CFO Brew helps finance pros navigate their roles with insights into risk management, compliance, and strategy through our newsletter, virtual events, and digital guides.

CFO Brew

Natasha Piñon

cfobrew.com

 SEC cracks down on two investment advisors for ‘AI washing’ 

AI washing gets hung out to dry. 

SEC cracks down on two investment advisors for ‘AI washing’ 

Alex Zank

In SOTU, Biden backs higher taxes on corporations, wealthy

The president's speech sets campaign themes. 

Courtney Vien

Companies aren’t as ready for ESG regs as they think they are

There are still gaps between their ESG goals and their capabilities.

A clipboard with a checkmark icon denoting financial compliance

Compliance

Whether it’s due to regulations (paging the 10,000 orgs facing the EU’s new 

), pressure from stakeholders, or strategic imperatives, many organizations are expanding the scope of their carbon emissions reporting. That is, they’re preparing to report Scope 3 supply-chain emissions, if they haven’t already.

Scope 3 involves upstream and downstream emissions beyond a company’s own operations, including purchased goods, transportation and distribution, leased properties, investment, and employee travel and commuting. Reporting these emissions is much more difficult for organizations because it requires more sophisticated and complicated methods to gather and decipher data, according to experts.

“A whole challenge here is that all of this data falls outside [organizations’] operational boundary,” Alyssa Zucker, senior industry principal at Workiva, told CFO Brew.

Some companies that do business in the European Union have to report Scope 3 emissions to comply with the Corporate Sustainability Reporting Directive, although European lawmakers are in the process of 

 the requirements. California regulators will require companies doing business in the Golden State to start reporting Scope 3 emissions in 2027, and Canada will require financial institutions to start reporting Scope 3 emissions in 2028.

One passenger glaringly missing from the Scope 3 regulatory train is the US government. The SEC last year dropped Scope 3 from its 

 what was left of that rule after it stopped defending it in court.

Other companies may feel pressure to report Scope 3 emissions not from regulators, 

Organizations that decide to skip Scope 3 reporting requirements risk fines from regulators as well as reputational damage, according to Sasha Matovic, North America regional lead at the Partnership for Carbon Accounting Financials (PCAF).

“If investors are looking at [climate disclosures] and are scrutinizing what you’re putting out there, [skipping them] is not great for your reputation,” Matovic said at Workiva’s annual conference in September.

Measuring Scope 1 direct emissions and Scope 2 indirect emissions from energy purchases might feel like a cakewalk compared to Scope 3. It’s easier to gather data that’s internal or comes in the form of an electric bill, Zucker explained. Tracking Scope 3 emissions requires data from outside parties, meaning the quality of and access to that data “is very much outside your control.”

Imagine, for instance, working for a lender that writes commercial vehicle loans. Scope 3 emissions would include emissions from all the vehicles purchased with loans your firm wrote, according to Zucker. “It’s incredibly challenging” to get that kind of information, she explained.

Fortunately, there’s a standard for that.

 Enter the Greenhouse Gas Protocol, which sets global greenhouse gas accounting and reporting standards for organizations to follow. There are also sector-specific standards like those PCAF designed for financial institutions.

These standards provide a “hierarchy” of measuring emissions “that start with really broad estimates” and get more precise as organizations’ data collection gets more sophisticated, Zucker said. The ramp-up in methodology means “that it’s going to take you a fair amount of effort, and time, and investment” to gather more granular data.

 The data gathering may be complex, but it’s certainly not impossible. Take Ikea, for example. The global furniture retailer 

 approximately 21 million tons of Scope 3 emissions in fiscal year 2024. Sources included business travel, food ingredients (Swedish meatballs, anyone?), and customers using its products at home.

But how exactly does Ikea figure out the carbon footprint of something like emissions related to product usage at home, which makes up roughly 17% of its entire greenhouse gas inventory? Ikea noted that this number came from how much energy its lighting, appliances, and electronics require, plus emissions from burning its candles. The company multiplied the energy consumption required of a product “with that of the national electricity grid” for the country where the product was sold. It calculated the carbon footprint of its candles by multiplying the weight of the wax “by the specific emission factor for combustion for the specific wax.”

 Often, companies will start reporting their supply chain emissions because of regulations. But after that headache of data gathering and reporting is over, some organizations find “they can make more informed decisions” with all this data in front of them, according to Zucker. “That kind of shift toward the strategic advantage is what we see as you are able to build some capacity around this and unlock the value beyond compliance,” she said.

Take the clean energy transition as an example.

Matovic said Scope 3 “financed emissions are a good measure of transition risk” for financial institutions. This is particularly relevant at a time when AI data centers demand massive amounts of energy, and sustainable sources are “the cheapest and quickest way to deploy energy.”

Ikea uses its emissions data to track its 

. The company says it’s committed to cutting its value chain greenhouse gas emissions in half by fiscal year 2030, and by “at least 90%” by 2050, compared to its 2016 emissions. That can’t be done without measurement.

What it takes to gather all the data needed for Scope 3 reporting

All the data headaches aside, there’s a huge strategic advantage to having this info, experts said.

SEC Chair Paul Atkins says he doesn’t want the SEC to undergo policy shifts in future administrations (guided by a less deregulatory philosophy than his).

“We can’t have a ping-ponging back and forth,” Atkins, the Trump-appointed SEC chair, said at a recent event hosted by the Managed Funds Association (MFA), a trade group representing alternative asset managers. “That doesn’t do anyone any good.”

His comments were in response to a question from Bryan Corbett, president and CEO of MFA, who said that each new presidential administration creates “significant swings” in regulatory priorities, and that “makes it very hard for businesses to plan [and] to spend on the right systems.”

The nonprofit advocacy group Better Markets slammed President Donald Trump’s nomination of Atkins to head up the agency earlier this year. Dennis Kelleher, Better Markets’ president and CEO, said in a March 

 that Atkins “has a remarkably long and disreputable record of being vigorously if not adamantly opposed to the very reasons the SEC exists.”

At the MFA event on Oct. 7, Atkins said he plans to “future-proof” his deregulatory agenda, in part by implementing new rules “early enough.” This would give the private sector time to implement required changes, he claimed, and make the rules harder to repeal or change under future administrations.

He also said that recent and pending court decisions will help further define and limit the agency’s authority. Atkins pointed to one such recent ruling from the conservative Fifth Circuit Court of Appeals, which “require[d] the SEC to assess the costs and benefits” of a Biden-era rule on 

, as well as another case pending in the Eighth Circuit involving the SEC’s climate-reporting rule, which the agency 

At the MFA event, Atkins thanked the court system for its rulings so far and said, “I wish the Eighth Circuit would rule” on the climate disclosure case. However, the court last month said it was putting the case on 

 until the SEC decides what it’s going to do with the regulation. SEC Commissioner Caroline Crenshaw, currently the commission’s only Democrat, said in March that the SEC’s announcement that it would no longer defend the climate reporting rule was “bad governance.”

Atkins said, regarding the court decisions so far, “this builds up a really good judicial type of track record” by limiting regulatory agencies in ways he says “are extremely important.”

Paul Atkins, former Commissioner of the U.S. Securities and Exchange Commission under President George W. Bush, arrives at Trump Tower. Credit: Drew Angerer/Getty Images

Paul Atkins plans to ‘future-proof’ his deregulatory agenda at the SEC

Doing this depends on quickly implementing his agenda and asking the courts to support it.

Jesse Klein

It’s the spookiest time of year: when compliance regulations mysteriously disappear. After months of campaigning by the largest member states of the EU, the lawmakers working on the ESG regulations have consented to “major cuts to a set of sustainability directives,” 

The threshold for companies that will have to comply with the Corporate Sustainability Reporting Directive (CSRD) and the Corporate Sustainability Due Diligence Directive (CSDDD) was increased from 250 employees to 1,000 employees for the CSRD and 5,000 for the CSDDD. A previous increase to the CSRD threshold cut the number of in-scope companies by 80%; now it’s 

. And for the CSDDD, the increase cuts the number of companies that need to adhere to the rules by 70%.

The CSRD requires these companies to show how their business activities affect the environment and their own financial status using the European Sustainability Reporting Standards, disclose energy usage and emissions metrics, and complete due diligence on labor issues like human rights abuses in their supply chains. However, the current cut removes the human rights reporting requirement for companies or their supply chain partners with under 1,000 employees.

While the CSRD regulates ESG reporting, the CSDDD requires that companies actually address issues as well as create transition plans for climate change mitigation in accordance with the Paris Agreement’s goal of climate neutrality by 2050. Under the CSDDD, in-scope companies have to dive into supply chains to root out human rights abuses and limit environmental impacts.

 and would stymie European businesses, decreasing their global competitiveness. French and German businesses have been among the most outspoken critics, and the US Chamber of Commerce 

 “unprecedented regulatory overreach” that could impact American companies.

 from federal climate regulations, as the SEC decided in March not to defend its own rule in court. David Peavler, a partner at Jones Day, 

 last year that US companies would probably default to the European regulations, as they’re among the most rigorous. But with this rollback overseas, more businesses will be free from disclosure requirements both at home and across the pond.

Sustainability-focused groups feel the “cuts have gone too far.” In a statement to Bloomberg, Beate Beller, EU senior campaigner at Global Witness, wrote, “EU lawmakers have handed big business a free pass.”

Discussions on the final agreement are scheduled to begin next week, with the goal of concluding by year’s end.

EU makes more cuts to ESG compliance rules 

New rules will increase thresholds for reporting companies from 250 to 1,000 or 5,000 employees.

Optimism among small business owners in the US dropped 2 points in September, falling to 98.8 from 100.8 in August, according to the National Federation of Independent Business’s latest sentiment index.

September’s dip marked the first decline of its kind in three months, though the NFIB noted the optimism index “remains above the survey’s 52-year average of 98.” Amid the 

, investors, economists, and policymakers are turning to 

For a sense of how small business owners are feeling, supply chain woes and inflation concerns were some of their most pressing issues in September, per the report. Nearly two-thirds of respondents said 

 “were affecting their business to some degree.”

As a result, 31% of owners anticipated raising prices in the next three months, marking a 5 point increase from August, according to the NFIB.

“While most owners evaluate their own business as currently healthy, they are having to manage rising inflationary pressures, slower sales expectations, and ongoing labor market challenges,” Bill Dunkelberg, the NFIB’s chief economist, said in a statement.

Small business owners are also dealing with the elephant in every boardroom: 

. The NFIB’s uncertainty index for September climbed seven points, moving up to 100. That marked “the fourth-highest reading in over 51 years,” the organization noted.

“Although uncertainty is high, small business owners remain resilient as they seek to better understand how policy changes will impact their operations,” Dunkelberg said.

They’re not too confident about the immediate future, though: The share of small business owners expecting better business conditions dropped 11 points month over month to 23%.

Small business sentiment dipped in September

Around a third of small business owners expect to raise prices in the next three months, according to the National Federation of Independent Business. 

The legal blows just keep coming for Johnson & Johnson, providing a stark reminder for finance and risk leaders that product liability risk can get real expensive, real quick.

A jury in Los Angeles recently ordered the consumer products giant to pay $966 million to the family of a woman who died of mesothelioma, Reuters 

. The plaintiffs alleged, and the jury agreed, that J&J’s talc products were to blame. This amount includes $16 million in compensatory damages and $950 million in punitive damages.

The company said it plans to appeal. In a statement, Erik Haas, J&J’s worldwide VP of litigation, called the verdict “egregious and unconstitutional” and claimed the plaintiffs based their arguments on “junk science.”

This is far from the end for J&J’s talc troubles, as it still faces more than 90,000 pending lawsuits, 

In March, a federal judge blocked J&J’s attempts to settle its talc lawsuits through a scheme that involved the company transferring all its talc-based liabilities to a newly created subsidiary and having that subsidiary declare bankruptcy, the Times noted.

J&J stopped selling talc-based products globally in 2023, but even in announcing that decision, it maintained that talc-based products were free from asbestos and did not cause cancer.

Exterior of Johnson & Johnson corporate office building

Johnson & Johnson slapped with $966 million verdict in California talc case

It looks like the talc trouble is far from over for the consumer products maker.

Drew Adamek

As the ancient proverb goes, fall down seven times, stand up eight. At least that’s what seems to be the mantra at the Internal Revenue Service.

Treasury Security Scott Bessent named Frank Bisignano, the head of the Social Security Administration, as “chief executive officer” of the IRS. It’s the first time the IRS has had a CEO, and the announcement came after the tax agency had already cycled through seven leaders this year.

Bisignano will apparently run both the IRS and the Social Security Administration. Bessent is currently acting commissioner of the IRS, having taken the reins after former IRS commissioner Billy Long 

The move to name Bisignano CEO, a title that hasn’t previously existed at the IRS, appears to be designed to avoid “a potentially lengthy Senate confirmation process to fill a leadership vacuum at IRS as it prepares for filing season and tries to integrate massive changes to tax law from Trump and the GOP’s 

. Multiple acting commissioners were named during the first months of the Trump administration, including three in a single week in April. One Elon Musk-supported commissioner 

 before Trump changed his mind and installed another Bessent pick.

Former auctioneer Billy Long was confirmed as IRS commissioner in mid-June, but was canned in August.

The hamster wheel at the top of the IRS comes as the agency’s inspector general 

 that IRS staffing cuts by the Trump administration could make the 2026 filing season difficult. The IRS has let approximately 

 go so far this year, many in critical positions for return processing.

The IRS now has a…CEO?

The top spot merry-go-round continues at the tax agency.

Internal auditors have marked generative AI as a leading priority and are putting their money where their mouth is in reviewing their organizations’ use of the technology.

GenAI is now the second-highest priority of internal audit teams, behind only cybersecurity, according to professional services firm Jefferson Wells’s latest 

 survey. GenAI moved up three spots after making its first appearance in the top five in 

More than one-third (35%) of the survey’s 257 respondents—audit leaders at US-based for-profit companies—identified GenAI as a top risk. Just over two in five (41%) said cybersecurity was a top risk.

The survey findings show “the pressing need for Internal Audit functions to adapt to swift advancements in AI,” among other challenges, Tim Lietz, national practice leader for risk and compliance at Jefferson Wells, said in a statement.

Audit leaders aren’t just thinking about GenAI risks; they’re acting on it.

 They made this apparent throughout the survey.

For instance, two-thirds of audit leaders said they’re “auditing GenAI use, including its governance,” according to the survey. And just over half of respondents said they’re including AI in their technology risk assessments, up from 30% in 2024.

Nearly three in five (59%) of organizations that have added headcount to their internal audit teams “are doing so because of increased audits into the use of Gen AI alone,” the survey revealed.

The survey contained other nuggets of information.

 About one-quarter (26%) of respondents cited economic uncertainty as a top risk, shooting up from nearly zero last year.

A sizable chunk of internal audit leaders also confessed their teams still aren’t hip with the latest auditing standards. Some 58% of internal audit departments have either “substantially implemented” or “fully implemented” the Institute of Internal Auditors’ new global standards, which were effective on Jan. 9. This is “despite the IIA granting a full year adoption period” beginning in January of last year, Jefferson Wells noted.