There is a staffing issue in payment security planning. The controls are typically designed without the presence of those who truly grasp the financial impact of a breach.
Finance Owns the Risk, Not Just the Budget
When a data breach happens, the costs are not part of the IT budget. Fines, legal fees, remediation work, and fraud-related chargebacks are all booked directly to the P&L. The global average cost of a data breach was $4.45 million in 2023, 15% higher than three years previously (IBM Cost of a Data Breach Report 2023). That’s a financial event, not a technical one, and it should be the sponsorship of the CFO from the outset.
Chargebacks are a good example of where this gap causes real damage. When fraudulent transactions lead to disputes, finance is left to argue the chargebacks and shoulder the losses with no seat at the table to discuss the controls that should be in place to stop them happening. The fraud liability shift, which determines who pays when card fraud occurs, is agreed in the small print of merchant services agreements, which finance should be reading in concert with legal, but rarely are.
The Annual Validation Cycle Needs Finance Co-Leadership
PCI DSS compliance is not a one-time event. Most merchants re-certify annually, based on a Self-Assessment Questionnaire (SAQ) or an audit, depending on the volume and value of their transactions. The SAQ process resembles the financial audit process: you self-attest to your compliance and provide records to evidence that compliance. A formal pci audit is conducted by a third party, but the process is the same: prove that your controls are implemented as you say they are.
The information security team often “owns” PCI at a merchant, with IT doing the heavy lifting and the business side often only tangentially involved until something goes wrong. The security team often doesn’t have any overlapping relationship with the finance team. Many merchants also don’t really have a risk officer who would naturally own both or at least bridge the gap. That’s exactly why finance should be co-leading the annual validation cycle, the preparation work of pulling records, reviewing vendor contracts, and confirming control documentation is current is what finance does every year for external auditors anyway.
PCI DSS is a Controls Problem, and Finance Knows Controls
The Payment Card Industry Data Security Standard approach is built around access controls, documentation, audit evidence, and segregation of duties. These aren’t foreign concepts to a finance team. They’re the same disciplines finance runs every year for the financial audit, and in many companies, for Sarbanes-Oxley compliance as well.
Finance teams already know how to maintain audit trails, document processes, retain evidence for auditors, and manage the cycle of preparation, review, and sign-off. The structure of PCI DSS compliance maps almost exactly onto that workflow. The difference is that security teams are often left running this process alone, without the institutional knowledge about documentation and evidence management that finance has built up over years.
Bringing finance into payment security compliance isn’t asking them to learn something new. It’s asking them to apply what they already do.
Defining Scope is a Finance Problem Too
One of the most important decisions within any PCI DSS card data security program is determining the scope of the environment in which card data resides. This involves identifying each and every system and process that store, process, or transmit card data. Scope it too narrowly and you’ve left gaps; scope it too broadly and you’re expending unnecessary resources holding controls over systems that don’t process card data.
Finance teams have clear line of sight into exactly where and through what systems and processes payment data flows through the organization. It goes through their accounting systems, the corporate ERP platforms, reconciliation and reporting processes and often through many of the other tools utilized by the finance team. Finance is often one of the only, if not the only, department(s) within the organization that can clearly trace that entire path. Yet, in most organizations, the scope is determined by IT, they see the technical infrastructure but what they often do not see is how the card data begins to surface from within these financial/ERP systems and or determine how it hits the various financial workflows.
A finance department that has a clear understanding of the PCI DSS requirements can then sit in a room with the compliance department and assert that “this financial system/ERP/integration touches/reaches out and processes card data as part of the reconciliation and or payment process and therefore it must be in scope”. This is not a technical judgment. No one is saying the card number is showing up in a server log for this reconciliation function. It is, instead, a business process judgment, a judgment that finance is actually better positioned to make.
Vendor Oversight and the Budget Case For Security
Finance often manages the relationships with payment processors and acquiring banks. Those vendor agreements include compliance obligations and penalty structures that finance needs to understand. Third-party processors and payment gateways create shared compliance responsibilities, if a vendor has a gap in their controls, it can affect your compliance status. Vendor risk management in the payment security context belongs on finance’s radar.
Budgeting is the other piece. Tokenization), encryption tools, and ongoing compliance maintenance all need funding. Security teams often struggle to justify these line items because they’re not framing the spend against quantified financial risk. Finance can make that argument, but only if they understand what the spend is for and what the controls are meant to prevent.
Cyber insurance is tightening too. Carriers are requiring evidence of security controls as a condition of coverage, and PCI compliance status is part of that picture. Finance should be verifying that the company’s compliance posture actually supports the coverage they’re paying for.
Where to Start
The easiest way for finance to engage is to invite them to the next PCI compliance planning meeting before you start getting ready, rather than after there are issues. Once finance knows what’s required and what evidence is necessary, they can do their part to identify financial risks early, be part of the decision on what’s in scope, and ensure some of that unnecessary work is completed to the satisfaction of the auditors.
Payment security doesn’t need a different team. It needs the right teams working together from the beginning.
