Five stories this week, in priority order.
Story 1: The Fed held rates, and two officials wanted an increase
The Federal Open Market Committee voted 10 to 2 on October 28 to keep the target range for the federal funds rate at 3-3/4 to 4 percent. Lisa D. Cook and Beth M. Hammack voted against the decision. Both preferred to raise the range by 1/4 percentage point at this meeting. The statement says economic activity is expanding at a strong pace and that "Inflation remains elevated." It says uncertainty remains elevated, in part because of geopolitical developments, and that the accumulation of more information will help the Committee determine the policy stance needed for a timely return of inflation to its 2 percent goal. It does not say what the Committee will do at its next meeting. The next day, the Bureau of Economic Analysis reported that real GDP grew at an annual rate of 3.4% in the third quarter, up from 2.2% in the second.
Why it matters: two voters wanted a rate increase now, and the statement does not rule one out. No increase has been decided. If one comes, borrowing priced off a floating short-term rate, such as many credit lines and term loans, will cost more.
What to do this week: list every borrowing facility with a floating rate, with its balance, reset date and any rate cap or hedge. Rerun 2027 interest expense with rates 0.25 and 0.50 percentage points higher, and ask your banker what it would cost to fix the rate on your largest balance.
Source: Federal Reserve, FOMC statement, Oct. 28, 2026 • U.S. Bureau of Economic Analysis, GDP advance estimate, third quarter 2026, Oct. 29, 2026
Story 2: Employer compensation costs rose 3.4% over the year
The Bureau of Labor Statistics reported on October 30 that compensation costs for private industry workers rose 3.4% in the 12 months ended September 2026, not seasonally adjusted. Wages and salaries rose 3.1% and benefit costs rose 3.9%. Within benefits, health benefit costs rose 6.4%. After inflation, private industry wages and salaries fell 0.6% over the year. Compensation costs in manufacturing rose 3.2%. For the three months ended September, compensation costs for civilian workers rose 0.8%, seasonally adjusted. The next release, for December, is scheduled for January 29, 2027.
Why it matters: this is the government's measure of what employers pay for labor, not a forecast. Benefits rose faster than wages, and wages fell after inflation. Employees whose pay rose about 3% this year lost ground, which may come up in 2027 pay reviews.
What to do this week: compare the wage increase in your 2027 budget with the 3.1% national figure, and show benefits as a separate line from wages. Decide which roles, if any, will get more than the standard increase, and price that before the budget is final.
Source: U.S. Bureau of Labor Statistics, Employment Cost Index, September 2026, released Oct. 30, 2026
Story 3: Ransomware group SafePay has hit at least 600 organizations
CISA, the FBI and the U.S. Secret Service, with international partners, issued a joint advisory on October 20 about the SafePay ransomware group. CISA says the group has affected at least 600 organizations in multiple critical infrastructure sectors since August 2024, in North America, South America, Europe and Australia, and calls it one of the most active ransomware groups. It gets in through exposed credentials, brute force password attacks, abuse of VPN access, phished accounts and automated scripts that exploit known vulnerabilities in edge devices and other internet-exposed systems. It may disrupt recovery by deleting shadow copies and resetting network-attached storage devices that hold backups. Its double-extortion model includes data theft, encryption, threats to publish stolen data and, in some cases, direct phone contact with victims. The agencies recommend patching systems regularly, especially VPNs, firewalls and other edge devices, fixing known exploited vulnerabilities quickly, and using multifactor authentication.
Why it matters: the group goes after the backups a company would use to recover, and stolen data can still be used for extortion after systems are restored. Downtime, recovery costs and any ransom demand fall on the finance budget.
What to do this week: ask IT for written answers to three questions: does every VPN and remote access account require multifactor authentication, when were the firewalls and VPN devices last patched, and is at least one backup copy kept offline or unchangeable, with a restore tested this year. Then check what your cyber insurance policy covers for ransom, downtime and data theft.
Source: CISA, joint cybersecurity advisory AA26-293A on SafePay ransomware, Oct. 20, 2026
Story 4: Microsoft adds accounting skills to Copilot
Microsoft announced on October 29 more than 25 new finance skills and partner-built plug-ins for its Copilot assistant. They include accounting capabilities in Copilot in Excel and in Cowork for reconciling accounts, preparing journal entries and analyzing performance against plan. The accounting capabilities are available in Frontier, Microsoft's early-access program, and the announcement gives no date for general availability and no pricing. Partner plug-ins, including ones for Intuit QuickBooks, Xero and Zoho Books, are beginning to roll out through Microsoft's plugin registry. Microsoft says drafted journal entries come with checks for required inputs and balanced entries, that users can start an audit trail whenever they use an accounting capability, and that Copilot honors existing permissions. It says finance professionals retain control of the decisions, approvals and actions that follow. Microsoft says that during a seven-day limited Insiders release, more than 8,000 users invoked the accounting skills more than 44,000 times.
Why it matters: these tools are coming to the spreadsheets and accounting systems small finance teams already use. The control descriptions are Microsoft's claims. We have not seen independent testing of their accuracy.
What to do this week: ask IT whether these features can be turned on in your Microsoft 365 tenant and who decides. Before anyone uses Copilot to draft journal entries, write down who reviews and posts them, and require the audit trail to be on.
Source: Microsoft, "Microsoft Copilot for finance: Purpose-built for the way finance teams work," blog post by Brian Jones, Oct. 29, 2026; vendor announcement
Story 5: AICPA proposes AI criteria for SOC 2 reports
The American Institute of Certified Public Accountants (AICPA) announced on October 28 a proposed update to the System and Organization Controls (SOC) 2 Trust Services Criteria, which an independent CPA uses to examine a service organization's controls over security, availability, processing integrity, confidentiality or privacy. The proposal consolidates duplicative concepts and removes some criteria. It adds new points of focus on AI governance, model monitoring, prompt manipulation and data poisoning, along with transparency of AI-generated outputs, training data management and risks from automated decision-making. Comments are due January 15, 2027. If approved, the criteria would apply to engagements beginning on or after December 31, 2027, with early adoption permitted.
Why it matters: companies often rely on SOC 2 reports from payroll, AP and cloud software vendors to judge those vendors' controls. The proposal is not final, and reports under the new criteria are more than a year away. Until then, a vendor's report may say little about how it governs the AI in its product.
What to do this week: list the vendors that use AI on your financial data, such as AP automation, expense and payroll tools. At your next review of each one's SOC 2 report, ask the vendor how the report covers its AI features today and who reviews their output.
Source: AICPA, press release and exposure drafts, proposed 2027 SOC 2 Trust Services Criteria, Oct. 28, 2026
The CFO Operating Brief is published by PCS Insight, LLC. Content is general operational guidance for finance leaders and does not constitute investment, legal, tax, or accounting advice.