Cyber security assurance process from the internal audit perspective

Abstract

Purpose The purpose of this study is to analyze the cybersecurity assurance approaches to determine the key issues and weaknesses within the internal audit and risk management perspective. Organizations increasingly rely on digital data to drive their growth and they are interconnected in a complex web to a multitude of stakeholders. Design/methodology/approach In this paper, cybersecurity is defined, and cybersecurity assurance model is explained based on the relevant literature. In addition, the role of internal auditing is introduced within this new business landscape. Finally, recommendations are made to provide best practices for stakeholders. Findings There are four major cyber-focused standards and frameworks in the current literature, namely, Control Objectives for Information and Related Technology, International Organization for Standardization, The American Institute of Certified Public Accountants and National Institute of Standards and Technology. In addition, there are many mechanisms in existence and operation currently which support cybersecurity assurance to prevent major threats. These include risk assessment, risk treatment, risk management, security assurance and auditing. Research limitations/implications Cyber risk is not something that can be avoided; instead, it must be managed. Hence, it is very important to maintain formal documentation on related cyber controls. Internal audit should be an integral part of cybersecurity assurance process, as internal audit have a unique position to look across organizations. The contribution of internal audit also provides comfort to the Board and Audit Committee. Practical implications A model is introduced how the internal audit and information security functions could work together to support organizations accomplish a cost-effective level of information security. The key issues and approaches are explained for how to become a trusted cybersecurity advisor and a sample cybersecurity awareness program checklist is provided at Appendix 1. Social implications Considering cybersecurity threats grow with speed, complexity, and impact, organizations are no longer satisfied with an answer to a question like “are we secure?” instead, they need the answer for such a question like “how to give a reasonable assurance that our business will be secure enough?”. In that respect, the role of internal audit is discussed based on the relevant literature and the current condition of the business environment. Originality/value A model is introduced how the internal audit and information security functions could work together to support organizations accomplish a cost-effective level of information security. The key issues and approaches are explained for how to become a trusted cybersecurity advisor and a sample cybersecurity awareness program checklist is provided at Appendix 1.

Cybersecurity in accounting research

“…The authors find that the association with forecast accuracy appears to be strongest for IT control weaknesses most directly related to data processing integrity Steinbart et al, 2012 The relationship between internal audit and information security Exploratory study. Steinbart et al, stated that the internal audit and information-security functions should co-operate synergistically (continued) Kahyaoglu and Caliyurt, 2018 Cyber security assurance process from the internal audit perspective Conceptual study. The authors concluded that cyber-risk must be managed and stated that it is very important to maintain formal documentation on related cyber controls and internal audit should be an integral part of cybersecurity assurance process, as internal audits have a unique capacity to look across organizations The role of internal audit and user training in information-security policy compliance Qualitative case analysis.…”

“…In related work, Kahyaoglu and Caliyurt (2018) examined the cybersecurity assurance process from the internal audit perspective. They developed a model to introduce the way in which the internal audit and information-security functions could work together to support organizations in accomplishing a cost-effective level of information security.…”

“…No. of citations Amir et al, 2018;Carré et al, 2018;Curtis et al, 2018;Ettredge et al, 2018;Gordon et al, 2018;Gyun No and Vasarhelyi, 2017;Islam et al, 2018;Kahyaoglu and Caliyurt, 2018;Li et al, 2018;Rahimian et al, 2016;Smith et al, 2018;Stafford et al, 2018 12 0-4 Bose and Luo, 2014;Gansler and Lucyshyn, 2005;Gordon et al, 2016;Gordon et al, 2008;Higgs et al, 2016;Steinbart et al, 2018;Steinbart et al, 2016;Steinbart et al, 20138 5-30 Abu-Musa, 2006Gordon et al, 2015a;Gordon et al, 2015b;Hausken, 2007;Kwon et al, 2013;Pathak, 2005;Steinbart et al, 2012;Wallace et al, 2011;Wang et al, 2013 9 30-90 Boritz andNo, 2005;Ettredge and Richardson, 2003;Gordon et al, 2010;Gordon et al, 2003;Gordon and Loeb, 2002;Hausken, 2006;Lainhart, 2000;Li et al, 2012;Tanaka et al, 2005 10 90 ! Table IV.…”

Effects of digitalisation of organisations on internal audit activities and practices

“…Digitalisation raises questions about the evolution of internal audit activities, which comes with a certain degree of complexity and uncertainty for organisations (Schoemaker et al, 2018). The digitalisation of the business environment makes business processes more complex (Nuijten et al, 2015) and people are increasingly using digital devices, networks and cloud computing (Kahyaoglu and Caliyurt, 2018). This environment, where big data are continuously generated and new technologies constantly emerge, is increasingly interconnected with organisational systems (Appelbaum et al, 2017;Flora and Rai, 2015).…”

“…However, although some internal auditors can be torn between the added value of consulting activities for management and the preservation of their independence, they still perform consulting activities to bring additional value to organisations (Betti and Sarens, 2020). For example, internal auditors could play a more proactive role in the early stages of implementing new IT developments (Kahyaoglu and Caliyurt, 2018) or when implementing new technologies (Flora and Rai, 2015). Internal auditors could also provide advice and insight on cybersecurity programmes and risk prevention (Dixon and Singer, 2011;Kahyaoglu and Caliyurt, 2018), thereby performing more consulting activities.…”