Top priorities for internal audit professionals

Internal audit professionals are making strides in meeting cybersecurity and data privacy standards, according to Protiviti. Much work remains, with many of the surveyed organizations rating themselves as less than “very effective” at addressing their cybersecurity risks. However, the results are significantly better for organizations in which the board of directors has a high level of engagement with information security risks, and those that include cybersecurity in the annual audit plan.

“Across the globe, businesses are continuing to experience cybersecurity issues, challenges and breakdowns. Our survey shines a light on the evolving set of challenges faced by internal audit professionals as they work to incorporate cybersecurity frameworks into business processes,” said Brian Christensen, executive vice president, global internal audit and financial advisory, Protiviti. “Those professionals who continue to engage board members and define cybersecurity measures within their annual audit plans will be poised to effectively mitigate future threats.”

More than 800 internal audit professionals, including chief audit executives (CAEs), participated in Protiviti’s ninth annual survey to assess the top priorities for internal audit functions. Along with a review of cybersecurity management and processes, the survey assessed general technical knowledge, audit process knowledge, and personal skills and capabilities.

Protiviti’s survey shows a clear, positive correlation between a high level of board engagement in information security (30 percent of respondents) and an organization’s ability to acceptably manage cybersecurity risk.

There is a similar relationship between having defined cybersecurity measures in the annual audit plan and the successful management of cybersecurity risk. For example:

• Nearly half of organizations with a high level of board engagement (47 percent) rate themselves as “very effective” at identifying cybersecurity risk, compared to just 19 percent of other organizations.
• Seventy percent of organizations that include cybersecurity in the audit plan have a cybersecurity risk strategy in place, compared to 42 percent of other companies.

More than half of this year’s respondents (53 percent) note that cybersecurity evaluation has been included in their current audit planning. Of those organizations, 60 percent have used the NIST Cybersecurity Framework to measure and evaluate existing programs.

Across respondents, many CIOs have also taken particular interest in collaboration with the audit committee, reporting on both cybersecurity and IT related risks (43 percent).

In addition to enhancing skills in new technology and applications, internal auditors remain committed to increasing collaboration with other departments and functions in the organization. CAEs and internal audit professionals seek to improve and leverage their personal skills such as persuasion, their relationships with board members, and their internal and external networks in order to balance multiple priorities and strengthen the function’s strategic contributions to the organization.