Background:

With change in Technology the risk of cyber security is also increasing which can potentially disturb the Profitability and considerably can increase the risk of unauthorized access into the organizations system.

Internal audit plays a critical role in helping organizations manage cyber threats by providing an independent assessment of existing and needed controls.

It can assist in the defense through five critical elements that complement a successful cyber security strategy and response plan.

The five critical elements are:

1. What is a Cybersecurity audit?

A Cybersecurity audit or assessment is a comprehensive analysis and testing of an enterprises existing IT infrastructure, policies, and procedures.

It involves:

• Review of data policies within the company.
• Centralized Cybersecurity policies check.
• Compliance review of network structure and its operations.
• Review of hardware and software adherence to relevant standards.
• Analysis of the entire digital structure to review loopholes and probability for malicious cyber fraud/attacks.
• Review of IT security employees and their responsibilities.

2. Key Questions that an Auditor should ask about Cyber security preparedness.

• Is the organization able to identify whether an attack is occurring?
• Is the organization able to monitor suspicious network intrusion?
• Is the organization able to know whether confidential data is leaving the organization?
• If an incident does occur, is a written crisis management plan in place that has been tested and is in line with organizational risk?
• Can the organization isolate and restrict potential damage?

3. Role of Internal Audit in Detecting Cyber security Threats includes:

• Verifying risk-based approach: It is responsibility of Internal Audit to verify if cyber security effort is risk based approach properly identifies and mitigates the cyber risk.
• Regular Assessment and Testing of Controls: Internal audit should regularly assess and test the effectiveness of Cybersecurity controls. This can be done through internal audits, independent assessments, and penetration testing. Any identified control gaps should be addressed promptly.
• Providing regular reports on emerging Cyber security risks: Internal audit should be able to provide regular and comprehensive reports of both existing and emerging cyber risks in the organization, as well as recommendations to mitigate them.
• Detecting Cyber Security lapses: The primary role of detecting cyber security lapses and control issues falls to Internal Auditor. Threat intelligence, security monitoring, and behavioral and risk analysis are used to detect malicious or unauthorized activity.
• Preventing major Cyber-Threats: The responsibility of prevention of major cyber threats by identifying the opportunities to strengthen enterprise controls and assessing the organization’s capabilities in managing the associated risks lies with Internal Audit.
• Ensuring Compliance: Internal Audit is required to ensure that cyber security regulations, including SEC disclosure required are being met.
• Internal audit should check to ensure they are working effectively include:
• Biometrics, two factor and multi factor authentication enforced for every employee (e.g. entering password which is for example notified to your phone).
• Access levels are appropriate to the job role.
• Data leaving the organization is encrypted at external end points.
• Encrypting the data that’s stored in the databases.
• Know where your data is and who has access.

Conclusion :

Internal Audit helps out in finding out the Cyber Security lapses and detect the Malicious and unauthorized activity using threat intelligence, Security monitoring and risk analysis and also Ensuring Compliances.

Summarizing the above Roles of Internal Audit in Detecting Cybersecurity Threats we reach to the conclusion that with the rapid increase in Cyber risk the Internal Audit provides process a proactive approach of Verifying potential risk, Regular Assessments and Testing of Controls by providing regular reports on existing and emerging cyber security risks which further helps organization to reduce its exposure to Cyber risks.

Authors:

Umesh Vishwakarma

Manager | Email: umesh.vishwakarma@masd.co.in | LinkedIn

Ritik Prajapati

Associate Consultant | Email: ritik.prajapati@masd.co.in | LinkedIn