Why Internal Audit & IT Should Fight Together Against Cyber Breaches

Updated as of 8/5/19

Why Cross-Collaboration Matters

Effective cybersecurity management requires cross-collaboration between multiple stakeholders and becomes increasingly complex with larger organizations. Though technology can serve as a solution to mitigate security risk, oftentimes the solution requires personnel or procedures that have been strategically implemented. For that reason, internal audit groups are of great use in creating a robust security environment.

Cybersecurity is about ensuring the safety of networks, devices and data. Due to the increasing number of devices connected to the network and volume of data transmitted across internal systems, strong policies and procedures coupled with firm corporate oversight are more important now than ever for organizations.

Due to this complexity, organizations must build and maintain a suite of information security policies, procedures, and standards that govern the organization, a task which increasingly requires collaboration between stakeholders from every department. At the center of the security effort should be an internal audit team that drives security awareness, adoption, documentation, and implementation of controls  to ensure systems and data are secure.

Internal Auditors and Cybersecurity

Organizations looking to establish a strong security program have a number of different standards to choose from, each of which require some level of interaction with internal audit teams. Key standards incorporating auditors include:

Consider the GDPR regulation, established by the European Union. The rules are complex and some are open to interpretation, however IT alone will prove unsuccessful in addressing the requirements. Legal, finance, and other departments must also be involved in the definition and implementation process. Having a strong internal audit team that understands the importance of security and regulatory requirements will help address this challenge.

As another example, consider the increasing complexity involved with system connectivity and data transmission between third party and partner environments. Is the data transmitted between environments adequately secured when transmitted or stored at rest? In an increasingly connected world, internal auditors can work to evaluate partners and ensure compliance with cybersecurity requirements in order to minimize these types of risk.

From a financial and budgetary standpoint, internal audit also plays a critical role in conducting cost/benefit analysis of the cybersecurity plan and selection of equipment, personnel, resource allocation, and other key factors that drive the security program.

Addressing the Internal Audit and Information Technology Gap

Though internal auditors represent a key success factor in building a security program, interdepartmental projects sometimes present a challenge. Part of the problem is that internal audit has not typically had a strong focus on technology or security controls. Historically, internal auditors have focused on financial regulatory compliance, not necessarily security compliance. As a result, many internal audit teams within organizations are composed of people with finance and accounting backgrounds who possess experience auditing financial controls. Given the previously distinct functions of IT and auditors, the need to integrate those departments can often create tension.

Chief Audit Executives (CAEs) are aware of the challenge. For instance, the 2019 North American Pulse of Internal Audit, by The Institute of Internal Auditors, notes that, “Despite organizations uniformly identifying cybersecurity and cyber awareness as key risk priorities, CAEs have significant concerns about cyber and IT risk to their organizations. Nearly 7 in 10 (68 percent) rated the risk as high or very high for cyber and more than half (53 percent) rated the risk as high or very high for IT.”

A survey result from the Pulse report shows this challenge.

This challenge also presents an opportunity for collaboration between IT and internal audit teams. Improving communications between these teams will lead to more thorough security examinations of the security program, mitigate risks, and set a precedent for continuous security operations. This requires support from executive management and a firm governance structure that ties IT to internal audit. 

Executives need to better understand both the cyber threats facing the organization and the security mechanisms that have been implemented to address these risks. Without executive input and sponsorship, the friction between IT and internal audit will create information silos, disparate communicate channels, and increase the attack surface for threat actors looking to exploit vulnerabilities that exist within the organization.

Executive oversight and a strong governance structure will ensure stakeholders understand their roles and responsibilities in the security program. After establishing and documenting the governance structure and communication channels, leadership should ensure it is reviewed and updated on a periodic basis to ensure it aligns with the security program and changes to the environment.

Conclusion

Creating a symbiotic relationship between IT and internal audit is a necessary initiative for a company's cybersecurity program to be effective. Because of internal audit's need to understand upcoming tech changes and IT's need to understand ever-changing internal and external policies and procedures, creating an effective cybersecurity program must involve collaboration across both departments. By working in conjunction with one another, each team is able to bring their subject matter expertise to the table. Ultimately, this partnership will lay the foundation for a secure cyber program that can more effectively prevent and manage future breaches.

Apptega and the Cybersecurity Team

Apptega was designed to help organizations easily build, manage, and report on cybersecurity compliance. With 12+ security frameworks to choose from, users can build a security plan in seconds that aligns with their business, including mapping multiple frameworks together into a blended framework. 

Apptega provides automated alerting, task workflows, and detailed reporting capabilities that simplify collaboration across IT, Security, Audit, and Executive teams. Ultimately, having a central platform to manage security compliance, communication between stakeholders, and serve as a system of record for the security program will mitigate risk and decrease the time to complete assessments and drive financial benefits through reduced audit costs and increased efficiencies.. 

To find out more, schedule a demo today.