Internal auditors challenged by cybersecurity, data quality

By Ken Tysiac

About half of internal audit leaders lack confidence in their staffs’ cybersecurity expertise, and nearly half say internal audit has little or no involvement in evaluating the quality of data used in their organization, according to a new survey.

Fifty-two percent of the nearly 500 respondents to The Institute of Internal Auditors (IIA) North American pulse survey said that a lack of cybersecurity expertise among internal audit staff very much or extremely affects internal audit’s ability to address cybersecurity risk.

Just one-quarter of respondents who reported having a business continuity plan said their plan provides clear, specific procedures in response to a data breach. And 17% said their plans provide no data breach or cyberattack procedures at all.

With regard to cybersecurity, internal audit organizations primarily are focused on prevention. More than half (53%) of respondents said prevention efforts, such as hardening interior or external barriers, are the most effective method for addressing a cyberattack.

“In the face of a cyberattack, addressing business continuity and reputational risk are paramount, yet few organizations are taking time to think beyond prevention,” IIA President and CEO Richard Chambers said in a news release. “The IIA has been promoting cyber resiliency—the concept of addressing the full spectrum of prevention, detection, reaction, and restoration—for some time, so these findings are particularly alarming.”

Meanwhile, 47% of respondents said internal audit is slightly or not at all involved in evaluating the quality of data used in their organization. Nearly one-quarter (23%) said they are slightly or not at all confident in their organizations’ data-based strategic decisions.

Other findings

  • The percentage of internal audit chiefs who report functionally to the audit committee or board of directors has risen (83%, up from 76% in 2013).
  • More than one-third (35%) project increases in their next internal audit budget, and more than half (55%) expect their next budget to remain the same as the current budget.
  • One-fourth expect internal audit staffing to increase, and 71% project that staffing will remain the same.

Ken Tysiac (ktysiac@aicpa.org) is a JofA editorial director.

SPONSORED REPORT

Time to prepare for overtime changes

As an employer, trusted business adviser, or HR professional, you will need to be aware of exemption guidance, record requirements, advice for clients, and typical problems in applying overtime pay.

QUIZ

News quiz: Good news on pay and benefits for accountants

CPAs can find much to like in recent reports, including news that their expertise and skills are in such demand that pay is expected to rise and that their employers value professional certifications.

CHECKLIST

Bolster your data defenses

As you weather the dog days of summer, it’s a good time to make sure your cybersecurity structure can stand up to the heat of external and internal threats. Here are six steps to help shore up your systems.