Call us now:
Cybersecurity and Enterprise Wide Risk are at the top of the Audit Committee Agenda as cybersecurity risk management regulation transfers cyber risk into the boards rooms of covered entities. A risk that may receive more prominence if PCAOB proposals to address fraud and to oversight and assure cybersecurity risk move ahead.
If the Deloitte figures are correct the 69% of audit committees will put cybersecurity as a top-three priority in the next 12 months, 30% ranking it as a No. 1 priority. With cyberregulation such as the SEC final cyber rule, EU NIS 2 and DORA driving audit committees to assure cybersecurity, risk management and regulatory compliance.
What is of concern is that it is reported that 58% of audit committees have primary oversight of cybersecurity risks, with 25% of respondents saying the board has oversight responsibility. In ones opinion this cannot continue, boards are being regulated to oversight, assure and attest cybersecurity risk management. Regulation requiring boards adopt appropriate oversight, assurance and attestation of cyber risk across all three lines of defense, that includes internal audit. Committees provide different len’s through which cybersecurity risks are evaluated, this includes the audit committee but also the governance, cyber, finance, HR, risk and renumeration committees.
For the audit profession to provide oversight and assurance of cybersecurity risks, it will need to develop audit oversight and assurance frameworks and methods. A program that we at Veritas GRC, Ryan Buckner at Schellman and Rachel V. Rose, JD, MBA have started to develop.
The Institute of Internal Auditors Inc. ECIIA | European Confederation of Institutes of Internal Auditing
#cybersecurity #cyberriskmanagement #audit
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7191003705687650306