Auditing cybersecurity risks

Razali, Fazlida Mohd, Zaini, Muhamad Khairulnizam and Briliyant, Obrina ORCID: https://orcid.org/0000-0002-1054-8112 2026. Auditing cybersecurity risks. Shahimi, Suhaily, Mohd Razali, Fazlida and Mohd Nassir, Mohd Daniel, eds. Strategic Internal Auditing in the Digital and ESG Era, Boca Raton: CRC Press, pp. 104-137. (10.1201/9781003642381-9)

Full text not available from this repository.

Abstract

Cybersecurity has transitioned from an information technology issue to a board-level business risk requiring professional judgement over mere technical testing. This chapter provides a practical roadmap for internal auditors to move towards risk-based assurance, aligning technical findings with business impact. Drawing on Global Internal Audit Standards, the Institute of Internal Auditor’s Cybersecurity Topical Requirement, and frameworks like NIST and ISO 27001, it outlines how to scope audits, prioritise assets, and evaluate control effectiveness. The discussion highlights the “human factors” such as cybersecurity skills, confidence/efficacy, conflict management, and cybersecurity governance that dictate cybersecurity risk judgement quality and the reliability of risk assessment. Through a concise case study, the chapter equips audit leaders to enhance cybersecurity risk audit planning programmes by utilising artificial intelligence-powered audit planning. Ultimately, it demonstrates how internal audit can transform cybersecurity from a latent liability into a strategic organisational advantage through timely, decision-useful assurance.

Item Type:	Book Section
Date Type:	Published Online
Status:	In Press
Schools:	Schools > Computational & Mathematical Sciences Schools > Computer Science & Informatics
Publisher:	CRC Press
ISBN:	9781041077398
Last Modified:	02 Nov 2026 11:16
URI:	https://orca.cardiff.ac.uk/id/eprint/190569

Actions (repository staff only)

Edit Item