Cybersecurity and data privacy are top internal audit risks

The inability to fully leverage the potential of technology in areas such as cybersecurity or data governance due to a lack of expertise is seen as one of the key risk factors for internal auditors going forward.

In a recent report from cloud solutions provider AuditBoard, cybersecurity and data privacy were seen as especially relevant: When looking ahead to 2023, 54% of internal auditors said this was a "very high" risk area while a further 29% said it represented a "higher than average" risk. Only 17% of respondents felt it was either an average risk or less-than-average risk. When looking further to 2026, the perceived risk landscape changes little, as cybersecurity and data privacy were still seen as either a top risk or a higher-than-average risk by more than 70% of respondents.

Internal auditors do not expect these risks to dissipate — indeed, they are expecting that they will grow even stronger as the years go on. The risk presented by "advanced technologies" in particular are expected to grow from well above average in 2022 to "very high" risk by 2026. However when it comes specifically to cybersecurity and data privacy risk, while levels are expected to remain quite high through 2026, they are expected to reduce (very) slightly.

When it comes to the particular risks associated with technology, respondents said there was not enough expertise in leveraging technology for the internal audit process. At least part of this comes from concerns that there is not enough talent with the necessary skills.

"This should be a wake-up call for internal audit leaders: Investing in talent and technology is critical to bolstering internal audit efficacy and efficiency. Upskilling staff and vetting and implementing the right technology solutions for your audit function are no easy feats. But when executed properly, fine-tuning
these resources can substantially enhance internal audit's ability to perform its responsibilities and add value to the business," said the report.