INTEGRATING CYBERSECURITY INTO INTERNAL AUDIT THROUGH A SELF-ASSESSMENT TOOL BASED ON A SYSTEMATIC LITERATURE REVIEW

CERNOVSCHI Cristina-Raluca

Stefan cel Mare University of Suceava, România

Email: cristina.cernovschi09@gmail.com

CIUBOTARIU Marius-Sorin

Stefan cel Mare University of Suceava, România

Email: marius.ciubotariu@usm.ro

MIHAILA Svetlana

Academy of Economic Studies of Moldova

Email: svetlana.mihaila@ase.md

.

Keywords: internal audit, cybersecurity, innovative technology, assurance, cyber risks

Introduction

With the increasing assimilation of manual processes by intelligent technologies, cybersecurity is becoming an emerging topic among internal audit committees. The main risk factor of cyber-attacks is the misappropriation of a company's assets or the manipulation of data on a computer through the illegal use of hacking knowledge () and differs from other illegalities in that it takes place in cyberspace, not requiring the offender to move physically to the scene of the action. According to a report by analyzing the financial impact of data breaches globally, in 2024, cyberattacks cost companies an estimated $4.88 million, up 10 per cent from the previous year, and on top of that this was the highest since the pandemic. Cybercriminals operate with complicated and difficult to intercept schemes, and in these situations to which all entities that have included artificial intelligence in their business are exposed, internal audit is seen as a savior, due to the assurance role and independence of this department within an organisation. Our study focuses on the challenges integrating cybersecurity into their assignments and their chances of success. Through a careful literature review, we tried to summarize the added value that the internal audit department brings to the organisation in minimizing cyber risks. The results of our work materialized in a thematic framing of the research available to the general public so far in the Web of Science database, identifying three areas of interest: the role and updated competencies of internal auditors, risk minimization solutions developed following security breaches, and the factors leading to a quality cyber audit. This paper contributes to the literature, providing support to internal audit professionals, and aims to draw the attention of regulators to the lack of clear and up-to-date regulatory frameworks for the current context.

Literatur e review

Currently, most organisations store their information on IT infrastructures, from business partner details to financial data, leading to a reliance on virtual environments and thus increasing the vulnerability of companies to cybersecurity threats. In addition, the latest technological innovations, while offering multiple benefits, expose organisations to the risk of compromise of sensitive information. All this means that internal audit has to reconsider its mode of action and proactively engage in minimizing cybersecurity risks. In this context, the literature tries to cover as broad a scope as possible on the relationship between internal audit and cybersecurity.

Professionals in the field provide us with studies that trace internal auditing can help prevent data breaches; internal auditing should consider in its activity what cyber threats the company is facing, then it should propose the implementation of special programs for monitoring the company's digital behavior and develop a set of procedures for the use of cyberspace . Moreover, some authors () attempt to characterize internal auditors and assess their risk awareness, citing professional ethics, personality traits and rewards as influential factors in detecting cybersecurity issues. Similarly,(Jiang, 2024). auditors' rewards grow directly proportional to the company's exposure to attacks.

Also, to support internal auditors, researchers analyze the level of vulnerability of business sectors to risks associated with IT infrastructure, according to , the financial sector is considered the most prone to cyber-attacks because banks are additionally tasked with defending their financial assets. Analogously, (), manage to identify the most common attack methods that cybercriminals use on financial institutions (social engineering and phishing, ransomware attacks) and propose customized solutions for this industry (blockchain technology implementation) which in their opinion should be treated differently from the others for the direct impact it has on the economy. Furthermore, () find that if a company operating in a particular industry suffers a cyber attack, the whole industry is affected and the effects are usually reflected on reputation . In addition to reputation, the directly affected company faces costs related to IT repairs, legal expenses or business continuity disruptions. We can even find in the literature a guide proposed by Sánchez-García which he calls CRAG, and which contains 7 steps and 28 activities, accompanied by practical applications and implementation examples, as well as aspects to be taken into account when writing the audit report. based on risk management theory, presents processes and tools used in internal audit to assess and continuously improve cyber controls such as interdepartmental cooperation, continuous audit, or real-time monitoring. Consistent with the other context of smart technology development, Chin et al. (2025) built a cybersecurity auditing model based on an autonomous agent using Large Language Model, which can identify breaches of security policies such as password violations.

After reviewing the scientific sources dealing with cybersecurity and internal audit, we can conclude that although the main issues are touched upon, the dynamics of the subject mean that they cannot cover all aspects in depth. This conclusion stems from the fact that cybersecurity is a constantly evolving field, influenced by technological innovations, and the speed with which cyber attackers act. Therefore, in the following, we will give a complete overview of all the topics discussed at the moment to see in which areas there is still work to be done and where the literature has reached saturation point.

Met h odolog y

An important step in achieving the proposed goal is the choice of an appropriate research method, so to be able to present an overview of the involvement of internal auditors in reducing the threat of cybersecurity breaches, we considered it appropriate to use the SLR (systematic literature review) method, which consists of an analysis of all existing studies in a database on a given topic. In our case, we chose Web of Science as the documentation space and the search expression was "cybersecurity in internal audit". As to how the relevant studies were selected, we have included all the details in Table 1.

Source: own processing

As can be seen in the table above, the studies included in the analysis were conducted over a period of 9 years e also preferred to focus only on articles, 4 proceeding papers, 3 review articles and 2 early access were excluded. Our search was limited by open access to papers 14 studies dealing with the topic of adopting cybersecurity risks in annual internal audit plans, conducted in the years 2024 and 2025, were eliminated. Limiting open access influences the results as more recent studies that certainly contain novel approaches could not be included because they could not be fully analyzed. Refinement of the database resulted in 16 available studies that met all criteria each study was subjected to critical interpretation and thematically categorized. Specifically, we read all articles in their entirety, identified the purpose and outcomes, first extracted them all into a table, then based on keywords identified common purposes, and then created three thematic categories: the role of internal auditors in ensuring cybersecurity, determinants of effective cyber auditing, and practical examples of breach or audit. Each individual study has been classified into one of the three categories and discussed, so that in the end we can synthesize the current knowledge on integrating cyber risks into internal audit activities. The thematic coding process may include an inherent degree of subjectivity as it was done manually and not with the help of any computerized system. Based on the main findings of the 16 thoroughly analyzed studies, we constructed a self-assessment sheet on the need for integrating cybersecurity into internal audit processes addressed to the board of directors. The sheet is divided into 4 points of 5 questions each, the answer to which can be yes or no n case those who fill in the form feel the need to explain the answer, we have also created an explanation box. The structure and interpretation are drawn from the risk-based audit theory according to which the audit should correspond to the organisation's exposure and the effectiveness of control measures. The first item looks at the degree of exposure the more yes answers, the more exposed the company is, criterion number 2 looks at the measures a company takes to protect itself from cyber risks, and the last two criteria look at the positioning of the internal audit function and the qualities that the internal auditor should possess. A majority of yes answers in these last three sections means that the entity has understood the current context and has adapted to the new requirements, and a negative answer means that the internal audit function urgently needs to be reconfigured. Briefly, after analyzing the 16 studies, based on the scopes, we managed a thematic grouping of the trends in the field, and based on the extracted results we developed a self-assessment sheet on the understanding of the need to adapt internal audit processes in the context of cybersecurity.

Re s ult s and discu ss ion

The omnipresence of cyber risk and the financial losses created by data privacy breaches have led to the expansion of the work of internal auditors who are charged with providing independent assurance on the quality of information systems, procedures and strategy to mitigate cyber threats. In addition, the increasing pressures generated by the contagion of damage to other organisations operating in the same environment are driving the audit department to mobilize to prevent threats. proposals.Table 1 below lists studies that focus on the roles that internal auditors play in maintaining strong cybersecurity, the changes that have occurred in the work of auditors, and how three-dimensional internal auditing models have evolved from compliance to proactive engagement.

Source: own processing based on literature

The following table summarizes 6 studies indexed in the Web of Science database that emphasize the importance of internal auditing in maintaining cybersecurity in an organisation. The authors of these papers use mixed research methods, both conceptual analysis, interviews surveys questionnaires. All results have at their center the role of the internal auditor and the idea that traditional duties have become insufficient for today's user requirements. The common themes show that it is not enough for internal auditors to focus only on compliance with entity, state or other internationally mandated policies and procedures, but that they need to be actively involved in evaluating the organisation's strategies and acquire technical skills. This means assessing password generation policies, how passwords are managed, whether antivirus applications are up to date and working, and if signs of a cyber-attack occur, how employees respond. In addition, they need to conduct cyber-attack simulations to assess the resilience of prevention plans and come up with recommendations. In short, today's internal auditors need to do more than just check what's already been done; they need to help prevent problems before they occur. If we were to look at when the first studies on the role of the internal auditor in preventing cyber risks originated, the first year of publication is 2018. Coupled with the fact that in the same year the General Data Protection Regulation was also implemented and interpreted through or say that this research emerged as a response to coercive pressures that forced organisations to comply with these rules. With the implementation of this regulation, a number of new responsibilities have been placed on internal auditors, given that the subject of personal data is a sensitive topic that needs to be dealt with at the moment, the role of auditors is starting to tend towards strategic partner.

After having identified all the research that is only on the role of internal auditors in maintaining cybersecurity, the next aspect addressed by specialists in the field is related to practical examples, which present with the help of case studies both audit models tested in organisations and data breaches. These papers have been grouped in Table 3 for easier visualization.

Source: own processing based on literature

Examining the papers summarized above, we note the focus on situations that already exist in practice, ranging from evaluating cybersecurity audit models, to calculating financial losses from cyberattacks, to presenting methods of operating small and medium-sized businesses. Given that only three studies were included in this category, there is less emphasis on what already exists in practice. This disproportion indicates that the literature provides an overview but fails to identify implementation methods for varied operational environments. While the focus is on sophisticated cybersecurity auditing methods, it does not take into account the limited resources of SMEs and the fact that these methods can only be implemented by large enterprises. In addition, as regulations are not clear enough and internal auditors are new to cybersecurity auditing, there are few examples of models and none are customized to business sectors. We therefore see a need for studies targeted at real areas of application and believe that we need to pay more attention to already known incidences in order to learn from them.

The third and broadest category comprises 8 papers that share the common goal of identifying factors that influence the quality of an internal cybersecurity audit. The details have been summarized in Table 4, and in the following we aim to extract from the table the elements that value to the cyber audit.

Source: own processing based on literature

Upon further analysis of the information summarized in the table above, we conclude that several research studies highlight a gap between senior management's awareness of cyber risks and the actual level of integration of these risks into audit processes. Although boards of directors state that cybersecurity is a priority, they are not sufficiently engaged and there is a lack of adequate communication between management and the audit department. Also, another factor influencing the integration of cybersecurity into audit is the lack of technical skills of auditors, which contrary to expectations, is not given by certifications, as internal auditors who hold these certifications are not trained to assess IT systems, encryption, firewalls or responses to attacks. At the same time, we see that companies that have had at least one are more attentive and more open to accepting the idea that internal auditors should also take on the issue of cybersecurity. These companies are also willing to offer more to internal audit professionals to be more vigilant in their work. Therefore, the determinants of effective internal cyber internal audit mentioned in the studies are: the level of involvement of senior management, the existence of communication between internal audit and IT departments, the level of rewards given to internal auditors and the skills of internal auditors.

our study to have practical, not just theoretical, applicability, starting from the three thematic categories discussed by experts in the field: the role of the internal auditor in cybersecurity, organisational measures and response models as well as the determinants of an effective cybersecurity audit, we thought it would be relevant to develop a self-assessment tool to evaluate the degree of integration of cybersecurity in the internal audit process, a checklist type, with binary answers: yes or no, which we considered relevant to divide into 4 dimensions. The first dimension concerns how exposed the company is to risk, and the next three are themes identified in the literature. The questions were formulated by analysing the results and recommendations from each study, considering the challenges faced by companies, the construction of integration models, the elements breached during cyber attacks, and translating theoretical findings into practical applications. This self-assessment sheet will help organisations to see where they stand in relation to the guidelines, advices and models found in the literature.

Source : own processing

In setting the scores, we propose three appropriate levels for each dimension: low, medium, high, which are set according to the number of affirmative answers. We consider a low level when negative answers predominate, a medium level when the number of yes answers is 3, and a high level is equivalent to 4 or 5 yes answers. To interpret the per-set table, we will correlate the answers given for the first dimension with those for the other dimensions. According to these levels of each dimension, we logically interpreted the results, deriving 6 organisational profiles described in the following paragraphs:

Unexposed and unprepared organisation (0 positive answers at first dimension) Although their field of activity does not force them to protect themselves from cyber-attacks and they have not suffered any incidents, the lack of current exposure creates a false security, and in the current context, this profile is the most vulnerable to becoming the target of attackers if they do not invest in prevention measures and internal audit training.

Unexposed and Prepared Organisation(0 positive answers at first dimension) These companies are the most secure, although the risk is low, they have still chosen to protect themselves and involve internal audit in cybersecurity.

Exposedandunpreparedorganisation.(0-6 positive answers)- This type of entity is susceptible to cyber risks, lacking technical measures and internal audit involvement. In this case urgent decisions should be taken to integrate cybersecurity into the audit processes; the internal auditor should actively participate in the development of procedures and rules, should strengthen the relationship with the IT department in the shortest possible time and invest heavily in technical knowledge training.

Protected organisation but without governance: (7-11 positive answers). Entities this category are exposed to cybersecurity risks, have integrated measures, but internal audit is not actively involved. Therefore, organisations at this stage need to consider integrating internal audit into cybersecurity, as the existence of measures does not guarantee their effectiveness. Although the fact that the IT department is in charge of risk prevention, they do not provide independent assurance but are subjective. Auditors may point out that risks are not properly assessed Although not as urgent as in the first case, the reorganisation of the internal audit function needs to be done.

Exposed but aware organisation: (12-16 positive answers) For these organisations, a relationship between cybersecurity and internal audit is already starting to take shape, but it is still developing, it does not meet all the requirements and there is space for improvement. Internal auditors need to take their role more seriously, consolidate relations with the IT department, improve their security knowledge and continuously evolve a training plan.

Mature integrated organisation: (17-20 positive answers) The companies that are in this category have already integrated cybersecurity into their internal audit, trained auditors, well-developed measures and a high level of exposure. Internal auditors must continue to improve; procedures and controls require regular review and optimisation.

The present study aimed to analyze the integration of cybersecurity into the internal audit process through a systematic review of the literature. The first finding is related to the novelty of the topic; the relevant studies were published after 2017, and there are enough aspects not yet discussed. Starting from the 16 identified studies, in our research, we managed to compile the topics into three thematic categories, as we wanted to provide a more structured view of what it means to integrate cybersecurity into the internal audit process. Following this categorization, we could clearly see that the researchers' interests are focused on the reorganisation of the audit function, the skills needed by future professionals, and the financial impact that cyber criminals can cause to companies that neglect cybersecurity risk.

This study contributes to the literature by thematically structuring the research on internal audit and cybersecurity in three directions: role, measures, determinants that can be starting points for future analysis. On the application side, the self-assessment sheet and the 6 organisational profiles support organisations in understanding their own positioning and in implementing improvements in the relationship between internal audit and cybersecurity. In contrast to a simple checklist, the proposed tool has a comparative function as the questions are drawn from international literature reviews and organisations can benefit from an assessment against existing global trends and recommendations.

This research was constrained by open access to scholarly materials on the Web of Science platform, and since this study was conducted critical thinking, we consider the risk of arbitrary categorization, as some research included in the analysis was on the borderline between one category and another.

After examining the existing topics, we found that the issue of cybersecurity in underdeveloped or developing countries is treated superficially or example in Romania, such a topic has not yet been addressed, therefore we propose future research directions investigate the challenges faced by Eastern European countries. The factors that determine the effectiveness of a cyber audit should be studied individually and, last but not least, the need to update the regulatory frameworks should be emphasized. Additionally, to refine the proposed tool, future studies could focus on the practical application of the checklist and the comparison of profiles by business sectors.