The Influence of Internal Audit on Information Security Effectiveness Perceptions of Internal Auditors Graham Gal With Paul Steinbart, Robyn Rascke, and Bill Dilla October 5, 2013

Outline Previous Work Method and Hypothesis Results Implications University of Waterloo

Previous Work Impact of monitoring on information security Monitoring of controls reduces risk (R & M 2009) Monitoring as an enabling process (ITGI 2012) Relationship between IFOSEC and IA Compliance with SOX (Wallace et al. 2011) Infosec perceptions of information security efforts (Steinbart et al. 2013) Frequency of interaction Knowledge of domain Incidents Findings

Method and Hypothesis Tested Data Collection Web Based Survey Subjects -42 Certifications (98%) Work Experience (74% > 10 years) Type of firm For profit 82% Across industries 42% financial services 26% Health/Education/Professional Services

Hypothesis Tested H1: Internal auditors’ perceptions about the quality of the relationship between the internal audit and information security functions will be positively related to the number of audit findings related to information security. H2: Internal auditors’ perceptions about the quality of the relationship between the internal audit and information security functions will be negatively related to the frequency of security incidents. H3: The frequency of internal audit reviews of various aspects of their organization’s information security activities will be positively associated with internal auditors’ perceptions about the quality of the relationship between the internal audit and information security functions. H4: The frequency of internal audit reviews of various aspects of their organization’s information security activities will be positively associated the number of audit findings related to information security. H5: The frequency of internal audit reviews of various aspects of their organization’s information security activities will be negatively associated with the number and severity of security incidents.

Frequency of Internal Audit Review of Info Security Quality of Relationship between IA and Infosec H3*** H1 & H2 H4 & H5 Outcomes (Findings and Security Incidents) Top Management Support ***

Frequency of Internal Audit Review Financial Items H3a*** Quality of Relationship between IA and Infosec Frequency of Internal Audit Review Technical Items H4a*** H5a*** H1 Outcomes (Findings) Top Management Support ***

Frequency of Internal Audit Review Financial Items H3b*** Quality of Relationship between IA and Infosec Frequency of Internal Audit Review Technical Items H4b H5b H1 Outcomes (Incidents) Top Management Support ***

Implications Frequency improved perceptions of quality of relationship Similar to our previous work IA mean of overall frequency implies could be more involved Impact on outcomes Relationship is improved by frequency No mediated impact on outcomes (findings or incidents) Decomposed types of reviews “Softer People Oriented” and “Technical” reviews impact findings “Softer People Oriented” and “Technical” reviews do not impact incidents