The Influence of Internal Audit on Information Security Effectiveness October 5, 2013 Perceptions of Internal Auditors Graham Gal With Paul Steinbart, Robyn Rascke, and Bill Dilla

University of Waterloo Symposium on Information Integrity and Information Systems Assurance Outline Previous Work Method and Hypothesis Results Implications

University of Waterloo Symposium on Information Integrity and Information Systems Assurance Previous Work Impact of monitoring on information security – Monitoring of controls reduces risk (R & M 2009) – Monitoring as an enabling process (ITGI 2012) – Relationship between IFOSEC and IA Compliance with SOX (Wallace et al. 2011) Infosec perceptions of effectiveness (Steinbart et al. 2013) Frequency of interaction Knowledge of domain – Incidents – Findings

University of Waterloo Symposium on Information Integrity and Information Systems Assurance Method and Hypothesis Tested Data Collection – Web Based Survey Subjects -42 – Certifications (98%) – Work Experience (74% > 10 years) – Type of firm For profit 82% Across industries 42% financial services 26% Health/Education/Professional Services

University of Waterloo Symposium on Information Integrity and Information Systems Assurance Hypothesis Tested H1: Internal auditors’ perceptions about the quality of the relationship between the internal audit and information security functions will be positively related to the number of audit findings related to information security. H2: Internal auditors’ perceptions about the quality of the relationship between the internal audit and information security functions will be negatively related to the frequency of security incidents. H3: The frequency of internal audit reviews of various aspects of their organization’s information security activities will be positively associated with internal auditors’ perceptions about the quality of the relationship between the internal audit and information security functions. H4: The frequency of internal audit reviews of various aspects of their organization’s information security activities will be positively associated the number of audit findings related to information security. H5: The frequency of internal audit reviews of various aspects of their organization’s information security activities will be negatively associated with the number and severity of security incidents.

University of Waterloo Symposium on Information Integrity and Information Systems Assurance Relationship Quality Quality of Relationship between information security and internal audit Members of information security and internal audit work together to assure information systems are secure and reliable There is little friction between internal audit and information security The relationship between internal audit and information security staff is close and personal There is a good working relationship between internal audit and information security

University of Waterloo Symposium on Information Integrity and Information Systems Assurance Frequency of Internal Audit Review of Info Security Quality of Relationship between IA and Infosec Top Management Support Outcomes (Findings and Security Incidents) H3 *** H1 & H2 H4 & H5 ***

University of Waterloo Symposium on Information Integrity and Information Systems Assurance Frequency of the Review Internal Audit Reviews of Information Security Topics: Business Continuity and Disaster Recovery Identity and Access Management Logging and System Monitoring Firewalls and Other Network Access Devices Encryption policies (including key management) Backup Procedures Change Management Controls Security Policies

University of Waterloo Symposium on Information Integrity and Information Systems Assurance Frequency of Internal Audit Review Financial Items Quality of Relationship between IA and Infosec Top Management Support Outcomes (Findings) H3a *** H1 & H2 H4a *** Frequency of Internal Audit Review Technical Items H5a *** ***

University of Waterloo Symposium on Information Integrity and Information Systems Assurance Frequency of Internal Audit Review Financial Items Quality of Relationship between IA and Infosec Top Management Support Outcomes (Incidents) H3b *** H1 & H2 H4b Frequency of Internal Audit Review Technical Items H5b ***

University of Waterloo Symposium on Information Integrity and Information Systems Assurance Implications Frequency improved perceptions of quality of relationship – Similar to our previous work – IA mean of overall frequency implies could be more involved Impact on outcomes – Relationship is improved by frequency – No mediated impact on outcomes (findings or incidents) – Decomposed types of reviews “Softer People Oriented” and “Technical” reviews impact findings “Softer People Oriented” and “Technical” reviews do not impact incidents