The quality of cybersecurity audits: do synergies among the chief audit executive, IT governance and internal audit functions matter?

Abdulaziz Alzeban, Krayyem Al-Hajaya, Nedal Sawan, Houda Chammaa and Scott Foster

Managerial Auditing Journal, 2025, vol. 41, issue 2, 322-349

Abstract: PurposeThis study aims to investigate how the internal audit function helps boost an organisation’s cybersecurity quality. The authors focus on the key roles played by the chief audit executive (CAE) competencies in terms of their IT expertise, qualifications and tenure, their interaction with the audit committee (AC), the organisation’s IT governance structure and the role of internal audit (IA) in overseeing cybersecurity.Design/methodology/approachData were collected via a survey questionnaire distributed to internal auditors and audit committee members in UK-listed companies, supplemented by relevant archival data where appropriate.FindingsPanel regression findings, validated across both CEAs and AC members, reveal that CAE IT expertise, private CAE-AC meetings and robust IT governance significantly improve cybersecurity quality. Crucially, each additional year of IT audit expertise increases perceived cybersecurity quality by approximately 0.30 units, confirming the high value of deep IT audit expertise. Additionally, IA’s role in policy review, regulatory compliance and risk assessment strengthens cyber resilience.Practical implicationsThe findings carry important practical implications for organisations, regulators and society. Strengthening IT competencies within internal audit, fostering private dialogue between CAEs and audit committees and embedding cybersecurity into corporate governance frameworks can significantly improve resilience. Beyond organisational benefits, enhanced cybersecurity audit quality supports consumer protection, safeguards privacy and reinforces public trust in digital infrastructures such as health care, banking and government services, aligning with global standards like the General Data Protection Regulation (GDPR) and the National Institute of Standards and Technology (NIST) Cybersecurity Framework.Originality/valueThe study makes an original contribution to the literature by examining how synergies among the CAE’s IT competencies, interaction with the audit committee, IT governance and internal audit functions shape the quality of cybersecurity audits.

Keywords: Internal audit; Cybersecurity quality; Chief audit executive competences; Audit committee; IT governance (search for similar items in EconPapers)
Date: 2025
References: Add references at CitEc
Citations:

Downloads: (external link)
https://www.emerald.com/maj/article/41/2/322/13222 ... -audits-do-synergies (text/html)
https://www.emerald.com/maj/article-pdf/41/2/322/10919794/maj-05-2025-4825en.pdf (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:eme:majpps:maj-05-2025-4825

DOI: 10.1108/MAJ-05-2025-4825

Access Statistics for this article

Managerial Auditing Journal is currently edited by Professor Jie Zhou

More articles in Managerial Auditing Journal from Emerald Group Publishing Limited
Bibliographic data for series maintained by Emerald Support ().