Vaktechnische Publicaties

The World Business Council for Sustainable Development and The IIA collaborate to offer practical suggestions and examples for integrating sustainability considerations into the key roles and responsibilities within The IIA's Three Lines Model. This paper considers how environmental, social, and governance (ESG) threats and opportunities should be embedded into the Three Lines processes to ensure efficient and effective risk management and internal oversight.  

In an increasingly complex cyber environment organizations require, clear, robust cybersecurity controls and processes built on core fundamentals, including continuous learning about the risk and its related regulations, as well as communication and alignment among the board, management, and internal audit. This Global Knowledge Brief focuses on the development and implementation of an organization's cyber incident response strategy, and more specifically where internal audit can provide organizational value in assessing the controls critical to quickly recovering from a cybersecurity breach.  You can find part 1 here. You can find part 2 here.

Stability within the banking sector is crucial to preserve the trust that underpins a well-functioning economy. Government legislators and regulators globally have incorporated the Basel Framework, a composite of recommendations created after the 2007–09 financial crisis, into regulations for financial institutions.

The IIA's three-part Global Knowledge Brief series on cybersecurity presents an overview of the new SEC proposals, including the implications they have for cybersecurity reporting regulation in the U.S. as well as abroad. It also explores how internal auditors can play an important role in helping their organizations manage an altered compliance landscape that new regulations could soon create. You can find part 1 here.  You can find part 3 here.

Cybersecurity attacks are increasing as the tools for detecting and exploiting vulnerabilities in networked systems and devices become increasingly sophisticated or commoditized. Threatening technologies and methods are advanced by criminal enterprises, state-sponsored hackers, and others with malicious intentions. An organization’s stakeholders rely on independent, objective, and competent assurance services to verify whether cyber incident response and recovery controls are well-designed and effectively and efficiently implemented. The internal audit activity adds value to the organization when it provides such services in conformance with the Standards and with references to widely accepted control frameworks, particularly those used by the organization’s IT-IS functions.