Cyber security essentials for internal auditors

Upon completion you will be able to:

• Understand core cybercrime and cybersecurity concepts
• Recognise key cyber threats and vulnerabilities
• Identify essential security controls and best practices
• Understand the auditor's role in assessing basic cyber risks within the UK regulatory
  context.

Module 1: Cybercrime and Security Fundamentals
• What is Cybercrime? (Concise definition, key examples: phishing, ransomware, data
breaches)
• Why Cybersecurity Matters for Auditors:
o Impact on financial/operational integrity.
o Regulatory focus (UK GDPR).
o Reputational risk.
• Core Security Concepts: CIA triad 

Module 2: Key Cyber Threats and Vulnerabilities
• Phishing and Social Engineering:
o Recognition, impact, and the human element.
• Ransomware:
o Basic understanding and impact.
• Data Breaches:
o Common causes, focusing on internal risks.
• Brief overview of cloud and mobile risks.
• AI & Deepfakes – social engineering & bypassing controls.
• Remote working and public Wi-Fi

Module 3: Essential Security Controls and the Auditor's Role
• Key Controls:
o Password management and MFA (emphasise importance).
o Access control (principle of least privilege).
o Remote working securely (including Wi-Fi).
o AI considerations & controls.
o Endpoint Security.
o Data backup (brief overview).
o Software Patching.
The Auditor's Role:
o Assessing control effectiveness (practical examples).
o Understanding UK GDPR and NCSC guidance.
o Reporting considerations.
o How to ask the correct questions.

Q&A

• Environment (Information technology)