Internal Security Audits Crucial to Preventing Breaches: PwC

A strong internal audit can be the difference between catching a security failure and spending weeks and months doing a forensic investigation of a breach.

With this in mind, professional services firm PricewaterhouseCoopers (PwC) released a whitepaper outlining how internal audits have become a key pillar of security strategies in the age of data breaches and what companies can do to overcome some common hurdles to audit effectiveness.

"Internal audit departments need strong governance, which leads to respect, credibility and visibility," said Carolyn Holcomb, leader of PwC’s Risk Assurance Data Protection and Privacy practice. "If they don t have the right visibility or governance, they’re just not heard and unfortunately, this happens frequently."

Even with compliance regulations in place, most companies tend to do the minimum, so strong governance is important to make sure the regulations are effective at providing a level of security, she said.

In the whitepaper, the firm details a number of pitfalls audit efforts can face, such as the belief that adequate security measures are already in place or audits can be undercut by fragmented responsibility for security controls.

According to Holcomb, PwC is seeing a trend where companies are forming risk committees at the board level so that the committee can assess and understand the privacy and information security risks of the organization. Many businesses are looking externally for these individuals because they aren’t often found serving as board members, she said.

"Because information security and privacy can often be technical, individuals without experience in this area may not understand it," she said. "As a result, the auditors of information security and privacy may be communicating risks and concerns, but to senior management or boards who don’t fully understand and appreciate the risks."

In addition, she said, boards need to be more educated about the hacks their management teams are detecting and preventing to improve their understanding of the threat level. "Increased governance and visibility for the information security and privacy professionals within organizations and increased communication with the board can increase this education and awareness," she said.

This board-level support for audits is very important, she said, and roles and responsibilities for privacy and security with the management need to be defined. It is also important that the audit highlight and assess the organization’s significant data security and privacy risks and include any information about threats that may be on the horizon when it is presented to the audit committee, the firm noted in the paper.

To read the original eWeek article, click here: Internal Security Audits Play Critical Role in Preventing Breaches: PwC