Top Information Technology Audit Risk Considerations in 2023
May 26, 2023
As organizations continue to rely on technology to achieve their business objectives, information technology (IT) risks continue to evolve, becoming increasingly complex and challenging to many organizations. We are seeing a significant shift in the IT risk landscape, driven by emerging technologies, changing cybersecurity threats, and evolving regulatory requirements. How are you going to protect your company? Below are the top IT risk considerations for organizations to assess:
Emerging Technologies
The adoption of emerging technologies such as artificial intelligence, the Internet of Things, robotic process automation (RPA) and the proliferation of blockchain in everyday business finances is expected to continue to accelerate. While these technologies offer numerous benefits, they also introduce new IT risks that organizations must plan for and manage. For example, the implementation of RPA processes can expose sensitive data and systems to security threats. There is a misconception that automation does not require monitoring and human intervention. RPA solutions require appropriate access control, encryption and monitoring to protect data and maintain security. Governing bodies such as the U.S. Securities and Exchange Commission may pay closer attention to the impact of these technologies on financial reporting and the associated internal controls. IT auditors must ensure that organizations have appropriate controls in place to mitigate these risks.
Cybersecurity Threats
The threat of cyberattacks continues to be a top concern for organizations across all industries no matter their size. Public companies are encouraged to prioritize cybersecurity in their risk management and disclosure practices. Cybercriminals are becoming increasingly sophisticated, using advanced techniques such as ransomware attacks, phishing, and social engineering to gain access to sensitive data and systems. Usually, the weakest link coming from insider threats such as unauthorized access by employees, contractors and partners. Additionally, as more organizations move their operations to the cloud, the risk of cloud-specific cyberattacks is increasing. IT auditors must ensure that organizations have effective cybersecurity controls in place to prevent and detect cyberattacks.
Third-Party Risk Management
As organizations continue to rely on third-party vendors and service providers to support their operations, the risk of third-party breaches and data breaches is increasing. Some common risks associated with engaging with third-party providers include the delegation of authority, quality control and non-compliance to applicable laws and regulations. Companies may face challenges in managing and monitoring the adherence to their standards by third-party providers. In some cases, companies may be held accountable for any legal violations committed by their third-party providers, leading to potential fines, penalties, or legal disputes. The steps in performing proper due diligence and establishing clear service-level agreements are key when selecting third-party providers. IT auditors must ensure that organizations have appropriate third-party risk management processes in place to monitor and manage the risks associated with third-party relationships.
Evolving Regulatory Requirements
As the regulatory landscape continues to change, organizations must remain vigilant about compliance with new and evolving regulations. For example, the General Data Protection Regulation (GDPR) has been in effect for several years, but organizations must continue to monitor their compliance with the regulation’s requirements. Additionally, new regulations, such as the California Privacy Rights Act (CPRA) and the European Union’s ePrivacy Regulation, are expected to take effect in 2023, adding to the compliance burden for organizations operating or with employees in these areas.
Internal IT Control Environment
Finally, as a result of the ever-evolving risks described earlier, it is essential to consider the organization’s internal IT control environment more now than ever. A defined cadence to assess internal controls in order to maintain alignment with the business, technology and compliance changes is paramount. IT auditors must ensure that the organization has appropriate IT governance structures, policies, and procedures in place to manage IT risks effectively. Additionally, they must assess the effectiveness of IT controls and ensure that the organization has appropriate risk management processes in place.
How Cherry Bekaert Can Help
By focusing on emerging technologies, evolving regulatory requirements, cybersecurity threats, third-party risks, and the internal IT control environment, organizations can stay ahead of the curve and navigate IT risks effectively in 2023.
At Cherry Bekaert, our dedicated IT Audit professionals understand the IT universe and the current challenges with emerging technology integration, along with managing IT risk, financial reporting risk, compliance risk, and operational risk to help protect company assets, drive compliance, and increase stakeholder confidence.
For more information on establishing or enhancing your organization’s risk and IT programs, contact Cherry Bekaert’s IT Audit & Consulting Advisory practice or your Cherry Bekaert advisor.