For years, cybersecurity occupied a strange place on Caribbean audit plans: acknowledged as important, deferred as specialist, and scoped down to whatever the function felt qualified to look at — usually access forms and password policies. The Global Internal Audit Standards have ended that accommodation. Cybersecurity is the subject of the first Topical Requirement — a mandatory, standardized set of expectations that applies whenever cyber falls within an organization’s risk profile. And since no organization that banks online, runs cloud applications, processes card payments, or holds customer data can honestly say cyber is outside its risk profile, the practical effect is simple: cyber assurance is now a mandate, not an option. This eighth article in The Internal Audit Imperative™ explains what the requirement demands, why the Caribbean’s exposure is compounding, and how functions without deep cyber skills can still conform — credibly and affordably.

What the Topical Requirement Actually Demands

The cybersecurity Topical Requirement is deliberately structured, and its structure tells boards what to expect. It requires internal audit to assess three things: governance — whether the board and management have established clear accountability, strategy, policies, and reporting for cybersecurity; risk management — whether cyber risks are identified, assessed, and integrated into the organization’s wider risk processes rather than living in an IT silo; and control processes — whether the controls that matter are designed and operating: identity and access, vulnerability and patch management, data protection, backup and recovery, third-party and cloud security, incident response, and security awareness. Two features deserve emphasis. First, conformance must be demonstrable — assessors will look for evidence that the requirement’s elements were addressed, not merely that “cyber was on the plan.” Second, the requirement expects testing, not touring: inquiry and document review alone do not discharge it. Somebody must actually verify that the backup restores, the dormant accounts are disabled, and the patches are applied.

Why the Caribbean’s Exposure Is Compounding

Four regional dynamics make cyber the fastest-compounding risk on Caribbean risk registers. The digital transformation wave: core banking replacements, payments modernization, e-government platforms, and wholesale cloud migration are expanding the attack surface faster than control environments mature. Concentration: small markets depend on a short list of shared providers — telecoms, data centres, payment processors, managed IT firms — so a single third-party compromise can propagate across an entire sector. Talent scarcity: experienced security professionals are scarce and mobile, leaving many institutions with capable IT operations but thin independent security capacity. Attacker economics: ransomware operators deliberately target mid-sized organizations — large enough to pay, small enough to lack layered defences — which describes a substantial share of the region’s corporate landscape. Meanwhile, supervisory expectations are rising: financial regulators across the region increasingly examine cyber governance and resilience directly, and the Twin Peaks transition will sharpen that focus further.

The Board’s Cyber Assurance Gap

Most boards receive cyber comfort from exactly one source: the people who run the systems. IT reports that the firewall is current, the antivirus is deployed, and the last incident was contained — and the board, lacking an independent view, accepts it. This is the assurance map’s most common blank cell (Article 7 readers will recognize it): first-line security operations exist, but no second line monitors them and no third line tests them. The uncomfortable questions go unasked: When did anyone outside IT last verify a full restore from backup? Who reviewed the cloud configuration after the migration? How many privileged accounts exist, and who checked? If the payments provider is breached tonight, what happens at 6 a.m. tomorrow? A “we have a firewall and an IT manager” posture is not a control environment. It is a hope.

Cyber assurance is not about doubting the IT team. It is about giving the board something no operator can give: independent verification that the defences claimed are the defences deployed.

What Internal Audit Must Now Cover

Translated into an audit universe, the Topical Requirement implies a recurring body of work:

1. Cyber governance review. Board oversight and reporting, accountability and strategy, policy currency, and whether cyber risk appetite has ever actually been discussed — the highest-level, least technical, and most frequently failed element.
2. Risk assessment validation. Are the “crown jewels” identified — the systems and data whose loss would genuinely hurt — and does the cyber risk assessment connect to the enterprise risk process and the audit plan?
3. Technical control testing. Identity and access (privileged accounts, joiners-movers-leavers, dormant IDs), vulnerability and patch management, backup and verified recovery, and data protection — tested on real systems, with analytics where populations are large.
4. Third-party and cloud assurance. The regional concentration problem demands it: provider due diligence, contract and SLA security terms, cloud configuration review, and exit/continuity arrangements.
5. Incident response readiness. A documented plan, a tested plan, and a board that has rehearsed its own decisions — a tabletop exercise reveals more in three hours than a policy review reveals in three weeks.

The Capability Question — Answered Honestly

Few Caribbean internal audit functions employ penetration testers, cloud security engineers, or incident response specialists — and the Standards do not expect them to. What they expect is that the function obtains the competence its plan requires. In practice that means a co-sourcing model: the internal team owns the audit universe, the risk assessment, and the relationship with the board; specialist cyber auditors execute the technical testing under the function’s methodology; and findings flow through one report in the board’s language, not the vendor’s. Three disciplines separate good co-sourcing from expensive theatre: the specialists work under the internal audit charter (so independence and access rules apply); scopes are set by the organization’s risk assessment, not the provider’s product catalogue; and every technical engagement ends with a knowledge transfer that leaves the internal team more capable than it started.

Five Questions for the Next Board Meeting

1. Have we identified our crown jewels — and does anyone independently test the controls around them?
2. When was our last verified backup restoration — not the schedule, the actual restore?
3. How many privileged accounts exist across our systems, and who outside IT has reviewed them?
4. What assurance do we hold over our critical providers — telecoms, cloud, payments — beyond their own assurances?
5. Has this board ever rehearsed a cyber incident — including the decisions only we can make?

The Dawgen Perspective

Cyber is where the repositioning this series describes stops being conceptual. A back-office audit function samples access forms; a governance function tests whether the organization could survive Tuesday night’s attack and prove it to a regulator on Wednesday. The Topical Requirement, demanding as it is, hands boards a gift: a standardized, assessable definition of what adequate cyber assurance looks like — which means boards no longer have to design the question. They only have to insist on the answer.

Dawgen Global delivers that answer as an integrated service across 15+ Caribbean territories: co-sourced cyber audit under our internal audit methodology, technical control and cloud configuration testing by our cybersecurity practice, incident response tabletops facilitated for boards, and continuous cyber assurance dashboards under TRUST360™ — one engagement, one report, in the board’s language.

Next in the series: “Auditing the Algorithms: GenAI Governance, ISO/IEC 42001, and the New Audit Universe” — what happens when the systems making decisions are no longer merely computing them.

 

Turn the Cyber Topical Requirement Into a Plan Dawgen Global’s Cyber Assurance Programme delivers Topical Requirement conformance in twelve months: governance review, crown-jewel risk validation, technical control testing, third-party and cloud assurance, and a board-level incident tabletop — co-sourced under your internal audit charter, reported in your board’s language. Independent verification that the defences claimed are the defences deployed. Request Proposal   |  [email protected]  | Big Firm Capabilities. Caribbean Understanding.