Executive Summary Somewhere in the Caribbean this week, an executive will approve a payment for a “penetration test,” receive a hundred-page PDF full of colour-coded severity scores, file it with satisfaction — and remain exactly as exposed as before. What was purchased was almost certainly a vulnerability scan: a legitimate, useful, automated exercise that is...
Executive Summary The previous article in this series ended with a rule every well-governed board eventually adopts: for each material cyber assertion, the board must be able to answer “how do we know that is true?” Much of the answer flows through one function — internal audit. Yet in most Caribbean organisations, internal audit and...
Executive Summary The first two articles in this series established two propositions: cyber risk is an enterprise risk that belongs on the board agenda, and boards can only govern it with independent evidence — cyber assurance — rather than management’s unverified word. This third article addresses the people on whom both propositions land: the directors...
Executive Summary Ask the leadership of almost any Caribbean organisation whether it takes cybersecurity seriously and the answer will be yes — supported by a list of investments: firewalls, endpoint protection, an IT provider, security policies, perhaps a certification. Then ask a different question: how do you know any of it works? The room usually...
Executive Summary For most of the past two decades, cybersecurity in the Caribbean has lived in the IT department: a budget line for firewalls and antivirus software, a technical specialist’s responsibility, a subject the board touched once a year, if at all. That arrangement no longer matches reality. Cyber risk has become one of the...
There is a paradox at the centre of Caribbean public-sector governance. No class of organization carries more explicit, legislated internal audit obligations than the region’s public bodies — the statutory agencies, government companies, and authorities through which a substantial share of national economic life flows. Accountability frameworks across the region presuppose audit committees, functioning internal...
The annual audit plan rests on a quiet assumption that no one states aloud: that risk moves at the speed of a planning cycle. Book the inventory audit for March, the payroll review for August, the revenue work for November — and trust that the risks will be waiting patiently when the team arrives....
Somewhere in your organization, an algorithm is making a decision that used to belong to a person. It may be scoring a loan application, flagging a transaction, screening a job candidate, drafting a customer response, or summarizing a contract for an executive who will act on the summary. Caribbean organizations crossed a threshold over the...
For years, cybersecurity occupied a strange place on Caribbean audit plans: acknowledged as important, deferred as specialist, and scoped down to whatever the function felt qualified to look at — usually access forms and password policies. The Global Internal Audit Standards have ended that accommodation. Cybersecurity is the subject of the first Topical Requirement —...
Article 6 closed with a one-page exercise: the assurance map, showing which of an organization’s principal risks carry continuous assurance, periodic assurance, or none at all. Boards that complete it honestly usually discover the same two things. First, some risks are assured twice — tested by internal audit, reviewed by compliance, monitored by risk...
Dawgen Global is an integrated multidisciplinary professional service firm in the Caribbean Region. We are integrated as one Regional firm and provide several professional services including: audit, accounting, tax, IT, risk, HR, performance, M&A, corporate recovery and other advisory services
© 2026 Copyright Dawgen Global. All rights reserved. · Privacy Notice · Cookie Policy · Website Terms · Accessibility
Where to find us?
Stay ahead of Caribbean business
Receive our latest insights on tax, regulation, technology and the economy across the region.