vulnerability assessment and internal audit

Executive Summary The previous article in this series ended with a rule every well-governed board eventually adopts: for each material cyber assertion, the board must be able to answer “how do we know that is true?” Much of the answer flows through one function — internal audit. Yet in most Caribbean organisations, internal audit and...