The aim of this paper is to analyze how effective internal audit of cybersecurity is. We developed a Cybersecurity Audit Index composed of three dimensions (planning, performing and reporting) to address this question. We hypothesize that CSA effectiveness is positively related to cyber risk...

We examine external auditors' decisions to use the evidence or direct assistance of internal auditors when those auditors engage in consulting on enterprise risk management. Although such consulting provides value to an organization, it can also put the objectivity and independence of internal...