A poll of over 300 chief internal auditors working in both private and public sector organisations across Europe found that 66% cite cybersecurity as the key risk, followed by compliance (58%), data security and protection (58%), HR and people risk (42%) and regulatory change (37%).

Also on the top ten risks list, compiled from responses from France, Germany, Italy, the Netherlands, Spain, Sweden and the UK and Ireland, were digitalisation (36%), innovation (28%), culture (25%), outsourcing and third-party (24%) and political uncertainty (23%).

Dr Ian Peters, chief executive of the Chartered Institute of Internal Auditors (IIA), said: ‘Cybersecurity has been a high-priority risk for a number of years and this shows no signs of abating. However, companies are pushing to move away from legacy systems and, as approaches to managing cyber risk mature, attention is turning to third-party defensibility.

‘High-profile cyberattacks such as Petya and WannaCry are becoming more and more prevalent and this means that organisations are only as strong as the weakest link in their IT supply chain.’

The IIA is warning that a major obstacle to mitigating cyber risk is the piecemeal approach organisations have taken to their IT infrastructure planning and development over past decades. Poor governance and oversight of IT functions has meant businesses have gradually built siloed systems and bolted on parts of their network over a period when cyber risk was low.

It says it is important now that organisations turn to looking at outsourced or third party supply chains to ensure that they are not vulnerable to cyberattacks.

The Risk in Focus report is here

Report by Pat Sweet