The UK Government’s Cyber Security Breaches Survey 2016 found that whilst 69% of businesses say their senior management consider cyber security to be a very or fairly high priority for their organisation, only half of businesses have actually taken recommended actions to identify cyber risks.

Dr Ian Peters, IIA chief executive, said: ‘Our latest board briefing note addresses the lack of understanding of the response that is required to the rising threats to cyber security. A key element of that response must be cultural, as well technological.

‘Cyber security starts with the board and our briefing note suggests how internal audit can help them gain a true picture of the efficacy of their organisation’s cyber security measures.’

Looking ahead, Peters pointed to the Network and Information Security (NIS) Directive and General Data Protection Regulation (GDPR), which come into force in April and May 2018 respectively.

These regulations place significant obligations on many organisations in the public and private sectors, and threaten potentially substantial fines for contraventions. Although these are EU regulations, both will be transposed into UK law and will require businesses to meet exacting data protection standards.

‘Our organisations have not taken this issue seriously enough. New EU regulations will now compel us to act. We have to be informed and ready for this – both leadership and internal audit,’ Peters said.

 The IIA’s cyber security board briefing is here.