Information technologies and cybersecurity in internal audit: A review in Borsa Istanbul companies

Cybersecurity activities are under the responsibility of business management. When cybersecurity activities are carried out, the biggest supporters of business management are undoubtedly internal audit departments. There are three main purposes of this study. The first aim of the study is to determine the levels of cybersecurity activities of public companies operating in Turkey and to determine whether the levels of cyber security differ according to the characteristics of companies. The second aim is to determine the effectiveness of the cybersecurity activities of the internal audit departments, which serve as the third line of defense in companies, and to determine whether the cyber security activities of the internal audit units differ according to the characteristics of the companies. The final aim of this study is to determine whether there is a relationship between the levels of cybersecurity activities of companies and the effectiveness of cybersecurity activities of internal audit units. 222 internal auditors operating in public companies listed on Borsa Istanbul participated in the survey conducted for this purpose. As a result of the analysis, cybersecurity activities levels of public companies were determined, and it was concluded that cyber security levels differ according to the characteristics of the companies. In addition, the effectiveness of the activities of the internal audit units regarding cybersecurity was determined and it was determined that the effectiveness of the activities of the internal audit units regarding cybersecurity differ according to the characteristics of the companies. Finally, it has been concluded that there is a very strong and significant relationship between the cybersecurity activities levels of companies and the effectiveness of the activities of internal audit units regarding cybersecurity. Keywords: Internal Audit, Information Technologies, Cybersecurity, Cybersecurity Governance, Triple Line of Defense