The effect of internal audit on effectiveness in cyber security: Perceptions of internal auditors

With the development of digital infrastructure, information is stored, transactions are made and reports are prepared in this environment, which is expressed as cyberspace, which consists of elements such as the internet, computer systems, software, and hardware. Although this situation brings opportunities to the fore, it also carries risks of cyber attacks. Since cyber-attacks cause serious costs, taking precautions and reducing their effects is necessary. In this context, internal audit, which helps organizations to provide assurance to the management and board of directors that the organization's risk management and internal controls are effective, is of great importance, especially in terms of taking precautions against cyber attacks and reducing their effects. This study was carried out as quantitative research to reveal the perception of the effectiveness of internal audit in cyber security in universities from the eyes of internal auditors working in state and foundation universities in Turkey. Determining the current state of internal auditing in universities and identifying the deficiencies in internal audit and cyber security constitute the importance of the study. Research data were collected through an online questionnaire. In the study, descriptive factor analysis was performed and the factors of "Internal Audit and Cyber Security Perception", University Administration and Cyber Security Perception", "Internal Audit and Cyber Security Perception", "Cyber Security Knowledge Level Perception" and "Cyber Risk Management and Cyber Threats Perception" has been obtained. As a result of the study, it has been determined that increasing the necessary training and auditing related to information security, cyber security, and internal audit is an essential factor in providing internal audits against cyber risks. It has also been found that IT systems and tools can assist internal auditing by automating processes and tasks, improving risk management and internal controls, and helping organizations comply with laws, regulations, and industry standards.