The role of intrusive auditing in enhancing cybersecurity risk governance: A field study on a sample of Iraqi banks

Abstract

This research aims to develop a theoretical framework for enhancing the role of internal auditors in strengthening cybersecurity risk governance in Iraqi banks. The most important conclusion is that internal auditing plays a crucial role in enhancing cybersecurity risk governance in the Iraqi banks included in the study sample. This is achieved through integrating cybersecurity into risk-based audit planning and enterprise risk management, and by assessing the adequacy of cybersecurity policies, incident response plans, and access controls. The study recommends that Iraqi banks enhance the training and professional development of internal auditors on the latest cybersecurity technologies and best practices, and that they regularly review and update their governance policies to align with international standards.