The Effectiveness of the Assurance and Consulting Roles of Internal Audit in Managing Cybersecurity Risks: Perspectives of Internal Auditors in Joint-Stock Companies

The research aimed to examine the effectiveness of both the assurance and consulting roles of internal auditing in managing cybersecurity risks from the perspective of internal auditors in joint-stock companies. This was achieved by assessing the effectiveness of the internal audit’s assurance role in managing cybersecurity risks in joint-stock companies listed on the financial market, as well as the effectiveness of their consulting role in the same context. To achieve the research objective, the researcher employed the deductive approach to derive research hypotheses by analyzing previous studies related to the topic, along with the inductive approach to examine practical realities, test the validity of the hypotheses, and draw conclusions. A purposive sample of 200 internal auditors from Saudi joint-stock companies listed on the financial market was selected. Out of these, 186 valid questionnaires were retrieved and analyzed using the Statistical Package for Social Sciences (SPSS) version 30. The study reached several key findings, most notably the high level of effectiveness of the assurance role of internal auditing in managing cybersecurity risks, as perceived by the respondents. Similarly, the results revealed a high level of effectiveness of consulting role of internal auditing in the same context. Among the most significant contributions were regular audits of cybersecurity policy compliance, use of advanced security technologies to protect data, assistance in identifying security vulnerabilities, and providing recommendations to address them. The study also revealed a statistically significant impact of the internal audit’s consulting role in managing cybersecurity risks in joint-stock companies listed on the financial market. The study recommended that internal auditing departments in joint-stock companies should actively participate in discussions on cybersecurity risks with the board of directors and relevant committees and should also evaluate the effectiveness of the cybersecurity controls implemented within the company.