ISACA urges swift audit reform from Government for digital resilience

The letter underlines strong stakeholder support for the Audit Reform and Corporate Governance Bill promised in the King’s Speech last year, but that has yet to be published.

Other signatories include CEOs from Airmic, CREST, Sheffield University’s Audit Reform Lab, the Chartered Governance Institute, CompTIA, the IASME Consortium, The National Preparedness Commission, NEDonBoard and Share Action alongside Sir Donald Brydon, Baroness Neville-Jones and Ciaran Martin, former CEO of the National Cyber Security Centre.

Dr Vladlena Benson MBE, director of the Aston Centre for Cyber Security Innovation, and Adrian Jolly (co-founder of the Institute of Corporate Resilience) have also signed the communication.

Enhanced powers 

ISACA, the Chartered Institute of Internal Auditors and signatories are calling for recommendations made by Sir John Kingman in 2018 and Sir Donald Brydon in 2019 to be rapidly implemented, including legislating to afford the UK’s audit regulator (ie the Financial Reporting Council) enhanced powers.

The letter also calls for the Government to enact wider reforms, ensuring that the UK’s largest companies are reporting on their resilience against digital as well as financial risks.

The signatories stress that the Government is already taking positive steps in the right direction when it comes to improving digital resilience. However, it argues that the UK must go further and faster. The US, the EU and Asia are already advancing similar audit reforms and, unless the UK Government acts, the nation “risks falling behind” on investment and digital governance, which would have wide-ranging economic ramifications.

Long overdue

Chris Dimitriadis, chief global strategy officer at ISACA, said: “Our letter to Government stresses that legislation and reform is long overdue. Failure to prioritise audit reforms will have a catastrophic impact on digital resilience, leaving our vital infrastructure and businesses vulnerable to regular technological disruptions, including by malicious attacks and threats. This will have major implications for the economy as well as privacy and data protection.”  

Dimitriadis added: “Alongside legislation, we must prioritise skills. The digital sectors including cyber, audit and privacy are plagued by skills gaps and understaffing. In fact, ISACA’s latest State of Cyber-focused study finds 40% of cyber and IT professionals feel that their job has become more stressful today than it was five years ago due to their teams being understaffed. This is having a real impact on businesses’ ability to protect themselves.”

Anne Kiem, CEO at the Chartered Institute of Internal Auditors, added: “We have witnessed multiple corporate failures connected to audit and governance deficiencies since the collapse of Carillion, with some of these companies completely lacking any internal audit capability. To tackle this, the Government needs to publish the long-awaited Audit Reform Bill and bring forward proposals for larger companies to publish Audit and Assurance Policies and Resilience Statements. This will drive growth and foster responsible risk-taking, while also enhancing digital resilience in an increasingly digital world.”

Bad actors

Bad actors are now increasingly using emerging technologies to identify vulnerabilities in systems and orchestrate effective attacks. Upcoming ISACA research results, due to be released later this month, finds that over two-thirds of European IT professionals are worried that quantum computing could break today’s Internet encryption before browsers and websites can fully implement new post-quantum cryptography algorithms approved by NIST.

Chris Dimitriadis continuedL “Digital transformation, driven by Artificial Intelligence (AI) and cloud computing, has increased the dependence on digital systems. One outage or breach can compromise entire networks, disrupting public services, threatening jobs and weakening investor confidence. We’ve seen this in high-profile cases such as last year’s Crowdstrike outage.”

He concluded: “It’s clear that rapid developments in AI and quantum are creating fresh challenges for digital resilience, highlighting the urgent need to bolster our defences. ISACA is looking forward to working closely with the UK Government to build a digitally resilient future.”