1. Privacy compliance will be a key focus for internal audit

3. Boards will become more involved in cybersecurity. 
By providing an independent, objective evaluation of an organization’s existing controls, internal audit plays a crucial role in helping organizations manage potential cyber threats. However, with cyberattacks on the rise, security breaches at an all-time high, and new pressures from the SEC and PCAOB, cybersecurity is now becoming a top priority in boardroom discussions. Board members want to gain a comprehensive view of the risks both inside and outside of the organization. As involvement in cyber risks grow and board responsibility to adhere to the FTC’s increased standards of care becomes a concern, boards will rely more heavily on Chief Audit Executives (CAEs) and their IA team to communicate these risks and effective methods for countering them.
During these discussions, IA will need to educate board members on the steps taken to test the organization’s cybersecurity program to validate its effectiveness. Utilizing their knowledge of industry trends, risk management best practices, and business strategies, the IA team will recommend solutions to handle any detected risks before they become too large to address.
Based on the FTC’s Safeguards Rule, which requires a comprehensive information security program containing safeguards to collect and handle customer information, boards must also annually attest to the effectiveness of this program. IA will be the driving force in monitoring this program, updating its policies, and instilling confidence in the board’s verification. Boards looking to remain highly engaged in matters of cybersecurity and cyber threats will find a useful partner in internal audit.
4. More internal audit departments will use cybersecurity frameworks. 
One of internal audit’s objectives is to provide management with an independent assessment of an organization’s cybersecurity policies and procedures and their effectiveness. IA identifies regulatory deficiencies that could put the organization at risk, as well as the necessary internal controls to mitigate them. More than ever, organizations must balance the evolving threat landscape against their security program. In the coming year, this will be seen more often through the adoption of a cybersecurity control framework, which can serve as a baseline for an organization’s