What is the role of the Internal Audit Quality Assurance and Improvement Program in cybersecurity engagements?

• A. Perform only external assessments.
• B. Ensure conformance with IIA standards, drive process improvements, perform internal/external assessments, and monitor performance indicators for cyber audits.
• C. Manage day-to-day IT operations.
• D. Provide legal counsel.

Answer: (B)

Quality Assurance and Improvement Program for internal audit establishes the standard for how cyber security engagements are planned, executed, and reported. It ensures the audit activity conforms with IIA standards and the code of ethics, driving ongoing process improvements across cybersecurity audits. It also requires both internal assessments of the audit function and external assessments at appropriate intervals to obtain independent validation of quality. In addition, it involves monitoring performance indicators—such as audit cycle times, remediation rates, and stakeholder feedback—to gauge effectiveness and guide further enhancements. This combination gives governance reliable assurance that cybersecurity controls are evaluated consistently, with appropriate evidence, by competent practitioners, and that findings lead to timely improvements. Other options miss important responsibilities: day-to-day IT operations are managed by IT, not internal audit; providing legal counsel is outside the audit function; focusing only on external assessments neglects internal quality checks and continuous improvement, and it omits the measurement and monitoring that demonstrate audit effectiveness.