Which statement correctly contrasts Internal Audit with cybersecurity operations?

• A. Internal Audit provides independent assessment and assurance, not day-to-day security operations
• B. Internal Audit runs security operations
• C. Internal Audit conducts penetration tests
• D. Internal Audit guarantees breaches will not occur

Answer: (A)

The main idea here is that internal audit provides independent assessment and assurance about an organization's controls and risk management, while cybersecurity operations are the ongoing, hands-on defense activities. Internal audit evaluates whether security controls are well designed and actually operating effectively and then reports findings to the board or audit committee. This separation ensures objectivity and credible assurance about governance and risk management, rather than getting involved in the daily security duties.

Cybersecurity operations, by contrast, handle the day-to-day work of protecting systems—monitoring networks, detecting incidents, responding to threats, applying patches, and implementing controls. Internal audit may review and test how well those operational controls work and whether remediation is effective, but it does not run the security defenses itself.

The other statements misrepresent internal audit’s role: running security operations is the job of the security operations team; performing penetration tests is a specialized security activity typically done by security professionals or third parties (with internal audit reviewing results); and guaranteeing that breaches will not occur is not possible because risk cannot be eliminated entirely.