The relationship between internal audit and IT departments within Maltese banks

Abstract

Purpose: This study addresses the lack of specific research on the relationship between Internal Audit and IT Departments in Maltese banks, focusing on information security risk management. It aims to analyse their roles, interactions and factors impacting communication and collaboration, while also emphasising the benefits of fostering a positive relationship. Additionally, the study offers recommendations and best practices to enhance their relationship. Design: To fulfil the study's objectives, semi-structured interviews were conducted with internal auditors and IT Department executives, with additional insights gathered from interviews with 2 ISOs from local banks, providing a broader perspective. A thematic approach was then taken to analyse the data. Findings: The study emphasises the essential collaboration between IA and IT Departments in safeguarding a bank's information assets, despite their differing roles and perspectives on IS risk mitigation. Challenges, such as IAors' limited IT knowledge and resistance to criticism were observed, yet efforts to foster trust and collaboration led to improved communication over time. Positive shifts in perception of the IAF, attitudes among departments, top management support and structural factors were also noted. Achieving a balance between formal and informal communication, addressing operational challenges and promoting proactive risk management were deemed crucial by both interviewee groups. Ultimately, they also acknowledged the significance of enhancing mutual understanding and collaboration. Conclusions: This dissertation revealed that most interviewees express satisfaction with the current communication and collaboration between the departments, reflecting an overall positive relationship and an improvement from previous studies. However, occasional barriers persist, primarily stemming from the internal auditor’s limited IT technical knowledge and from IT personnel’s attitudes. Value: It is anticipated that this study will inspire additional research in this field. Additionally, stakeholders are encouraged to consider implementing the recommendations outlined to enhance the relationship between departments.