Information systems security and audit firms

Abstract

PURPOSE: This study analyzes to what degree Maltese audit firms are protecting themselves from Information Systems (IS) Security threats. It examines and distinguishes between the large audit firms and the small to medium sized audit firms, and draws comparison in their investment and assigned importance to their IS security. DESIGN: In order to meet the objectives, both primary data and secondary data are used. Research is performed to gain understanding of the most recent advancements and threats in the IS sector, and semi-structured interviews are carried out with partners or Information Technology (IT) auditors in local audit firms, to understand their firm’s position in terms of IS security. FINDINGS: The findings indicated that the large firms were doing well in this aspect, and although some recommendations can be suggested, they are still safe, and give a great deal of importance to IS Security. A great deal of differences emerged in the smaller firms, where some were not considered up to scratch and needed to put more effort in their IS security. The main weaknesses identified related to third parties, cloud usage, and lack of employee training. CONCLUSIONS: Firms need to keep up to date with new emerging threats, and there are still some steps that all firms can take to enhance their security further. At the time of writing, some of the firms were considered unsecure, due to significant shortcomings. VALUE: The study indicates if we can consider the local audit firms secure or not, and shows the major weaknesses plaguing local audit firms. It contributes to IS security through the recommendations it makes to the firms.