Highlights from our fifth annual survey of chief audit executives. To read the full report, grantthornton.com/fs-cae-survey

1. Cybersecurity: Suggested actions
Where are the risks?
Where can internal audit add the most value?
Financial services CAEs see room for improvement
when it comes to their risk management functions.
CAEs speak out:
Cybersecurity seen as key threat to growth
For more information, read the report at grantthornton.com/fs-cae-survey
continue to require
improvements
ineffectively used or they’ve
yet to implement one
rigorously enforced and
used comprehensively
business
continuity
25%
+++D
62%
15%
23%
fraud/
anti-corruption
20%
data privacy and security
(including cybersecurity)
71%
third parties
and vendors
34%
regulatory
risks
38%
.
Prepare for potential attacks and
regularly test preparations.
Address exposures stemming from
third-party and vendor relationships.
Focus on people and processes, in
addition to technological solutions.
Shore up cyberrisk exposures by
utilizing key resources (e.g., EO 13636
and NIST supporting standards, FBI’s
InfraGard, U.S. Computer Emergency
Readiness Team, U.S. Secret Service
Electronic Crimes Task Force).
Be alert to warning signals and
identify potential vulnerabilities across
the entire business “ecosystem.”
Ensure boards and senior
management focus attention on
cyberrisks, including understanding
inherent cybersecurity risks, as outlined
by the Federal Financial Institutions
Examination Council (FFIEC).
Chief audit executives (CAEs): Management and board priorities
(according to CAEs):
Identifying improvement
opportunities
Increased efficiency
Mitigating risk/stronger
corporate governance
Mitigating risk
Identifying improvement
opportunities
Stronger compliance
efforts in other areas
1 1
2 2
3 3
“Grant Thornton” refers to Grant Thornton LLP, the U.S. member firm of Grant Thornton International Ltd (GTIL). GTIL
and its member firms are not a worldwide partnership. All member firms are individual legal entities separate from GTIL.
Services are delivered by the member firms. GTIL does not provide services to clients. GTIL and its member firms
are not agents of, and do not obligate, one another and are not liable for one another’s acts or omissions. Please visit
grantthornton.com for details.
© 2015 Grant Thornton LLP | All rights reserved | U.S. member firm of Grant Thornton International Ltd