Chapter 1: 6.9 - Final note about data security

Question 1

What do auditors needs to recognise about client info and working with others?

Answer 1

Need to recognise when to disclose info with our without client’s permission and when to take precautions if acting for competing clients

Question 2

As well as being able to recognise when to disclose information with or without clients’ permission and when to take precautions if acting for competing clients, what do auditors also need to understand?

Answer 2

Importance of data security

Question 3

What must be done in relation to data during the course of an audit?

Answer 3

During course of an audit (both internal and external), will be significant amounts of evidence collected which must be stored securely to maintain confidentiality

Question 4

How is the evidence likely to be stored in 21st century and why?

Answer 4

Increasingly likely to be some kind of electronic or digital storage due to significant advantages of being able to access and share data as part of an efficient audit, sometimes spread across different locations

Question 5

Why can shared access data create problems?

Answer 5

Cyber threats are becoming more significant and the loss or theft of confidential data can have serious implications for auditors, who must now invest in ongoing cybersecurity controls to ensure they are adequately protected from such threats

Question 6

What doe the implications of loss or theft of confidential data include?

Answer 6

Range from losing clients to being fined for non-compliance with data protection legislation

Question 7

What do examples of suitable cybersecurity controls include? (4)

Answer 7

1. The appointment of qualified IT staff who can implement and support appropriate policies and controls
2. Investment in suitable IT infrastructure such as firewalls and anti-virus software
3. Education and awareness of cybersecurity among staff, such as training for staff on neutralising suspicious emails that might contain a cyber threat
4. Adoption of suitable cybersecurity accreditation, such as ISO 270001

Question 8

Define cybersecurity and cyberthreats.

Answer 8

Awareness of the issues surrounding the use of digital means of storing and accessing confidential client information