TFL Vsebine / Revija SIR*IUS

Cybersecurity in Audit Firms

Revizijske družbe morajo skladno s predpisi varovati zaupne podatke revidirancev. Pri tem se srečujejo s pomanjkanjem konkretnih smernic glede varovanja zaupnih podatkov v elektronski obliki, zato se soočajo z izzivi medsebojnih obveznosti pri zagotavljanju zadostne varnosti informacij. Tudi zaradi obvladovanja tveganj, povezanih z odgovornostjo revizijskih družb, je smiselno uporabljati okvire upravljanja informacijskih sistemov, standarde in dobre prakse, kot so COBIT 2019, CIS Controls in SIST EN ISO/IEC 27001. Zaradi pomanjkljivega zakonskega urejanja je doseganje in dokazovanje kibernetske varnosti trenutno prepuščeno trgu, pri tem pa kljub navidezni avtoriteti, ki jo imajo revizijske družbe, tudi revidiranci ohranjajo nekatere pogajalske možnosti.

Audit firms are required by regulations to protect the confidential data of their clients. However, they face challenges due to a lack of specific guidelines on protecting elec- tronic confidential data, leading to issues regarding mutual obligations in ensuring adequate information security. To manage the risks associated with the responsibility of audit firms, it is advisable to use information system management frameworks, standards, and best prac- tices such as COBIT 2019, CIS Controls, and ISO/IEC 27001. Due to insufficient legal regula- tion, achieving and demonstrating cybersecurity is currently left to the market. Despite the apparent authority of audit firms, clients still retain some negotiating power.