What type of study is this?

September 10, 2025

Two Decades of Information Security Audit Research: A Meta-Analysis Review of Methods and Techniques in Information Security Auditing

Key Points

The study identifies a rise in research output on information security audits, particularly post-2021, and emphasizes the need for updated frameworks.
Key metrics included 23 articles reviewed using the PRISMA approach, enhancing understanding of information security audit techniques globally.
Through a meta-analysis, the research highlights the significant subtopics of risk, control, and auditors that require further investigation.
An increase in cybercrime necessitates a collaborative effort between academia and industry to improve information security audit practices.

Abstract

Cybercrime has been on the increase and continues to affect a wide range of organizations, bringing both direct and indirect costs. Information security audits have evolved as a means of safeguarding an organization’s value and key data assets through the appraisal of policies, standards, and security measures that have been put in place. The current study sets out to trace and interpret the scholarly developments in the area of information security audits in the last twenty years, that is, within the period of 2004-2024, with particular interest on techniques and methods used in Indonesia and other places in the world. Taking advantage of meta analysis particularly the PRISMA approach, this study collected data from qualitative sources in the scopus and google databases and was able to identify 23 articles from reputable sources. Such articles were thereafter mapped by means of VOSViewer to assess the popular sub topics of the articles and future research niches. The research noted an increase in the number of research output after the year 2021, although there are still some sub topics such as “risk”, “control” and “auditors” that require attention. There is need to create an audit framework that incorporates the changing technologies in order to enhance the shared responsibility between the industry and the academia in the quest of improving information security. The implications of these findings are intended to advance the work done in the area of information security audits both in theory and practice.

Demander à l'IA

Bookmark