Integrating cybersecurity into internal audit through a self-assessment tool based on a systematic literature review

In an era where technological innovations are reshaping organisations' operational strategies and introducing new challenges related to data protection and privacy, internal auditing is compelled to expand its scope to address the risks associated with cybersecurity. In this context, we propose a systematic review of 16 studies indexed in the Web of Science database, covering the period from 2017 to 2025. These studies were selected based on clear inclusion and exclusion criteria, with the aim of capturing the interdependence between the internal audit function and an organisation's cybersecurity, in order to assess the contribution of internal auditors to mitigating cyber risks. The results are presented in two forms: first, a categorization of the reviewed studies according to the key ideas addressed by the authors; and second, a company-level selfassessment tool for integrating cybersecurity into the internal audit process. These results have dual relevance: firstly, they serve academics, who can more easily track the main interests in this area as well as the existing gaps in the literature; secondly, they help companies diagnose the maturity level of cybersecurity integration into internal audit processes. However, these results are limited by the analysis of a small number of studies, as restricted access to some articles prevented their inclusion in the analysis.