Audit Committee Penetration Testing Considerations

Joel Lanz, CPA, CISA, CISM, CISSP, CFE

Whether responding to heightened regulatory expectations or confirming trust in their organization's ability to repel a cyberattack, performing penetration testing (i.e., “pen test”) continues to be a hot topic at audit committee meetings. Sighs of relief frequently accompany the good news of a passed pen test and sometimes create favorable bonus considerations for management. A poor pen test typically results in blame (and in some cases shame) throughout the organization, time-intensive meetings, and additional expense to resolve identified issues. Some organizations charge the audit committee with ensuring that a periodic (usually annual) penetration test occurs, results are communicated, and remedial actions are taken where necessary. For organizations not having an audit committee, the “governance role” typically is assigned to the CFO, who can provide some independent perspective on the information technology function. Unfortunately, in other organizations, the recruitment and contracting of a penetration tester are assigned to those directly responsible for the assets for which the test is to be performed.