Cybersafety Connections September 2021 Vol #32 

  • Start with Internal controls in the organization . 
  • Preventive and Detective Controls are both necessary.  
  • Preventive Controls are Better and less Expensive than Cure.  

Internal Controls  

Our focus today is on this article on Internal Controls by Perry D. Wiggins, CPA discussing preventive and detective controls as a measure to mitigate the loss from fraud and cyberattacks. This definition from google states that Internal controls are procedures and policies put in place by management to safeguard organizations, ensure effectiveness and efficiency of operations, reliable financial reporting, and compliance with applicable laws and regulations.   

Preventive and Detective Controls  

Internal controls should be a mix of preventive and detective controls to fight against cyberattacks because according to experts, it is not a matter of “IF” but “When” an organization will become a victim of cyberattacks. No organization is safe from cyberattacks no matter the size or industry.  

Preventive controls are aimed at preventing cyberattacks in the first place while detective controls like security cameras seek to detect if a cyberattack has happened and not necessarily prevent the cyberattacks. Preventive controls involve things like multifactor authentication, implementing user access control, protecting company assets, and training employees in cybersecurity awareness.  

Prevention is Better and Less Expensive than Cure  

Preventive controls are less expensive to implement and will not break the bank even for Small-to midsized businesses. The leader’s or business owner’s tone at the top surrounding issues of integrity, ethics, and compliance including cybersecurity will set the pace for cybersafety behavior in the organization.  

For Small to mid-sized businesses (SMBs) that may not have the financial and people resources to design, implement and carry out the right preventive and detective controls, what are the options?  

Automation and artificial intelligence make it straightforward for preventive controls to be included in the business process an option that can lessen some of the challenges faced by small-to-midsized businesses(SMBs).  This is not to imply that detective controls are less important since it would be best to be able to detect cyberattacks right when it happens in order to take action to mitigat loss.

Subscribe to get the latest post.