Ransomware Readiness and the Role of Internal Audit

Why It Matters

Embedding internal audit in ransomware preparedness turns a reactive scramble into a coordinated, business‑focused response, reducing damage, compliance risk, and recovery costs.

Key Takeaways

• Avoid impulsively shutting down servers; preserve forensic data first.
• Establish clear communication protocols and ownership during ransomware incidents.
• Simple, laminated run‑books improve response speed and reduce chaos.
• Internal audit should stress‑test backups and incident response plans.
• Tabletop exercises reveal governance gaps and cross‑function coordination needs.

Summary

The episode of All Things Internal Audit Tech focuses on how organizations can strengthen ransomware readiness and the unique role internal audit plays in that effort. Host Adam Ross and guest Vipul Patel discuss common missteps in the early hours of an attack and outline practical steps to build a more resilient response framework.

Patel highlights two primary pitfalls: the instinct to pull the plug on servers, which can destroy critical forensic evidence, and the chaos that ensues when communication lines and ownership are undefined. He stresses that a concise, laminated run‑book—"Stop, isolate, document, call three numbers"—can curb panic and guide staff through a disciplined triage. A broader crisis‑communication plan that spans cyber, disaster recovery, and other emergencies further reduces ambiguity.

Real‑world examples illustrate the impact. One organization posted a one‑page playbook in its server room, dramatically improving response speed. Another revamped its governance model, elevating a business executive to incident commander rather than leaving IT as the default lead, thereby aligning the response with enterprise‑wide stakes. Tabletop exercises, facilitated by internal audit, uncovered hidden dependencies such as legal’s lack of awareness about IT’s access to encrypted files and the need to consider OFAC sanctions on ransom payments.

The takeaway for leaders is clear: embed internal audit early in ransomware preparedness, conduct regular stress‑tests of backups, and institutionalize cross‑functional tabletop drills. By doing so, firms not only protect data but also transform cyber risk from an IT problem into a business‑wide governance issue, driving faster, more coordinated action when attacks occur.

Original Description

The Institute of Internal Auditors Presents: All Things Internal Audit Tech

In this episode, Adam Ross speaks with Vipul Patel about how organizations can better prepare for ransomware attacks. They talk through what goes wrong in the first hours of an attack, what smart preparation looks like, and where traditional audit approaches fall short when a business is in crisis mode.

HOST:

Adam Ross, CIA, CISA

(https://www.linkedin.com/in/adam-ross-29488a4/)

Partner and Internal Audit Services Leader, Grant Thornton

GUEST:

Vipul Patel, CISA

(https://www.linkedin.com/in/vipul-patel-2287a81/)

Managing Director and IT Internal Audit Leader, Deloitte

KEY POINTS:

Introduction [00:00:02-00:00:27]

Common Mistakes in Ransomware Response [00:00:27-00:02:14]

Building Crisis Communication Plans [00:02:20-00:03:03]

A Simple Incident Response Runbook [00:03:03-00:05:03]

Internal Audit’s Role Before an Incident [00:05:03-00:07:05]

Stress Testing and “What If” Scenarios [00:07:05-00:08:01]

Tabletop Exercises and Cross-Functional Readiness [00:08:02-00:10:03]

Partnering With the CISO and Management [00:10:03-00:11:15]

Lessons Learned After Ransomware Incidents [00:11:15-00:14:05]

Governance Changes After an Attack [00:14:55-00:16:55]

Cyber Risk as a Business Issue [00:16:55-00:17:16]

Traits of Organizations That Respond Well [00:17:20-00:19:44]

Final Advice for Internal Auditors [00:19:44-00:20:56]

Visit The IIA’s website or YouTube channel for related topics and more.

Visit The IIA's website (https://www.theiia.org/en/) or YouTube (https://www.youtube.com/%40IIAGlobalHQ) channel for related topics and more.

IIA RELATED CONTENT: Interested in this topic? Visit the links below for more resources:

• Global Internal Audit Standards (https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/?utm_source=google&utm_medium=cpc&utm_campaign=22100717904&utm_content=174821656482&utm_term=iia%20audit%20standards&gad_source=1&gad_campaignid=22100717904&gbraid=0AAAAADsnbmzrccWUNrcaezU3tqZKeGyb4&gclid=Cj0KCQjwucDBBhDxARIsANqFdr08xknZvGDSPOIRLC41f9Hk7-ycG2NaEy9tMs13xnjcEE9I-PeaowYaAkv0EALw_wcB)

• Cybersecurity Topical Requirement (https://www.theiia.org/en/standards/2024-standards/topical-requirements/cybersecurity/)

• Course: Detecting, Mitigating and Responding to Global Ransomware Attacks (https://www.theiia.org/en/products/learning-solutions/course/detecting-mitigating-and-responding-to-global-ransomware-attacks/)

• Articles: A Ransomware Playbook (https://internalauditor.theiia.org/en/articles/2024/december/a-ransomware-playbook/?_gl=1*rgy3u*_gcl_aw*R0NMLjE3NzUyNDU5MzAuQ2owS0NRand5cjNPQmhEMEFSSXNBTGxvLU9tT0ZEWUQyWkNvTGd5M1BSbnl6WkREZGRDV0phQnB3UXFGWXowWC05VlI1MGl5bGVrckh1c2FBbU4xRUFMd193Y0I.*_gcl_au*MjEyNjUzNTM0OC4xNzczMDc4OTc3LjE1MTE0MTg3NTIuMTc3NDI5MjczNy4xNzc0MjkyNzM3)

• IIA Certificates: IT General Controls Certificate (https://www.theiia.org/en/learning/certificates/)

• Knowledge Centers: Artificial Intelligence (https://www.theiia.org/en/resources/knowledge-centers/artificial-intelligence/)

• Vison 2035 (https://ia-vision2035.org/)

• IIA Courses: Fundamentals of IT Auditing (https://www.theiia.org/en/products/learning-solutions/course/fundamentals-of-it-auditing/)

• Become a Certified Internal Auditor (CIA) (https://www.theiia.org/en/certifications/cia/)

• CIA Challenge Exam (https://www.theiia.org/en/certifications/cia/challenge-exam)

Follow All Things Internal Audit: (https://podcasts.apple.com/us/podcast/all-things-internal-audit/id1649563473)

• Apple Podcasts (https://podcasts.apple.com/us/podcast/all-things-internal-audit/id1649563473) (https://open.spotify.com/show/1NB6ExNTE5RaarkTRaPBcy)

• Spotify (https://open.spotify.com/show/1NB6ExNTE5RaarkTRaPBcy) (https://1984d534-f92f-4772-a722-6ac47400e67e.libsyn.com/)

• Libsyn (https://1984d534-f92f-4772-a722-6ac47400e67e.libsyn.com/) (https://www.deezer.com/us/show/5250577)

• Deezer (https://www.deezer.com/us/show/5250577)