n most organizations, both the information systems and internal audit functions are involved with
information security. The IS function has a primary responsibility for designing, implementing, and
maintaining a cost-effective information security program. Internal audit provides an independent review
and analysis of the organization's information security initiatives. Ideally, the feedback provided by
internal audit can be used to improve the overall effectiveness of the organization's information security.
These two functions should work together synergistically to maximize the effectiveness of an
organization's information systems security program. Indeed,