Customer demand for mobile apps is showing unprecedented levels and far exceeds uptake of traditional web based access to transactional services when originally launched. This demand has precipitated a surge in the number of digital and mobile services in the financial services industry and it is increasingly seen as an essential channel for organisations to engage with customers. Regulatory interest has been awakened into digital and mobile as a platform for customer engagement, influenced to a large extent by the high customer demand as mentioned above. In September 2014, the FCA published the results of its thematic review into Mobile Banking and Payments highlighting concerns over security of customer data and funds and whether technology is robust enough to cope with the change in customer behaviour. Internal audit functions are now including mobile apps in their audit plans, blending of specialisms on such reviews including IT, marketing, conduct and anti-fraud skill sets. We are not seeing, however, any significant internal audit focus on the risks relating to mobile devices as a corporate tool. Smartphones and tablets are internet connected devices with tremendous processing power
that enable access to data assets and systems; they normally store confidential data and are in the hands of individuals who may lose them, share them or use them in ways that expose vulnerabilities to attackers (e.g. the use of Cloud services or untrusted third-party applications).