Cybersecurity: The changing
role of audit committee andinternal audit

Brochure / report title goes here | Section title goes here

1. Introduction

03

2. What is the role of internal audit and the audit committee?

04

2.1 Three lines of defence model04

2.2 Organisational roles and responsibilities for Cybersecurity05

2.3 The audit committee’s role in Cyber Security06

2.4 Transforming cyber defences

06

3. Framework for Cyber Risk Management08

3.1 Cyber rsk appetite and tolerance

10

3.2 A representative internal audit plan to address cyber risk

10

4. Looking ahead

02

13

Cybersecurity: The changing role of audit committee and internal audit

1. Introduction
Among the most complex and rapidly evolving issues
companies must contend with is cybersecurity. With
the advent of mobile technology, cloud computing, andsocial media, reports on major breaches of proprietary
information and damage to organisational IT
infrastructure have also become increasingly common,
thus transforming the IT risk landscape at a rapid pace.
International media reports on high-profile retailbreaches and the major discovery of the Heartbleed
security vulnerability posing an extensive systemic
challenge to the secure storage and transmission of
information via the Internet have shone a spotlighton cybersecurity issues. Consequently, this has kept
cybersecurity a high priority on the agenda of boards
and audit committees.
•• Organised crime is monetising cyberspace, exploiting
vulnerabilities in computer systems to compromise
and remotely control computers; recording key
strokes, monitoring screen displays and manipulating
the computer user into divulging sensitive data.

•• Corporate espionage by firms is commonplace incyberspace. Attacks often target sensitive intellectual
property, and there have been multiple instances ofmajor firms with its security compromised over many
months and losing substantial amounts of sensitive
data during these attacks.
•• Activism is also prevalent in cyberspace withsabotage and denial of service attacks growing
progressively frequent. In the past, they would be
attributed to ‘hacktivist’ groups such as Anonymous;
but increasingly attacks point to political motivations.
Based on the Global Risk Landscape 2014 published by
the World Economic Forum, cyber-attacks are one of
the risks with high impact as well as high likelihood.

Figure 1. 2014 Global Risk Landscape (World Economic Forum)•• Cyberspace being borderless allows any attacker
to route their assaults through multiple countries
and jurisdictions, complicating investigation and law
enforcement.
•• Companies run the risk of losing substantial amountsof sensitive company information to malicious
employees, who could also potentially remove it fromcompany premises or introduce malicious software
to corrupt company databases or sabotage network
operations.

03Cybersecurity: The changing role of audit committee and internal audit

2. What is the role of internal
audit and the audit committee?
2.1 Three lines of defence model
Effective risk management is the product of multiple
layers of risk defence. Internal Audit should support
the board’s need to understand the effectiveness ofcybersecurity controls. Organisations should instituteand continually shore up three lines of defences:
1. Management. Companies that are good atmanaging information security risks typically assign
responsibility for their security regimes to thehighest levels of the organisation. Management
has ownership, responsibility and accountability forassessing, controlling and mitigating risks.
2. Risk management and compliance functions.
Risk management functions facilitate and monitor
the implementation of effective risk management
practices by management, and help risk owners inreporting adequate risk-related information up anddown the firm.

3. Internal audit. The internal audit function provides
objective assurance to the board and executive
management on how effectively the organisationassesses and manages its risks, including themanner in which the first and second lines ofdefence operate. It is imperative that this lineof defence be at least as strong as the first two.
Without a function that provides competent andobjective assurance, a company faces real risks of its
information privacy practices becoming inadequate
or even obsolete. This is a role that internal audit isuniquely positioned to fill. But to do so, it must havethe mandate and the resources to match.

Roles and responsibilities

1 Line of defense
business and IT
functionsst

2nd Line of defense
information and technology
risk managment
functions

3rd Line ofdefenseinternal audit

04• Incorporate risk-informed decision making into day-to-day
operations and fully integrate risk management into operational
processes• Deﬁne risk appetite and escalate risks outside of tolerance• Mitigate risks, as appropriate• Establish governance and oversight• Set risk baselines, policies, and standards• Implement tools and processes• Monitor and call for action, as appropriate• Provide oversight, consultation, checks and balances, andenterprise-level policies and standards• Independently review program eﬀectiveness• Provide conﬁrmation to the board on risk managementeﬀectiveness• Meet requirements of SEC disclosure obligations focused on
cybersecurity risks

Cybersecurity: The changing role of audit committee and internal audit

The three lines of defence illustrated below are notunique to data privacy and security, but should be inplace and operating at a robust level to deal with any
critical risk to the business. For most organisations,information security and privacy are critical risks
because of its potential to cause financial andreputational damage.
Given recent high profile cyber-attacks and data losses,
and the expectations of the SEC and other regulators,
it is critical for Internal Audit to understand cyber risks
and be well prepared to address the questions andconcerns expressed by the audit committee and board.
2.2 Organisational roles and responsibilities for
Cybersecurity
Audit committee and board of directors —Overseeing a successful cybersecurity programme
requires frequent and proactive engagement fromthe board of directors and audit committee. The
audit committee, in its capacity of overseeing risk
management activities and monitoring management’s
policies and procedures, plays a significant strategicrole in coordinating cyber risk initiatives and policies
and confirming their efficacy. These responsibilities
include setting expectations and accountability for
management, as well as assessing the adequacyof resources, funding and focus for cybersecurity
activities. The audit committee chair can be aparticularly effective liaison with other groups inenforcing and communicating expectations regarding
security and risk mitigation.
Boards are devoting increased attention and resources
to responding to cybersecurity issues. In a recent
study² of global enterprise security governancepractices conducted by the Carnegie Mellon University
CyLab, 48% of corporations surveyed reported having
a board-level risk committee responsible for privacy
and security risks, a dramatic increase from the 8%that reported having such a committee in 2008. Among
North American respondents, 40% indicated that theircompany’s board deals with computer and information
security issues.

Whether or not there is a dedicated risk committee
on the board, it is important to confirm that there
are directors with knowledge and skills in security, IT
governance and cyber risk. Given the audit committee’s
responsibility for risk oversight, it can be advantageous
to recruit committee members with cybersecurity
experience so that informed decisions are made about
the sufficiency of the efforts overseen.
Management — All members of management should
be fully aware of the plan of action and who will occupy
key roles in the event of an attack or threat. Most
companies have a senior management position related
to information security in place so that there is a clear
voice directing cyberthreat prevention, remediation
and recovery plans, related educational activities, andthe development of frameworks for effective reporting.
This position is sometimes held by a chief information
officer, or a chief security officer who is also responsible
for physical security, but some companies may havea dedicated chief information security officer who
focuses solely on cyberthreats. These executives will
sometimes report directly to the board, but in all cases,
they can be an effective liaison with whom the audit
committee and board can communicate regarding risks
and the response to attacks.
Internal audit — The audit committee should confirm
that the internal audit function regularly reviews
controls pertaining to cybersecurity, is up-to-date on
the latest developments and include related issues
prominently and regularly on its agenda.
External auditor — The external auditor can often
be a valuable source of information on cybersecurity
issues. Many firms have practices focused on
evaluating and strengthening security controls
and implementing programmes for enterprise risk
management. They are also qualified to provide
perspectives gained through working with a wide
variety of companies in diverse industries.

05

Cybersecurity: The changing role of audit committee and internal audit

External specialists — It can be helpful to seek the
input of external specialists in assessing cybersecurity.
Companies can conduct annual external reviews of
security and privacy programmes, including incident
response, breach notification, disaster recovery
and crisis communication plans. Such efforts canbe commissioned and reviewed by the board’s
risk committee or another designated committee
to confirm that identified gaps or weaknesses are
addressed. Third-party security assessments can also
provide benchmarking relative to other companies ofsimilar size or in the same industry.

Engaging in regular dialogue with technology-focusedorganisational leaders will help the committee better
understand where attention should be concentrated.
Some questions for audit committees to consider
asking the management regarding cybersecurity are:

2.3 The audit committee’s role in Cyber Security
The extent of the audit committee’s involvement incybersecurity issues varies significantly by company
and industry. In some organisations, cybersecurity
risk is tasked directly to the audit committee, while inothers, there is a separate risk committee. Companies
for which technology forms the backbone of theirbusiness often have a dedicated cyber risk committeethat focuses exclusively on cybersecurity.

•• How are vulnerabilities identified?

Regardless of the formal structure adopted, therapid pace of technology and data growth, andthe attendant risks highlighted by recent security
breaches demonstrate an increasing importancein understanding cybersecurity as a substantive,
enterprise-wide business risk.
Audit committees should be aware of cybersecurity
trends, regulatory developments and major threats tothe company, as the risks associated with intrusions
can be severe and pose systemic economic andbusiness consequences that can significantly affectshareholders.

06•• What is the overall strategy and plan for protecting
assets?
•• How robust are the organisation’s incident response
and communication plans?
•• What are the organisation’s critical assets andassociated risks to be secured?

•• How are risks disclosed?
•• How are critical infrastructure and regulatory
requirements met?
•• What controls are in place to monitor cloud andsupplier networks, as well as software running on
company devices, such as mobile devices?
•• What digital information is leaving the organisation,
where is it going, and how is it tracked?
•• Do we have trained and experienced staff who canforecast cyber risks?
•• Is it known who is logging into the company’s
network, from where, and if the information they areaccessing is appropriate to their role?

Cybersecurity: The changing role of audit committee and internal audit

2.4 Transforming cyber defences
Within the broader context of responsibility for risk
oversight, audit committees are responsible for theoversight of financial reporting and disclosure, andmore recently cybersecurity.
Cybersecurity is a business issue as it exceeds theboundaries of IT and cyber risk needs to be managedwith as much discipline as financial risk.
Both the technical nature of the threat and amountof attention cyber risk demands calls for primary
audit committee involvement. Yet organisations haveacknowledged a lack of expertise on cybersecurity
issues. As a result, audit committees are seeking not
only education for themselves, but also an elevationof the discussion amidst C-level executives. These
efforts include increasing engagement with the chief
information officer (CIO) and chief information security
officer (CISO), drawing on the expertise of the IT
partner from the external audit firm, encouraging CIOs
and CISOs to participate in peer-group information
sharing, and challenging management to produce
metrics that the audit committee can use to evaluate
cybersecurity effectiveness.
A comprehensive cybersecurity plan also requires
appropriate culture and tone at the top. These
encompass an awareness of the importance of security
extending from the C-suite to the professionals in eachfunction, since breaches can occur at any level and inany department.
The CEO should make it clear that cybersecurity is amajor corporate priority, and should communicate thathe or she is fully on board with enforcing compliancewith policies and supporting efforts to strengthen
infrastructure and combat threats.
Several practices that companies are employing
to enhance the audit committee’s oversight ofcybersecurity risk, leverage the recent broader
strategic focus of the CISO and CIO roles:a) Increasing interaction with the IT department
CIO and CISO should attend audit committee meetings
and take the audit committee through one “deep dive”
education session on cybersecurity issuse. The audit
committee should also continue engaging with the CIO
and CISO.

b) Sharing information with industry
counterparts
CIOs and CISOs benefit from sharing information with
their industry counterparts about cyberattack patterns
and cyberdefence strategies. For instance, providing
first-hand experience of a cyberattack to industry
peers would better inform and prepare them for theprevention of similar attacks and in the process isolatea high-impact and high-likelihood risk from crippling anorganisation.
c) Technology experts joining the board
The lack of technology expertise is an issue that has tobe recognised in boards today. With the average ageof board members exceeding 50, there is often a lackof understanding of context as a CIO is briefing theboard. It is, therefore, beneficial for the board to have amember with significant technology experience.
d) Engaging the expertise of the external audit
firm
External auditors employ a variety of professionals
that include cybersecurity experts. They are a great
resource for providing an honest perspective on theorganisation – the knowledge of the management
team and how the company is benchmarked. Somecompanies engage external audit firms to be “ethicalhackers” without the knowledge of the CIO and/or
CISO, while others choose to notify these executives
ahead of timee) Deploying internal audit
Internal audit plays a central role in helping theaudit committee oversee cybersecurity. The regularassessments conducted by internal audit play animportant part in providing the audit committee with acomprehensive appraisal of the organisation’s strength
and weakness. Internal audit should also be able todevelop a road map for the future dealing with various
cyber risk issues and scenarios.
f) Evaluating the company’s cybersecurity
programmes
A company’s cybersecurity programme can be difficult
to evaluate because audit committees do not know
the key success factors and its indicators to measure
it. The most important indicator is the amount of timethat elapses between the hacker’s penetration and thecompany’s detection. Detection and response time areamong the most important metrics that the company
should track to ensure progression and effectivenessof the techniques being employed.

07Cybersecurity: The changing role of audit committee and internal audit

3. Framework for Cyber Risk
Management
The Cyber Risk Management Framework can help focus the conversation among the audit committee, othermembers of the board and senior management on what cybersecurity plans are in place and its possible gaps.
This can potentially bridge the gap between the seemingly technical world of cybersecurity and how it translates
into the governance decisions that boards and senior executives make. It also encourages dialogue between
companies in similar industries which have a shared interest in identifying and addressing vulnerabilities.
The framework’s core consists of five functions—governance and leadership, organisational enablers, capabilities,
cyber lifecycle and solution lifecycle that provide a high-level, strategic view of an organisation’s management ofcybersecurity risks and examine existing cybersecurity practices, guidelines and standards.

Business Value
1. Governance & Leadership
Executive
Management

Board

Technology
Leadership

IT Risk
Leadership

3. Capabilities
Threat Management

Infrastructure
Security

Identity & Access
Management

Application Security

Data Protection

Workforce
Management

Risk Analytics

Third Party
Management

CrisisManagement

2. Organisational Enablers
Policies &Standards

08

Talent & Culture

Risk Identiﬁcation& Reporting

Stakeholder
Management

4. Cyber lifecycle
Protect, detect,
respond & recover

5. Solution
lifecycle Design,build, implement& operate

Cybersecurity: The changing role of audit committee and internal audit

Cybersecurity plans should take into account thepast, present and future with regard to cyber risks.
Consideration should be given to the percentageof the available budget required for prevention
efforts, immediate response to attacks and resiliency
exercises.
Throughout the past decade, most organisations’ cybersecurity programmes have focused on strengthening
prevention capabilities based on establishedinformation assurance strategy: defence in-depth.
This approach advocates a multi-layered approach to
deploying security controls with the intent of providing
redundancy in the event a security control fails or avulnerability is successfully exploited in one of thelayers.
To be effective and well balanced, a cyberdefence musthave three key characteristics: secure, vigilant, andresilient.
1. Secure: Being secure means focusing protection
around the risk-sensitive assets at the heart of yourorganisation’s mission - the ones that both you andyour adversaries are likely to agree are the mostvaluable.

SecureEnhance risk-prioritised
controls to protect
against known &emerging threats, &comply with industry
cybersecurity standards& regulations

Actionable threat intelligence

Vigilant
Detect violations& anomalies
through better
situationalawarenessacross theenvironment

2. Vigilant: Being vigilant means establishing
threat awareness throughout the organisation, anddeveloping the capacity to detect patterns of behaviour
that may indicate, or even predict, compromise ofcritical assets.
3. Resilient: Being resilient means having the capacity
to rapidly contain the damage, and mobilise the diverse
resources needed to minimise impact - including direct
costs and business disruption, as well as reputation
and brand damage.
In summary, the model below has 3 objectives –secure, vigilant and resilient – woven together with 5
design principles of:a) Incorporating security in the core designb) Applying threat intelligence in the core designc) Sharing of intel and information among security
practitionersd) Automating processes to address the scarcity ofskilled resourcese) Enabling the power of combating crime together

Resilient
Establish the ability
to quickly return tonormal operations& repair damage
to the business

Strategic organisational approach09

Cybersecurity: The changing role of audit committee and internal audit

Once the cyber risks have been identified, the 3 objectives within the cybersecurity plan can be used to map the
programme and governance to mitigate or address those risks.

Who might attack?
What are they after, and what businessrisks do I need to mitigate?
What tactics might they use?
Cyber Risk Program and Governance
SecureAre controls in place to guard against
known and emerging threats?
Vigilant
Can we detect malicious or unauthorised
activity, including the unknown?
Resilient
Can we act and recover quickly to
reduce impact?

3.1 Cyber risk appetite and tolerance
Risk appetite and tolerance must be a high priority
on the board agenda. It is a core consideration in anenterprise risk management approach. Risk appetite
can be defined as ‘the amount and type of risk thatan organisation is willing to take in order to meet its
strategic objectives.
Every organisation possess different risk appetites
depending on their sector, culture and objectives.
A range of appetites exist for a diverse portfolioof risks, which may change over time according to
the risk portfolio. While risk appetite is interpreted
differently, there is general consensus that effective
communication of an appropriate risk appetitestatement can help organisations achieve their goals
and sustain their operations.

10• Theft if IP / strategic plans• Financial fraud• Reputation damage• Business disruption• Destruction of critical infrastructure• Threats to health and safety• Cyber criminals• Hactivists (agenda driven)• Nation states• Insiders / partners• Competitors• Skilled individual hacker• Spear phishing, drive by download, etc.
• Software or hardware vulnerabilities• Third party compromise• Multi-channel attacks• Stolen credentials• Governance and operating model• Policies and standards• Management processes and capabilities• Risk reporting• Perimeter defenses• Risk awareness and culture• Vulnerability management• Asset management• Identity management• Threat intelligence• Secure SDLC
• Security monitoring• Data protection• Behavioral analysis• Risk analytics• Incident response• Forensics• Business continuity / disasterrecovery• Crisis management

Management should develop an understanding of thecyber-criminal, their objectives, and how the attack
might happen. The following questions can be used todevelop the understanding:
01. Who might attack?
02. What are they after, and what business risks do weneed to mitigate?
03. What is the intruder’s arsenal?
3.2 A representative Internal Audit Plan toaddress cyber risk
It is imperative that internal audit takes a leading rolein determining whether a systematic and disciplined
approach exists to evaluate and strengthen theeffectiveness of cyber risk management. It should also
determine if appropriate cyber security capabilities(people, process, and technology) are in place toprotect against cyber threats.

Cybersecurity: The changing role of audit committee and internal audit

In developing the internal audit plan for Cyber Security,
the 2013 COSO Framework should be used as theframework for guiding the internal audit’s approach.
Managing cyber risk through a COSO lens enables theboard and senior executives to better communicate
their business objectives, their definition of criticalinformation systems, and related risk tolerance levels.
This enables others within the organisation, including
IT personnel, to perform a detailed cyber risk analysis
by evaluating the information systems that are most
likely to be targeted by attackers, likely methods ofattack, and points of intended exploitation. In turn,appropriate control activities can be establishedto address such risks. Through the COSO cube,organisations may view their cyber risk profile throughthe components of internal control to manage cyberrisks in a secure, vigilant, resilient manner. For example:
Figure 1 – The COSO Cube
e
nc
ia
l
p
m
Co

Control Activities

Division

Risk Assessment

Entity Level

Control Environment

Function

g
in
rt
o
p
Re

Operating Unit

ns
io
at
r
e
Op

Information & Communication
Monitoring Activities

Control Environmentb) Risk Assessment — Has the organisation and its
critical stakeholders evaluated its operations, reportingand compliance objectives, and gathered information
to understand how cyber risk could impact suchobjectives?
c) Control Activities — Has the entity developed
control activities, including general control activities
over technology that enable the organisation to
manage cyber risk within the acceptable level oftolerance to the organisation? Have such control
activities been deployed through formalized policies
and procedures?
d) Information and Communication — Has theorganisation identified information requirements
to manage internal control over cyber risk? Has
the organisation defined internal and external
communication channels and protocols that support
the functioning of internal control? How will theorganisation respond to, manage, and communicate acyber risk event?
e) Monitoring Activities — How will the organisation
select, develop, and perform evaluations toascertain the design and operating effectivenessof internal controls that address cyber risks? When
deficiencies are identified how are these deficiencies
communicated and prioritized for corrective action?
What is the organisation doing to monitor their cyberrisk profile?

e
nc
ia
l
p
m
Co
11

ion

g
tin
or
p
Re

Unit

ns
io
t
a
er
Op

a) Control Environment — Does the board
understand the organisation’s cyber risk profile andare they informed of how the organisation is managing
the evolving cyber risks management faces?

Cybersecurity: The changing role of audit committee and internal audit

A cybersecurity assessment can drive a risk-based IT internal audit plan, and audit frequency should correspondto the level of risk identified, and applicable regulatory requirements/expectations.
The following table illustrates the detailed cyber risk programme and governance derived from the three key
characteristics (secure, vigilant, and resilient) linked to the internal audit plan each year to address the cyber risks.
Another approach is to allow some coverage of each area (Secure, Vigilant and Resilient) in each year.

Resilient

Vigilent

Secure

2015

12

2016

2017

Cyber security risk and compliancemanagement

Secure development life cycle

Security program and talentmanagement•• Compliance monitoring•• Issue and corrective action planning•• Regulatory and exam management•• Risk and compliance assessment andmanagement•• Integrated req and control framework•• Secure build and testing•• Secure coding guidelines•• Application role design/access•• Security design/architecture•• Security/risk requirements•• Security direction and strategy•• Security budget and financemanagement•• Policy and standards management•• Exception management•• Talent strategy

Third party management

Information and asset management

Identify and access management•• Evaluation and selection•• Contract and service initiation•• Ongoing monitoring•• Service ternination•• Information and asset classificationand inventory•• Information records management•• Physical and environment security
controls•• Physical media handling•• Account provisioning•• Privileged user managment•• Access certification•• Access management and governanceThreat and vulnerability
management

Data management and protection

Risk analytics•• Incident response and forensics•• Application security testing•• Threat monitoring and interlligence•• Security event monitoring and logging•• Penetration testing•• Vulnerability management•• Data classification and inventory•• Breach notification and management•• Data loss prevention•• Data security strategy•• Data encryption and obfuscation•• Records and mobile device
management•• Information gathering and analysis
around:–– User, account, entity–– Events/incidents–– Fraud and anti-money laundering–– Operational loss

Crisis management and resilency

Security operations

Security awareness and training•• Recovering startegy, plans, andprocedures•• Testing and exercising•• Business impact analysis•• Business continuity planning•• Disaster recovery planning•• Change management•• Configuration management•• Network defense•• Security operations management•• Security architecture•• Security training•• Security awareness•• Third party responsibilities

SOX (financially releveant systems
only)

Penetration and vulnerability
testing

BCP/DRP Testing

Cybersecurity: The changing role of audit committee and internal audit

4. Looking ahead
As recently as five years ago, it was rare for a board of directors to be closely involved in managing
cybersecurity risks, but rapid advancements in technology, coupled with a corresponding increase in
the sophistication of cyber criminals and cyber legislation, have made it essential for the board andaudit committee to be informed and proactive. New technologies continue to shape the physical andvirtual borders of organisations, which must frequently review and quickly adapt policies to address
emerging issues.
Cybersecurity specialists are developing increasingly sophisticated approaches for preventing,detecting, and responding to security breaches, but no single solution can address all the evolving
challenges associated with cyber threats. It remains important to apply prudent and adaptable
controls to respond to changes in the threat landscape, and to have strong response and resiliency
plans in place in the event of an attack.
Increasingly, cybersecurity is becoming a top-of-mind issue for most CEOs and boards, and they
are becoming more preemptive in evaluating cybersecurity risk exposure as an enterprise-wide risk
management issue, not limiting it to an IT concern.

13Cybersecurity: The changing role of audit committee and internal audit

Authors
Siah Weng Yew
Executive Director, Risk Advisory

Thio Tse Gan
Executive Director, Risk Advisory

Tan Ing Houw
Director, Risk Advisory

Diona Lim
Manager, Risk Advisory

Kenneth Leong
Director, Risk Advisory

Contacts
SEA and Singapore
Thio Tse Gan
Executive Director+65 6216 3158
tgthio@deloitte.com

Indonesia
Sigit Kwa
Associate Director+65 6800 2903
skwa@deloitte.com

Thailand
Parichart Jiravachara
Executive Director+66 2676 5700 ext. 11913
pjiravachara@deloitte.com

Eric Lee
Executive Director+65 6800 2100
ewklee@deloitte.com

Malaysia
Megat Mohammad Faisal
Executive Director+60 3 7610 8863
mkhirjohari@deloitte.com

Pinyo Treepetcharaporn
Director+66 2676 5700 ext. 11946
ptreepetcharaporn@deloitte.com

Victor Keong
Executive Director+65 6216 3222
vkeong@deloitte.com

Ho Siew Kei
Senior Manager+603 7610 8040
sieho@deloitte.com

Siah Weng Yew
Executive Director+65 6216 3112
wysiah@deloitte.com

Philippines
Maria Carmela Migrino
Director+63 2 581 9000
cmigrino@deloitte.com

Edna Yap
Director+65 6531 5016
edyap@deloitte.com
Leslie Moller
Director+65 6800 2333
lesmoller@deloitte.com

14Cybersecurity: The changing role of audit committee and internal audit

15

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK privatecompany limited by guarantee (“DTTL”), its network of member firms, and theirrelated entities. DTTL and each of its member firms are legally separate andindependent entities. DTTL (also referred to as “Deloitte Global”) does not provide
services to clients. Please see www.deloitte.com/sg/about to learn more about our
global network of member firms.
Deloitte provides audit, consulting, financial advisory, risk advisory, tax and related
services to public and private clients spanning multiple industries. Deloitte serves
four out of five Fortune Global 500® companies through a globally connected
network of member firms in more than 150 countries and territories bringing
world-class capabilities, insights, and high-quality service to address clients’ mostcomplex business challenges. To learn more about how Deloitte’s approximately
245,000 professionals make an impact that matters, please connect with us on
Facebook, LinkedIn, or Twitter.
About Deloitte Southeast Asia
Deloitte Southeast Asia Ltd – a member firm of Deloitte Touche Tohmatsu Limited
comprising Deloitte practices operating in Brunei, Cambodia, Guam, Indonesia,
Lao PDR, Malaysia, Myanmar, Philippines, Singapore, Thailand and Vietnam – wasestablished to deliver measurable value to the particular demands of increasingly
intra-regional and fast growing companies and enterprises.
Comprising 290 partners and over 7,400 professionals in 25 office locations, thesubsidiaries and affiliates of Deloitte Southeast Asia Ltd combine their technicalexpertise and deep industry knowledge to deliver consistent high quality services
to companies in the region.
All services are provided through the individual country ractices, their subsidiaries
and affiliates which are separate and independent legal entities.
About Deloitte Singapore
In Singapore, services are provided by Deloitte & Touche LLP and its subsidiaries
and affiliates.
© 2017 Deloitte & Touche Enterprise Risk Services Pte Ltd