## 5 Results
### Frameworks and Good Practices
* **Technical Capability Development and Independence--**Knowledge transfer between specialists and internal teams enhances technical skills, empowering organizations to address security challenges. Audit independence ensures unbiased risk assessments, which are free from internal biases and contribute to a more objective perspective. * **Transparency and Communication--**Transparent reporting and relevant metrics improve communication with stakeholders, both internal and external. This builds trust in security management and ensures alignment on risks and protective measures. Likewise, according to interviewees, when implementing the techniques and strategies presented in this research, auditors may face the following **challenges**:  
* **Governance and Independence--**Challenges in this category are directly tied to organizational structure and the preservation of audit impartiality. The absence or ineffectiveness of the second line of defense (risk management and compliance) overburdens internal audit, exposing it to pressure from the first line (operations). Additionally, consulting activities performed by internal audit may compromise its independence if the team becomes too involved in the processes it is meant to evaluate. Another critical issue is cross-departmental alignment, as teams like IT, cybersecurity, and audit often have differing objectives and terminology, hindering effective collabo \begin{table}
\begin{tabular}{l l} \hline \hline \multicolumn{3}{c}{**Evaluating the Effectiveness of Cybersecurity Controls**} \\ \hline \multicolumn{3}{c}{How internal audit can evaluate the effectiveness of cybersecurity controls implemented in institutions.} \\ \hline A. & Verify aspects of management and governance of processes, performing high-level and strategic evaluations. \\ B. & Perform or hire specialized companies to perform Invasion or Penetration Tests (PenTest). \\ C. & Evaluate the vulnerability management process using tools, established steps, documentation generated, and rules defined and applied. \\ D. & Conduct security assessments and testing jointly with IT and Cybersecurity teams. \\ E. & Utilize continuous auditing based on data and information to monitor and evaluate security controls and processes continually. \\ F. & Assess how cybersecurity and IT areas implement continuous real-time monitoring tools that detect abnormal or suspicious activity. \\ G. & Compile and analyze data on past security breaches and incidents and current trends in cybersecurity to identify areas of emerging risk. \\ H. & Develop security reports and dashboards that provide a view of the organization’s cybersecurity status. \\ I. & Establish metrics and indicators that provide a clear and objective view of the organization’s current cybersecurity state. \\ J. & Adopt frameworks that offer standardized structures for process management, risk assessment, and security controls. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Summary of context units. ration. Finally, having the audit team conduct penetration tests can create conflicts of interest, requiring rigorous documentation of methods to preserve objectivity. * **Technical and Operational Capability--**Technical complexity is one of the biggest hurdles for modern auditing. Integrating data from disparate sources is time-consuming and resource-intensive, while managing large volumes of information demands specialized tools and skills. Data quality is another concern, as unreliable or inconsistent sources can lead to flawed analyses. Furthermore, maintaining dashboards and reports requires significant effort, especially in environments with legacy systems or fragmented infrastructure. * **Metrics and Indicators--**Defining and interpreting relevant metrics remains a persistent challenge. Many organizations struggle to identify key performance indicators (KPIs) aligned with their strategic risks and objectives, often collecting data that fails to yield actionable insights.