## 6 Conclusions  
The study identified ways internal audits could contribute to ensuring the effectiveness and improvement of cybersecurity controls within Brazilian financial institutions. Two opposing perspectives emerged regarding the depth of the assessments conducted by Internal Audit. The first suggests that internal audits should focus on high-level management and governance aspects. In contrast, the second argues that internal audits should also conduct detailed assessments of operational activities. Some proposed conducting penetration tests (PenTests) to assess the effectiveness of cybersecurity processes, either by the third-line team or by companies contracted to validate and improve operational processes. However, the idea may be unfeasible in practice due to technical and budgetary limitations, and it may also be operationally inefficient, given that the first line already employs specialized tools and professionals to perform these activities. Some suggested that the lines work together as an alternative solution, where each could contribute within their specific attributions. Continuous data-driven auditing was helpful in continually monitoring and evaluating security controls and processes, improving cyber risk management. Analytical tools increase the ability to detect and respond to emerging risks, making recommendations and actions more effective. However, some disagreement existed regarding the accuracy of statistical analyses in large populations versus the efficiency and representativeness of samples in contexts with limited resources. In this sense, the construction of metrics, key risk indicators (KRIs), and performance indicators (KPIs) for continuous monitoring of processes emerged as essential resources for cyber risk management. These metrics help identify weaknesses and opportunities for improvement, with KRIs highlighting potential threats and KPIs evaluating the effectiveness of security policies, such as incident response and compliance with established standards. Financial institutions can directly benefit from the conclusions obtained, especially regarding the performance of internal audits and the use of emerging technologies to evaluate and improve the effectiveness of cybersecurity controls. Identifying and addressing emerging risks requires a dynamic and systematic approach that combines continuous assessment with concrete mitigation actions. Structured processes must be implemented to prioritize vulnerabilities, adjust controls, and execute specific remediation plans. Collaboration between audit, risk management, and technical areas provides a comprehensive view of threats, facilitating agile and informed decision-making. Utilizing objective metrics and recognized frameworks supports the definition of appropriate measures, while strategic reporting ensures the monitoring of implemented actions. In this manner, organizations can respond effectively to constantly changing risks while maintaining their operational resilience. Theoretically, this study contributes to the existing literature by analyzing the role of the third line in cyber risk management using the Three Lines Model. Despite the results obtained, this study has some limitations. The sample was composed of a limited number of interviewees, which may not cover all perspectives and experiences within the universe of Brazilian financial institutions, in addition to biasing the results. Although the qualitative nature of the research allows for an in-depth understanding of the phenomena studied, it is difficult to generalize the results to other organizations or contexts. The subjectivity inherent in content analysis can influence the interpretation of the data, even with efforts to maintain objectivity and systematization in the analytical process. Based on the findings of this study, opportunities for future research emerge. One possibility is to replicate the study with a larger and more diverse sample, including different institutions, countries, and sectors relevant to society.