Why can an internal audit support cybersecurity accountability?

### Why this is right The material describes internal or external audits as ways to check accountability and compliance with policies and to identify areas for improvement. That makes an audit a review mechanism, not a replacement for governance. ### The concept Accountability requires expectations and assigned duties that can be reviewed. An audit can gather evidence about whether the organization follows its established policies and responsibilities. Findings can inform improvement, but managers and role owners remain responsible for decisions and actions. ### The other options - **B. It guarantees that the organization will never experience another incident**: an audit can identify gaps but cannot guarantee prevention. - **C. It transfers all cybersecurity decisions from management to auditors**: auditors examine and report; governance decisions remain with responsible leaders. - **D. It removes the need to define leadership roles**: auditing unclear roles does not replace the need to clarify them. ### Terms - **Compliance**: Meeting applicable requirements or established organizational expectations. - **Audit**: A structured review of evidence, controls, or compliance. ### Remember An audit checks accountability; it does not take over accountability.