INFORMATION SECURITY IN THE INTERNAL AUDIT OF GOVERNMENT BODIES (EXPERIENCE OF THE REPUBLIC OF POLAND)

Abstract

The purpose of the article is to identify the main directions for improving information security in the internal audit of government bodies based on generalization and analysis of the experience of the Republic of Poland. Internal audit has been found to include various types of information-related activities, including the collection, receipt, and use of information.This contributes to the emergence of certain information risks in the process of internal audit, which may adversely affect the activities of the organization. During the legal regime of martial law in Ukraine, such a negative impact may increase, causing damage to the systems of national, economic, and military security. The development of the internal audit methodology in the Republic of Poland is currently substantiated to be progressing along two main vectors: 1) determination of techniques and methods that will allow timely identification and assessment of existing and probable risks; 2) development of effective methods and technologies that will allow building an early warning system of risks and assessing the effectiveness of the organization. For governance bodies, important vectors of internal audit development are to establish compliance between their goals, mission, vision, and focus of practical activities, as well as to determine the impact of the implementation of certain strategies, programs, and plans on the dynamics of the level of public trust. The author identifies the priority areas of ensuring information security in the internal audit of government bodies based on the analysis of the approaches developed in Polish scientific thought and practice. These include the following: determining whether the goals, mission, and vision of the organization are consistent with its practical information activities; establishing the level of regulation of the most important aspects of information relations at the legislative, by-law, and local levels; determining the continuity in assessing the level of information security of the organization based on previous audits or other inspections; Identification, structuring, and ranking of information risks that may pose a significant threat to the organization's activities and achievement of its goals; compliance with the requirements of information and civil legislation in relation to digital products, especially copyright requirements; protecting the activities of internal auditors from compliance risks; dynamics of the level of trust in the organization in connection with its compliance with the requirements for transparency, access to public information and protection of personal data.