Sujal is appointed as the auditor of Kashish Ltd., a company heavily dependent on digital platforms for its core business operations and financial…

Sujal's first step in response to the above observations should be to Identify the risk in following manner: The auditor has to determine whether the entity's risk assessment process considers cybersecurity risks.Entity should conduct a periodic risk assessment & develop a management strategy which identifies cybersecurity risks around IT system failure affecting the entity's primary business or potential loss of data or inability to access data as required, Risk of unauthorized access to the IT network.The entity should maintain and periodically review an inventory of their information assets, i.e., Asset Management (e.g., intellectual property, patents, copyrighted material, trade secrets and other intangibles).The entity should classify and prioritise protection of their information assets based on sensitivity and business value and periodically review the systems connected to the network on which digital assets reside.From the governance perspective management should review how cybersecurity risks affect internal controls over financial reporting. In case of adverse attack how management is going to assess the impact on the recoverability of financial data and impact on revenue recognition.Management needs to identify if any established a risk-based cybersecurity program can be leveraged e.g. (NIST, ISO etc.)To determine overall responsibility for cybersecurity in the business environment entity should establish roles and responsibilities over cybersecurity (CISO, CIO). Further, the risk assessment should be discussed with those charged with governance (e.g., the Audit Committee or Board of Directors).