Auditing Insider Threat Programs
Global Practice Guide | Global Technology Audit Guide (GTAG) | Recommended | Issued and Effective | February 18, 2026
Key risks associated with insider threats include sabotage, theft of organizational data, espionage, fraud, and criminal acts. Internal audit functions are well positioned to assess the effectiveness of insider threat programs and recommend potential enhancements to related governance, risk management, and control processes.
This GTAG offers a comprehensive examination of insider threats and related risks, providing an overview of threats, key risks, and potential impacts. Practical and easy-to-use tools help auditors get started.
The guidance replaces the 2018 edition.
Tools to use with this practice guide
Insider Threat Leading Practices
Insider Threat Assessment Using NIST Cybersecurity Framework