Behind the Scenes of a Global Cybersecurity Audit

**The Institute of Internal Auditors Presents: All Things Internal Audit Tech** In this episode, Elizabeth Sullivan talks with Anthony Pugliese and Matt Pearman about Pugliese's experience when he  joined a global cybersecurity audit at Barclays. They discuss how the team planned and scoped an audit of a cloud platform used to build and run artificial intelligence, the value of senior leadership involvement, and the importance of balancing structure with flexibility. The conversation also explores cyber resilience, third-party risk, leadership engagement, and translating complex cybersecurity observations into meaningful information for executives and boards. - **HOST:** - [Elizabeth Sullivan](https://www.linkedin.com/in/elizabeth-sullivan-cia-crma-ccsa-448aa611/ "https://www.linkedin.com/in/elizabeth-sullivan-cia-crma-ccsa-448aa611/"), CIA, CRMA, CCSA, Senior Vice President and Chief Risk and Audit Officer, Washington Metropolitan Area Transit Authority - **GUESTS:** - [Anthony Pugliese](https://www.linkedin.com/in/anthony-pugliese/ "https://www.linkedin.com/in/anthony-pugliese/"), CIA, CPA President and CEO, The Institute of Internal Auditors - [Matt Pearman](https://www.linkedin.com/in/mattpearman/ "https://www.linkedin.com/in/mattpearman/"), CIA, CISA, CISM, CISSP Chief Internal Auditor for the Chief Operating Officer, Barclays **KEY POINTS:** - (00:00) Introduction - (00:37) Goals of the Barclays Cloud AI Platform Audit - (01:34) How a Chapter Event Led to an Invitation - (03:00) Teamwork and Collaboration in Kickoff Sessions - (05:02) Balancing Structure With Flexibility - (07:18) New Hire Development and Hands-On Management - (08:21) Prioritizing Key Controls When Setting Scope - (09:28) Gathering and Challenging Evidence - (10:43) The Value of Curious, Thoughtful Questions - (11:56) Senior Leadership Support Builds Credibility - (13:54) Adding Context Without Impairing Independence - (16:43) Cyber Resilience, Governance, and Third-Party Risk - (19:24) Translating Technical Findings Into Business Implications - (22:05) Showing the Discipline Behind Each Engagement - (24:24) Lessons in Rigor, Relevance, and Common Sense - (27:32) Future IIA Standards, Guidance, and Training **IIA RELATED CONTENT:**  Interested in this topic? Visit the links below for more resources:https://iia.mydigitalpublication.com/august-2026/page-22 - Cybersecurity Topical Requirement - Third-Party Topical Requirement - Artificial Intelligence Knowledge Center - Elevating Internal Audit Communication With the Board - Vision 2035 Visit The IIA's website or YouTube channel for related topics and more. **Follow All Things Internal Audit:** Apple Podcasts Spotify Libsyn Deezer