Necessary but Not Sufficient? Human Factors in Internal Auditors' Cybersecurity Risk Judgment

Effective cybersecurity assurance depends on the ability of assurance providers to accurately evaluate cybersecurity risks. Despite growing investments in cybersecurity technologies, governance frameworks, and assurance mechanisms, organizations continue to experience cybersecurity incidents, raising concerns about the quality and consistency of cybersecurity risk judgments. Drawing on Social Cognitive Theory, this study examines the influence of cybersecurity skills, self-efficacy, experience, and conflict management style on cybersecurity risk judgment performance among internal auditors. Survey data from Malaysian internal auditors were analysed using Partial Least Squares Structural Equation Modelling (PLS-SEM) and Necessary Condition Analysis (NCA) to examine both sufficiency and necessity relationships. The results show that cybersecurity skills and experience positively influence cybersecurity risk judgment performance, whereas conflict management style has a significant negative effect. Self-efficacy does not directly influence performance but emerges as a necessary condition for achieving high cybersecurity risk judgment performance. Cybersecurity skills also demonstrate partial evidence of serving as an enabling condition for superior performance. The findings demonstrate that factors influencing cybersecurity risk judgment differ from those required to achieve superior performance. By integrating sufficiency and necessity perspectives, this study advances cybersecurity assurance research and highlights the complementary roles of cybersecurity skills and auditor self-efficacy in supporting effective cybersecurity assurance.