I85PREP
⌘ K
CGSP study materials
CGSP study resources

The Ransomware Cover-Up

CGSP · Put your knowledge to work in context.

All case studies

The Ransomware Cover-Up

During a routine internal audit of incident management at HealthCo, auditor Maya discovers that a ransomware attack six weeks ago encrypted 200 GB of patient billing data. The CISO reported to the board that the incident was 'contained with no data exfiltration.' However, Maya's forensic review finds evidence that 200 GB was uploaded to an external IP address before encryption. The CISO asks Maya to omit this finding from her audit report, arguing that disclosure would trigger regulatory fines and reputational damage. HealthCo's code of ethics requires employees to report all material findings and cooperate with regulators. The incident was not reported to the supervisory authority within 72 hours as required under GDPR. Maya is a Certified Internal Auditor and holds the CGSP. She must decide how to proceed.

1. Identify the ethical and professional standards at stake for Maya. What should she do first, and why?

Read the worked answer

Standards at stake:

  • IIA Code of Ethics: Integrity (report accurately, do not omit material facts), objectivity (avoid conflicts of interest, resist undue pressure), confidentiality (protect information, but not to conceal wrongdoing), and competency.
  • CGSP ethics: Duty to act in the public interest, professional behavior, and compliance with laws and regulations.
  • Legal obligations: GDPR requires notification of personal data breaches to the supervisory authority within 72 hours unless unlikely to result in risk. The organization may have breached this duty; Maya cannot participate in concealment.

First action: Maya should document the evidence and the CISO's request in writing (e.g., a memo to file) immediately. She should not alter the audit report. Then, she should meet with the CISO to explain that she cannot omit the finding because it would violate professional standards and potentially legal obligations. She should offer to help draft a remediation and notification plan. If the CISO persists, she must escalate. Documenting first preserves evidence and protects her objectivity. The duty to the public and the organization's long-term interest outweighs loyalty to a colleague.

2. Outline the steps Maya should take to escalate the issue within HealthCo, including documentation and communication with the CISO and audit committee.

Read the worked answer

Escalation steps:

  1. Preserve evidence: Secure forensic logs, emails, and the CISO's request. Store them in a confidential audit file.
  2. Prepare a memo: Summarize the finding (200 GB exfiltration), the CISO's request to omit, and the ethical and legal obligations. State that omission would mislead the board and regulators.
  3. Meet with the CISO: Deliver the memo, reiterate that the finding must be reported, and request a written response. Offer to collaborate on a breach notification plan.
  4. Escalate to the Chief Audit Executive (CAE) or audit committee chair if the CISO does not relent. Provide the full evidence and a recommendation to report the breach to the supervisory authority (even if late, with an explanation).
  5. Present to the audit committee: Request a meeting, share the finding, and recommend that HealthCo notify the regulator and the affected individuals. Emphasize that concealment increases legal and reputational risk.
  6. Document all communications: Keep a chronological record of meetings, decisions, and any pressure received.

Maya should remain objective and avoid making accusations; focus on facts and obligations. If the audit committee supports concealment, she must consider external options.

3. If HealthCo's leadership continues to suppress the finding, what external actions are available to Maya, and what are the risks of each?

Read the worked answer

External options:

  1. Report to the regulator directly: In some jurisdictions, internal auditors are not mandatory reporters, but professional standards may permit or require reporting to external authorities when the public interest is at stake (e.g., patient data). Risk: breach of confidentiality, retaliation, legal liability for unauthorized disclosure. Maya should seek legal advice first.
  2. Whistleblower channel: Use HealthCo's whistleblower hotline or an external regulator's whistleblower program. Risk: anonymity may not be fully protected; retaliation risk.
  3. Resign and report: Resignation with a written explanation to the board, then report to the regulator. Risk: loss of income, reputational impact, but ethical protection under whistleblower laws in many countries.
  4. Notify the audit committee chair in writing and request a board resolution. If the board fails to act, document and consider external reporting. Risk: internal isolation.

Balancing factors: Maya's duty to the public (patients whose data was exfiltrated) and the legal obligation to report a GDPR breach likely outweigh confidentiality. She should first exhaust internal escalation. If suppression continues, she should consult a lawyer specializing in whistleblower protections and then report to the supervisory authority. The risks of inaction-ongoing data breach, regulatory penalties, and harm to patients-are greater than the personal risks of reporting.