How Internal Auditors Can Use the DVMS to Strengthen Cyber Risk Scoping and Testing

Share This Post

How Internal Auditors Can Use the DVMS to Strengthen Cyber Risk Scoping and Testing

Internal audit has become one of the most critical functions in organizations navigating cybersecurity threats, digital transformation, regulatory pressure, and increasing expectations around operational resilience and digital trust.

Historically, internal audit approached technology and cybersecurity primarily through compliance-driven, control-based testing. However, as digital ecosystems become increasingly interconnected and risk becomes more dynamic, internal auditors must adapt their methods.

The Digital Value Management System (DVMS) offers a modern, systems-based approach that enables auditors to understand better and test how people, processes, technology, and governance interact to produce—or fail to produce—digital value outcomes. By leveraging the DVMS architecture, internal auditors can enhance scoping, strengthen testing, improve assurance quality, and deliver insights that are more closely aligned with executive and board expectations.

Understanding DVMS as a Scoping and Testing Framework

The DVMS is built on the integration of three foundational components: Governance Intent, Operational Capability, and Assurance Evidence. These components do not operate independently—they form a closed-loop system that ensures digital programs such as Cybersecurity, GRC, ITSM, and AI are adequately governed, executed effectively, and validated with credible evidence. For internal auditors, this architecture provides a natural structure for scoping audits, identifying systemic weaknesses, and designing tests that evaluate not only the existence of controls but also their effectiveness and outcome reliability.

Traditional audit scoping often begins with a risk register, a set of policies, or a list of controls mapped against frameworks. The DVMS enhances this by enabling auditors to start with a more fundamental question: Is the organization’s digital work system designed in a way that can produce the outcomes leadership expects? This systems-level perspective leads to deeper, more accurate scoping and prevents auditors from spending time on controls that may exist but are irrelevant to real-world outcomes.

Using Governance Intent to Define Audit Scope

Governance Intent represents the organization’s formal expectations, including policies, standards, risk appetite, procedural requirements, and decision-making structures. For internal auditors, Governance Intent becomes one of the most potent tools for scoping. Instead of focusing solely on whether policies exist, auditors can evaluate alignment between governance intent and business reality.

Internal auditors should begin by reviewing key documents, including cybersecurity strategies, risk appetite statements, resilience plans, policy frameworks, and program charters. These documents tell the story of what executives believe is happening. Audit scoping, then, should compare this intended design against operational execution. When governance intent is unclear, incomplete, contradictory, or outdated, auditors can immediately identify areas of scope, such as unclear roles, inadequate oversight, or policy gaps. If governance intent is strong, auditors can scope their testing to verify whether operations and assurance mechanisms align with those intentions.

This gives internal audit a clear, risk-based structure: an audit where governance intent and operational reality diverge.

Evaluating Operational Capability as a Basis for Testing

Operational Capability encompasses the people, processes, technologies, and culture that are responsible for executing work. Internal auditors can utilize this layer of the DVMS to pinpoint areas where testing will have the most significant impact.

Capabilities can be assessed through interviews, workflow analysis, system walkthroughs, and review of process documentation. Instead of only checking whether a control exists, auditors should examine whether the underlying capability can consistently deliver the expected outcome. For instance, a policy may require timely patching. Still, if capacity, skill sets, workflow design, or tool integration are inadequate, the capability cannot meet the intent—even if controls appear to exist on paper.

Internal auditors can use DVMS to classify operational weaknesses, such as:

  • misaligned processes
  • unclear responsibilities
  • inadequate skills or staffing
  • outdated technology
  • cultural resistance
  • fragmented workflows
  • siloed teams

 

Testing should then focus on verifying whether these capabilities can meet expectations, especially under stress, which is a core principle of DVMS.

Using Assurance Evidence to Validate Outcomes

The third DVMS component—Assurance Evidence—is where the internal audit’s role becomes most visible. Assurance Evidence includes metrics, reports, dashboards, logs, artifacts, and documents that demonstrate whether expected outcomes are being achieved.

Internal auditors can use the DVMS intelligence-driven model to test:

  1. Does the organization generate evidence that is complete, accurate, and reliable?
  2. Does the evidence meaningfully demonstrate whether outcomes are being achieved?
  3. Is evidence produced consistently and used by leadership to make decisions?

 

A common failure uncovered through DVMS-informed testing is that organizations generate large volumes of data but lack a system for transforming that data into actionable insights. Internal auditors can scope and test whether assurance evidence is:

  • aligned to governance intent
  • relevant to operational capability
  • trustworthy under stress
  • used by executives and boards to evaluate program performance

 

If assurance evidence cannot be trusted, the organization cannot assure outcomes—regardless of how strong its governance or operations appear.

Applying DVMS to Risk-Based Scoping

One of the most significant benefits the DVMS brings to internal audit is a more accurate method for scoping risk. Instead of scoping based solely on frameworks, auditors can scope based on systemic alignment.

Internal auditors should begin by mapping:

  • governance expectations
  • operational capability
  • evidence reliability

 

Where any of the three are misaligned, the DVMS identifies these as risk concentration points. These points should become audit scope priorities because they represent areas most likely to result in operational failures, regulatory non-compliance, and reputational harm.

Scoping based on DVMS also prevents redundant audits, reduces audit fatigue, and increases the likelihood that audit findings accurately reflect the organization’s ability to produce measurable, resilient, and trusted outcomes.

Using DVMS to Design More Effective Tests

Once the scope is established, internal auditors can use DVMS to develop more impactful tests. These tests should examine:

  • whether governance intent is clear, current, and communicated
  • whether operational capabilities can meet those expectations
  • whether assurance evidence accurately reflects actual performance
  • whether resilience practices can withstand stress or disruption

 

Testing moves away from “check-the-box” control verification toward evaluating the system’s ability to deliver outcomes. This shift is valuable for leaders, as it aligns audit reporting with board and regulatory expectations.

Enhancing Audit Reporting With DVMS

Ultimately, internal auditors can utilize DVMS principles to structure audit reporting in a manner that resonates with executives and boards. Findings should be categorized according to:

  • governance intent gaps
  • operational capability deficiencies
  • assurance evidence weaknesses
  • cultural or behavioral issues

 

This structure improves clarity, enhances board oversight, and drives more actionable remediation.

Conclusion

The DVMS provides internal auditors with a robust, modern framework for scoping and testing digital programs. By aligning audit methods to Governance Intent, Operational Capability, and Assurance Evidence, auditors can identify systemic weaknesses, validate real-world outcomes, and provide executives and boards with meaningful, evidence-based assurance. Instead of auditing controls in isolation, auditors using DVMS evaluate whether the entire system can deliver the value, resilience, and trust the organization promises. This makes internal audit not just a compliance checker, but a strategic enabler of digital success.

 

About the Author

Rick Lemieux
Co-Founder and Chief Product Officer of the DVMS Institute

Rick has 40+ years of passion and experience creating solutions to give organizations a competitive edge in their service markets. In 2015, Rick was identified as one of the top five IT Entrepreneurs in the State of Rhode Island by the TECH 10 awards for developing innovative training and mentoring solutions for boards, senior executives, and operational stakeholders.

Digital Value Management System® (DVMS)

The DVMS is an adaptive, culture-enabled governance overlay designed to help organizations of any size, scale, or complexity transition from static, paper-based governance models to a living, evidence-based system of Governance, Resilience, Assurance, and Accountability (GRAA).

At its core, the DVMS is a simple but powerful integration of:

Rather than adding more complexity, a DVMS integrates fragmented frameworks and practices such as NIST CSF, GRC, ITSM, DevOps, and AI into a unified overlay system that enables leaders and regulators to see, in real time, whether the digital business is working as intended—and whether the risks that matter most are being managed proactively.

Through its MVC, CPD, 3D Knowledge, and FastTrack Models, a DVMS turns this integration into three distinctive capabilities:

A Governance Overlay that replaces fragmentation with unity. The DVMS provides organizations with a structured way to connect strategy with day-to-day execution. Leaders gain a consistent mechanism to direct, measure, and validate performance—across every system responsible for digital value.

A Behavioral Engine that drives high-trust, high-velocity decision-making. The DVMS embeds decision models and behavioral patterns that help teams think clearly and act confidently, even in uncertain situations. It is engineered to reduce friction, prevent blame-based cultures, and strengthen organizational reliability.

A Learning System that makes culture measurable, adaptable, and scalable. Culture becomes a managed asset—not an abstract concept. The DVMS provides a repeatable way to observe behavior, collect evidence, learn from outcomes, and evolve faster than threats, disruptions, or market shifts.

DVMS Organizational Benefits

Instead of replacing existing operational frameworks, the DVMS elevates them—connecting and contextualizing their data into actionable intelligence that validates performance and exposes the reasons behind unmet outcomes.

By adopting a DVMS, organizations are positioned to:

  • Maintain Operational Stability Amidst Constant Digital Disruption
  • Deliver Digital Value and Trust Across A Digital Ecosystem
  • Satisfy Critical Regulatory and Certification Requirements
  • Leverage Cyber Resilience as a Competitive Advantage

DVMS Leadership Benefits

The Digital Value Management System (DVMS) provides leaders with a unified, evidence-based approach to governing and enhancing their digital enterprise, aligning with regulatory requirements and stakeholder expectations.

For the CEO, the DVMS provides a clear line of sight between digital operations, business performance, and strategic outcomes—turning governance and resilience into enablers of growth and innovation rather than cost centers.

For the Board of Directors, the DVMS provides ongoing assurance that the organization’s digital assets, operations, and ecosystem are governed, protected, and resilient—supported by evidence-based reporting that directly links operational integrity to enterprise value and stakeholder trust.

For the CIO, CRO, CISO, and Auditors: an integrated, adaptive, and culture-driven governance and assurance management system that enhances digital business performance, resilience, trust, and accountability

DVMS White Papers

The three whitepapers below present a coherent progression that shifts organizations from compliance-driven thinking to a modern system of Governance, Resilience, Assurance, and Accountability (GRAA). Collectively, the three papers define a comprehensive system for building and governing resilient digital enterprises, grounded in evidence rather than assumptions.

The Assurance Mandate Paper sets the stage by showing why traditional GRC artifacts provide only reassurance—not evidence—and calls boards to demand forward-looking proof that their organizations can continue to create, protect, and deliver value under stress.

The Assurance in Action Paper elevates the conversation from leadership intent to managerial execution, demonstrating how the DVMS operationalizes resilience by translating outcomes into Minimum Viable Capabilities, connecting frameworks through the Create–Protect–Deliver model, and generating measurable assurance evidence that managers can use to demonstrate real performance rather than activity.

The Governing by Assurance Paper elevates the approach to the policy and regulatory level, showing how DVMS functions as a learning overlay system that links governance intent, operational capability, and verifiable evidence into a continuous loop—enabling regulators, agencies, and enterprises to govern by outcomes rather than checklists and to prove capability with measurable, auditable performance data.

DVMS Cyber Resilience Certified Training Programs

DVMS Cyber Resilience Awareness Training

The DVMS Cyber Resilience Awareness course and its accompanying body of knowledge publication educate all employees on the fundamentals of digital business, its associated risks, the NIST Cybersecurity Framework, and their role within a shared model of governance, resilience, assurance, and accountability for creating, protecting, and delivering digital value.

This investment fosters a culture that is prepared to operate within a system capable of transforming systemic cyber risks into operational resilience.

DVMS NISTCSF Foundation Certification Training

The DVMS NISTCSF Foundation certification training course and its accompanying body of knowledge publications provide ITSM, GRC, Cybersecurity, and Business professionals with a detailed understanding of the NIST Cybersecurity Framework and its role in a shared model of governance, resilience, assurance, and accountability for creating, protecting, and delivering digital value.

This investment fosters IT, GRC, Cybersecurity, and Business professionals with the skills to operate within a system capable of transforming systemic cyber risks into operational resilience.

DVMS Cyber Resilience Practitioner Certification Training

The DVMS Practitioner certification training course and its accompanying body of knowledge publications teach ITSM, GRC, Cybersecurity, and Business practitioners how to elevate investments in ITSM, GRC, Cybersecurity, and AI business systems by integrating them into a unified governance, resilience, assurance, and accountability system designed to proactively identify and mitigate the cyber risks that could disrupt operations, erode resilience, or diminish client trust.

This investment fosters IT, GRC, Cybersecurity, and Business practitioners with the skills to assess, design, implement, operationalize, and continually innovate a Digital Value Management System® program that operationalizes a shared model of governance, resilience, assurance, and accountability for creating, protecting, and delivering digital value.

Company Brochures and Presentation
Explainer Videos

Digital Value Management System® is a registered trademark of the DVMS Institute LLC.

® DVMS Institute 2025 All Rights Reserved

More To Explore

It's Time to Protect Your digital business value & resiliency

Publications, Certification Training, Enterprise Solutions & Community

Contact Us