Implementing Internal Audit for WebTrust CA/NS in Digital Signature Companies - Tambunan, Sarah Rosdiana; Sihombing, Indah Elisa; Sibarani, Tiarani (JBASE - Journal of Business and Audit Information Systems, 2025)
Internal audit plays a crucial role in ensuring the readiness and compliance of Certificate Authorities (CAs) with internationally recognized information security standards, particularly the WebTrust for Certification Authorities and Network Security. This topic has become increasingly relevant due to the growing demand for reliable and regulation compliant digital signature services. This study aims to examine the implementation of internal audit based on the WebTrust standard within a digital signature service provider in Indonesia. The research adopts a qualitative descriptive approach, utilizing document analysis and in-depth interviews with personnel performing trusted roles. The internal audit process consists of five main stages: defining the audit scope, mapping relevant controls to the standard, collecting evidence from operational processes and systems, evaluating the implementation’s conformity, and compiling the final report along with improvement recommendations. The audit findings reveal that most issues are concentrated in CA Environmental Controls, which includes asset management, physical security, and the documentation of policies and procedures. These findings indicate the need for strengthening controls in these areas to enhance the organization’s security posture. The internal audit has proven effective in identifying weaknesses early, providing relevant improvement recommendations, and serving as a strategic step in preparing for the external WebTrust audit. Thus, internal audit can be a critical instrument in improving system reliability, strengthening information security governance, and maintaining trust in digital signature services.