Washington, D.C. magazine CFO reports financial auditors are increasingly concerned about cybersecurity, demanding greater transparency on how organizations are managing and mitigating cyber risk. And why shouldn't they? A cyberattack or a data breach can lead to major financial losses, business disruption, loss of customer confidence, costly lawsuits and irreversible damage to reputation.

Cybersecurity audits and assessments are one of the best ways organizations can improve their security posture. When done right, they can help identify cyber risks, validate the effectiveness of cybersecurity programs, protect the business against cyberattacks, and provide assurance to stakeholders. However, cybersecurity is such a vast domain that it is difficult to determine what constitutes the "right" way of doing things. Here are five common mistakes that every organization must avoid when it comes to auditing its cybersecurity:

1. Choosing an auditor that is not pure play security

In March, the Wall Street Journal reported a follow-up story on the three major U.S. bank failures, learning they had one thing in common: KPMG. This was not the first time the audit quality of Big Four accounting firms was questioned. Not too long ago, the Big Four used to be the Big Five and the Big Five used to be the Big Six, and the Big Six used to be the Big Eight. A head-spinning tale of M&A activity, interdepartmental fiefdoms and turf wars have blurred the areas of expertise.