Internal Audit in the Age of Quantum Risk

Most conversations about quantum computing live in the technical corners of an organization. Cryptographers debate algorithms, security engineers discuss key sizes, and the board hears, at most, a passing reference to quantum in an annual risk briefing. This is a mistake. The arrival of cryptographically relevant quantum computers is not only a technical event. It is an enterprise risk event, on the same scale as a major regulatory shift or a systemic cyber threat, and it demands the kind of structured oversight that internal audit exists to provide.

The challenge is that quantum risk does not behave like the threats internal audit teams are used to assessing. It is slow moving, easy to defer, and invisible in day to day operations, right up until the moment it becomes catastrophic and irreversible. That combination makes it exactly the kind of risk that slips through the cracks of an organization without strong governance. This blog makes the case for why internal audit should be actively engaged in quantum readiness today, and what that engagement should look like in practice.

Quick Answer: What Role Should Internal Audit Play in Quantum Risk?

Internal audit should treat quantum risk as an active enterprise risk today, not a future technical concern, because the harvest now, decrypt later threat means sensitive data is already being exposed even though decryption is years away. It matters because ISACA’s 2025 polling found 62 percent of digital trust and risk professionals worried about quantum breaking current encryption while only 5 percent of organizations have a defined quantum strategy, a gap that is precisely the kind of control weakness audit exists to surface. The recommended action is for internal audit to independently validate that a cryptographic inventory exists, that a funded and time-bound migration roadmap is being executed, and that harvest now, decrypt later exposure and third-party quantum readiness are both being actively assessed, rather than waiting for a technical team to raise the issue unprompted.

Understanding the threat: Q-day and the clock that is already running

Quantum computers solve certain problems in fundamentally different ways than classical machines. Where a classical computer works through possibilities largely in sequence, a quantum computer can evaluate many possibilities simultaneously, giving it an exponential advantage on a specific class of mathematical problems. Two of those problems, integer factorization and the discrete logarithm, are exactly what today’s public-key cryptography depends on.

RSA, ECC, and Diffie-Hellman, the algorithms that secure web traffic, digital signatures, VPNs, and authentication across nearly every enterprise, rely on the assumption that these problems are too hard to solve in any practical timeframe. A sufficiently powerful quantum computer running Shor’s algorithm breaks that assumption. Q-day is the point at which a quantum computer can run Shor’s algorithm at sufficient scale to break RSA, ECC, and Diffie-Hellman.

The replacements already exist. In August 2024, NIST finalized its first post-quantum standards: FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures, with HQC selected in March 2025 as an additional code-based key-encapsulation mechanism. The standards are final, which means the open question is no longer whether to migrate but how quickly an organization can.

The uncomfortable truth is that the timeline does not start at Q-day. It started years ago. Adversaries are already engaged in what is known as harvest now, decrypt later: intercepting and storing encrypted data today, with the intention of decrypting it once quantum capability arrives. For any data with a long confidentiality lifespan, such as financial records, health information, intellectual property, government data, or trade secrets, the exposure is happening right now even though the decryption is years away. The data being stolen today does not become safe simply because you migrate later.

The concern is widely shared, but preparation is not. According to ISACA’s 2025 Quantum Computing Pulse Poll of more than 2,600 digital trust, cybersecurity, audit, and risk professionals, 62 percent are worried that quantum computing will break today’s encryption and 56 percent cite harvest now, decrypt later as a concern, yet only about 5 percent say their organization has a defined quantum strategy. In other words, roughly 95 percent have no roadmap. That gap between awareness and action is precisely the kind of control weakness internal audit is built to surface.

This is what makes quantum risk an immediate governance concern rather than a future technical project. The decisions that determine whether your most sensitive long-lived data survives Q-day are being made, or neglected, today.

What Do Auditors Need to Know? Key Definitions and Security Assumptions

An auditor does not need to be a cryptographer to test quantum readiness, but the review does depend on a handful of terms being understood precisely rather than loosely. The security assumption underlying nearly everything else in this article is simple: RSA, ECC, and Diffie-Hellman are only as safe as the assumption that factoring large numbers and solving discrete logarithms stay computationally impractical. Quantum computing is the first credible, standards-driven challenge to that assumption, which is why the terms below matter to an audit scope rather than only to a cryptography team.

• Q-day: the point at which a quantum computer can run Shor’s algorithm at a scale sufficient to break RSA, ECC, and Diffie-Hellman in practice. No credible source claims a confirmed date; the planning assumption is that it could arrive with little public warning.
• Harvest now, decrypt later (HNDL): the practice of capturing and storing encrypted traffic or data today so it can be decrypted once a cryptographically relevant quantum computer exists. It converts a future capability into a present-day exposure for any data with a multi-year confidentiality requirement.
• Cryptographic inventory: a maintained record of every certificate, key, algorithm, and protocol in use across an organization, and which systems and data depend on each one. Without it, neither the organization nor its auditors can say with confidence what is exposed.
• Crypto-agility: the architectural ability to change cryptographic algorithms, key sizes, or protocols without a ground-up rebuild of the systems that depend on them. It is the property that turns a migration from a crisis project into a routine change.
• Cryptographic posture management (CPM): the ongoing operating discipline, discover, assess, prioritize, remediate, and monitor, that keeps a cryptographic inventory and its risk ratings current rather than letting them go stale after the first assessment.
• Post-quantum cryptography (PQC): the family of algorithms, including ML-KEM, ML-DSA, SLH-DSA, and HQC, designed to remain secure against both classical and quantum attacks, standardized by NIST starting in August 2024.

Why this is an internal audit problem, not just an IT problem

Security teams can implement cryptography, but they cannot, on their own, guarantee that quantum risk is being managed at the level the organization requires. That gap is precisely where internal audit adds value. Internal audit brings three things that a purely technical response lacks: independence, an enterprise-wide vantage point, and the authority to hold the organization accountable to its own commitments.

This is also where internal audit’s role differs from everyone else at the table. The distinguishing contribution of audit is independent assurance: verifying that controls exist and operate as intended, rather than implementing them. That separates internal audit from the consultancies and integrators who build migration programs and from the tooling vendors who supply the technology. Audit does not own the roadmap; it tests whether the roadmap is real, funded, and working. Keeping that line clear is what makes the assurance credible to a board.

Consider the questions a board should be able to answer about quantum readiness. Does the organization know which systems and data depend on quantum-vulnerable cryptography? Is there an owned, funded, and time-bound migration plan? Are third parties and vendors, who hold and process sensitive data, being assessed for their own readiness? Do regulatory obligations around cryptographic standards have a clear path to compliance? In most organizations, no single technical team can answer all of these, because the answers span IT, security, legal, procurement, risk, and executive leadership.

Internal audit is the function designed to look across all of those domains, test whether controls actually exist and operate as intended, and report the truth to leadership and the board. Quantum readiness needs exactly that kind of independent, cross-functional assurance. Without it, working on quantum becomes a comfortable assertion that no one ever verifies.

What internal audit should actually do

Engaging with quantum risk does not require auditors to become cryptographers. It requires applying the discipline of audit to a new and high-stakes domain. Six areas of focus stand out.

Validate that a cryptographic inventory exists and is complete. The foundation of all quantum readiness is knowing where vulnerable cryptography lives. Internal audit should assess whether the organization has a genuine, continuously maintained inventory of its cryptographic assets, including certificates, keys, algorithms, and the systems and data that depend on them. An inventory that is partial, stale, or maintained in a spreadsheet is a finding in itself.

Assess the existence and quality of a migration roadmap. Readiness is not a slogan, it is a plan with owners, budgets, milestones, and prioritization based on data sensitivity and system lifespan. Internal audit should evaluate whether such a roadmap exists, whether it is realistic, and whether it is actually being executed against, rather than sitting on a shelf.

Test data protection against the harvest now, decrypt later threat. Auditors should examine whether long-lived sensitive data is protected by anything beyond classical encryption alone. Where data with a multi-year confidentiality requirement is protected only by RSA or ECC, that is an active exposure that warrants immediate attention and escalation.

Examine third-party and supply chain risk. An organization’s quantum exposure extends to every vendor, partner, and service provider that holds or transmits its data. Internal audit is well positioned to ensure that quantum readiness becomes part of third-party risk assessments and contractual due diligence.

Map specific frameworks and deadlines to organizational action. Governments and regulators are moving quantum readiness from recommendation toward requirement. Rather than tracking generic applicable standards, internal audit should check the organization’s roadmap against the concrete references auditors and regulators actually use: CISA’s post-quantum cryptography migration guidance, NIST’s NCCoE practice guide SP 1800-38 (Migration to Post-Quantum Cryptography), the NSA’s CNSA 2.0 transition milestones, and, for federal agencies and their suppliers, OMB Memorandum M-23-02. Verify the current versions and dates at the time of review, since these continue to evolve.

Promote crypto-agility, delivered through cryptographic posture management. Perhaps the most strategic contribution internal audit can make is to press whether systems are being designed for crypto-agility, the ability to swap cryptographic algorithms without massive rework. Crypto-agility is the governing principle; the continuous operating discipline that delivers it is increasingly called cryptographic posture management (CPM), a repeating cycle of discover, assess, prioritize, remediate, and monitor. Organizations that hardcode cryptography will face the next transition, and the one after that, as a crisis each time. Those that build agility in, and operate it as an ongoing posture rather than a one-off project, will not.

What Does This Look Like in Practice? A Worked Example

Consider an internal audit team at a mid-sized financial services firm opening its first quantum readiness review, an illustrative walkthrough of how the six areas above translate into actual audit work rather than a checklist left unexecuted.

The team starts by requesting the organization’s cryptographic inventory and finds that no single, current inventory exists; certificate data lives in one spreadsheet maintained by the PKI team, key management records sit in a separate vault console, and nobody can produce a combined list of which customer-facing applications rely on RSA-2048 versus ECC. That absence is logged as the first finding, since it blocks every downstream test. Next, the team asks for the migration roadmap and receives a slide deck from a security offsite eighteen months earlier with no named owner, no budget line, and no milestones tied to a calendar date, a second finding distinct from the first: awareness exists, but execution does not. The team then samples five systems that store customer financial records with a multi-year retention requirement and confirms all five rely solely on RSA or ECC with no compensating control, which becomes a third finding flagged for immediate escalation given the harvest now, decrypt later exposure. Finally, the team reviews the top ten vendor contracts by data volume and finds none contain a clause requiring the vendor to disclose its own post-quantum migration timeline, a fourth finding routed to procurement and legal.

None of these four findings required the audit team to evaluate a single line of cryptographic code. Each one came from asking whether a control that should exist actually does, and from testing the evidence rather than accepting an assurance at face value, which is exactly the independent assurance role internal audit is meant to play.

Framing quantum as an enterprise risk

The most important shift internal audit can drive is one of framing. As long as quantum is treated as a niche technical topic, it will compete poorly for attention and budget against more immediate concerns. Reframed as what it actually is, a foreseeable, high-impact, and irreversible risk to the confidentiality and integrity of enterprise data, it earns its place on the enterprise risk register and in board-level discussion.

This framing also clarifies the cost of inaction. Cryptographic migration is not a quick patch. Credible estimates from NIST and major advisory firms describe full migration as a multi-year program, often years of planning before the work is complete, and ISACA’s poll shows roughly 95 percent of organizations still have no roadmap.

The runway is shrinking before preparation has even started. A near-term forcing function makes this concrete: under the CA/Browser Forum’s approved schedule, the maximum public TLS certificate lifetime drops from 398 days to 200 days in March 2026, to 100 days in March 2027, and to 47 days by March 2029. Long before Q-day, that cadence makes manual cryptographic change untenable and rewards organizations that have already built automation and agility.

An organization that begins migrating only when quantum computers are demonstrably capable will be far too late, both for its harvested historical data and for the operational scramble of a rushed transition. Internal audit’s role is to make that timeline visible now, while there is still time to act on it deliberately.

Decision Table: Matching Audit Findings to Enterprise Action

Audit finding	Recommended enterprise action
No cryptographic inventory exists, or it is fragmented across teams	Fund a continuous cryptographic discovery and inventory capability before writing any migration plan
A migration roadmap exists but has no owner, budget, or milestones	Escalate to the risk committee as a governance gap, not merely a technical delay
Long-lived sensitive data is protected only by RSA or ECC	Flag as an active harvest now, decrypt later exposure and prioritize for hybrid or post-quantum protection
Vendor contracts are silent on post-quantum readiness	Add quantum readiness disclosure and remediation clauses at next renewal cycle
Systems hardcode specific algorithms with no abstraction layer	Require crypto-agility as a design standard for new and re-architected systems
The organization has no mapping to CISA, NIST SP 1800-38, or CNSA 2.0 milestones	Commission a compliance gap assessment against the frameworks applicable to the organization’s sector

Numbered Workflow: Launching a Quantum Risk Internal Audit

1. Scope the review around the six areas of focus above rather than attempting a full technical cryptography audit on the first pass.
2. Request the organization’s current cryptographic inventory and independently test a sample of systems to confirm it is accurate and complete, not merely assumed.
3. Request the migration roadmap and verify it has a named owner, an approved budget, and dated milestones, rather than accepting a slide deck as evidence of a plan.
4. Sample systems that store long-lived sensitive data and confirm whether they rely solely on classical cryptography, flagging any that do as active harvest now, decrypt later exposure.
5. Review the top vendor and third-party contracts by data volume for post-quantum readiness disclosure requirements.
6. Map every finding against the specific frameworks and deadlines relevant to the organization’s sector, such as CISA guidance, NIST SP 1800-38, CNSA 2.0, or OMB M-23-02, rather than a generic reference to being quantum aware.
7. Report findings to the audit committee and board with the enterprise risk framing above, prioritized by data sensitivity and time to exposure rather than technical complexity.
8. Schedule a follow-up review on a fixed cadence, since a cryptographic inventory and a roadmap both degrade in accuracy without ongoing cryptographic posture management.

Limitations of Internal Audit’s Role in Quantum Readiness

• Audit tests the plan; it does not build it: internal audit can confirm a migration roadmap is real, funded, and on track, but implementing the cryptographic changes themselves is the job of security, engineering, and specialist advisors.
• Findings still require executive sponsorship to act on: an audit report that identifies a governance gap does not, by itself, secure the budget or organizational priority needed to close it.
• Audit depends on evidence that must exist to be tested: where no cryptographic inventory or discovery tooling exists at all, audit’s first finding is simply that nothing can yet be verified, which is a starting point, not a completed review.
• A single review is a snapshot, not a guarantee: cryptographic risk changes as new systems, vendors, and data are added, so a quantum readiness audit needs a recurring cadence rather than a one-time engagement to stay meaningful.

How Encryption Consulting can help

Internal audit can identify and frame quantum risk, but acting on it requires deep cryptographic expertise and the right tooling. This is where Encryption Consulting partners with organizations, turning audit findings and board mandates into an executable quantum readiness program.

CBOM Secure discovers cryptography across any certificate authority and any environment, which is exactly what an audit-led, independence-first program needs. It is our cryptographic discovery and inventory solution, built to give your audit and security teams the visibility this kind of oversight demands. It continuously discovers and inventories cryptographic assets, including certificates, keys, algorithms, and protocols, and flags which are quantum-vulnerable. This transforms the cryptographic inventory from an audit aspiration into a living, data-driven asset, and provides the evidence base internal audit needs to assess readiness objectively.

Our Post-Quantum Cryptographic Advisory Services guide organizations through the full readiness lifecycle, from quantum risk assessment and data sensitivity analysis to building a prioritized, owned migration roadmap and implementing hybrid and post-quantum algorithms. This is the structured, time-bound plan that internal audit should expect to see, delivered by specialists who do this work every day.

On the governance side, our Compliance Advisory Services help align your quantum readiness program with NIST, CISA, CMMC, and other evolving regulatory frameworks, ensuring that what internal audit recommends maps cleanly to what regulators will require. And our Encryption Advisory Services provide the broader strategic foundation for managing cryptographic risk across the enterprise.

Whether your internal audit team is opening its first review of quantum risk or your organization is ready to execute a full migration, Encryption Consulting brings the expertise and tooling to move you forward. Get in touch to start building defensible, auditable quantum readiness.

Conclusion

Quantum risk is unusual among enterprise threats because its most damaging consequences are being set in motion today, silently, while the visible impact remains years away. That delay is precisely what makes strong governance essential. Left to compete with the urgent issues of the moment, quantum readiness will always lose, until the day it can no longer be deferred and the window to respond has closed.

Internal audit exists to surface exactly these kinds of risks: foreseeable, high-impact, and easy to ignore. By validating cryptographic inventories, testing data protection, scrutinizing migration plans, and reframing quantum as the enterprise risk it truly is, internal audit can ensure the organization acts while action still makes a difference.

The clock to Q-day is already running, and so is the harvesting of data meant to be decrypted when it arrives. The organizations that treat quantum readiness as a matter of governance, not just engineering, are the ones that will reach that day prepared.

Frequently Asked Questions

Does an internal auditor need cryptography expertise to review quantum readiness?

No. The review is a governance and control test: does a cryptographic inventory exist, is there a funded roadmap, and is harvest now, decrypt later exposure being managed. Auditors can partner with cryptography specialists to validate technical details without needing that expertise themselves.

How often should a quantum risk internal audit be repeated?

At least annually, and sooner if the organization completes a major acquisition, adopts new cloud infrastructure, or its migration roadmap reaches a scheduled milestone. Cryptographic inventories and vendor relationships change continuously, so a one-time review loses accuracy quickly.

What should audit do if the organization has no cryptographic inventory at all?

Report the absence itself as the primary finding rather than attempting to work around it. Without an inventory, no other quantum readiness claim, a roadmap, a risk rating, a vendor assessment, can be independently verified, so building the inventory becomes the first recommended action.

Is quantum risk relevant to organizations too small to have a dedicated internal audit function?

Yes. The harvest now, decrypt later threat applies to any organization holding long-lived sensitive data, regardless of size. Smaller organizations without a formal audit function should assign the same independent-review questions, does an inventory exist, is there a roadmap, to whoever owns enterprise risk oversight, such as a compliance lead or an external assessor.

How should quantum risk be prioritized against more immediate cybersecurity risks?

It should be evaluated on the enterprise risk register alongside other risks, weighted by impact and likelihood, rather than deferred by default because the impact feels distant. Since harvest now, decrypt later makes the exposure current even though decryption is future, the risk register should reflect today’s data exposure, not a future event date.