It looks entirely possible you will have ‘adequate’ security dictated by your insurers, so it is your job to understand the risk based yardstick they’re using to define that
Cyber Insurers Dictating Cybersecurity Standards?
Why Auditors Can Fail Security
About half of internal audit’s key stakeholders do not believe that internal audit is either delivering the value it should or addressing the risks that matter