IT Compliance Group managing director, Jim Hurley, said failing to protect IT security and regulatory audit data is like a bank giving away the combination to the vault.

"Instead of securities and cash, these firms are putting sensitive data, customers, revenues and business futures entirely at risk," he said.

The report provides a number of recommendations to improve protection from increasing the frequency of audits to implementing technology to mitigate user errors and policy violations.