Is an internal legacy system still a cyber risk if it is not public-facing?

No. Internal-only placement may reduce exposure, but it does not eliminate risk. Internal systems can still be affected by lateral movement, compromised credentials, vendor remote access, weak segmentation, removable media, malware, misconfigured firewall rules, or operational failure.

The auditor should ask for evidence. If IT says the system is isolated, internal audit can review network diagrams, firewall rules, allowed ports, access lists, vulnerability review, endpoint protection, logging, backup and restore testing, and incident-response coverage.

The right audit question is not, "Can I personally prove the exact exploit path?" The better question is, "Has management assessed the risk, implemented controls, and accepted the residual exposure at the right level?"

If the residual risk has not been accepted or remediated, internal audit can report a governance and control gap even without acting as the technical security architect.