The IIA's Global Internal Audit Standards took effect in January 2025. They introduced a new mechanism, Topical Requirements, which set minimum expectations for auditing specific risk areas. The first of these, on cybersecurity, has applied since 5 February 2026. Most internal audit functions are now completing their first engagements under it, and the lessons are useful for anyone finalising a 2027 audit plan.
When the requirement applies
The Topical Requirement is mandatory whenever cybersecurity is in scope. That includes dedicated cyber reviews, but also any engagement with a cybersecurity component, and reviews added to the plan during the year. It is easy to underestimate how often that is. Audits of payments, third-party oversight, data governance, IT change and operational resilience will frequently touch on cyber risk, and each of those engagements now needs to show how the requirement was considered.
The requirement does not mandate a cyber audit every year. It does require the chief audit executive to consider cybersecurity in the risk assessment that drives the audit plan, and to be able to show how that consideration was made.
What it asks for
The requirement is organised around three areas:
- Governance: cyber strategy and objectives, policies and procedures, roles and responsibilities, skills, stakeholder engagement, and how performance is measured and reported to the board.
- Risk management: how cyber threats are identified, assessed, mitigated and monitored, accountability for cyber risk, escalation, awareness and training, and incident response and recovery.
- Control processes: internal and vendor controls protecting the confidentiality, integrity and availability of systems and data, including access management, patching, network controls, encryption and endpoint security.
The IIA provides a template for documenting how each element was considered and either addressed or excluded. The accompanying user guide is illustrative rather than mandatory, and refers to established frameworks such as NIST CSF and COBIT.
Where functions are getting caught out
Undocumented exclusions. It is acceptable to scope an element out of an engagement, but the reason must be recorded. Engagement files where elements are simply absent will not show conformance at the next external quality assessment.
Partial-scope engagements. Functions have applied the requirement to their dedicated cyber review and forgotten it on the third-party or resilience audit that also touched cyber controls.
Governance treated lightly. Technical control testing is often well developed. Coverage of cyber governance, board reporting and the skills of those responsible for cyber risk is frequently thinner, yet that is where the requirement adds most.
Capability. Many functions still rely on generalist auditors for cyber work. The requirement does not demand specialist qualifications, but it does expect the function to have, or obtain, the competence to reach credible conclusions.
Building it into the 2027 plan
The practical step is to map the requirement's elements against the multi-year plan, so that coverage of governance, risk management and controls can be shown over a cycle rather than squeezed into a single engagement. Methodology and working paper templates should prompt auditors to consider the requirement on any engagement with a cyber component. Where specialist skills are needed, planning co-sourced support early is far cheaper than discovering the gap in fieldwork.
Further Topical Requirements are expected to follow. Functions that build a repeatable approach now will find the next one easier to absorb.
Getting specialist support
We help internal audit functions build IIA-aligned methodologies and provide subject matter support for technology and cyber audit coverage. If you want an independent view of your conformance with the Topical Requirement, or support with your first engagements under it, we are happy to have a conversation.
