The Institute of Internal Auditors’ (IIA) Topical Requirements establishes a new baseline for assurance work, with additional requirements expected across multiple risk domains in the years ahead. These mandatory additions to the Global Internal Audit Standards define minimum criteria that internal audit functions must assess when conducting assurance engagements in covered risk areas. Cybersecurity became effective on Feb. 5, 2026; third-party risk followed on Sept. 15, 2026, with organizational behavior taking effect on Dec. 15, 2026. Organizational resilience is also expected, though an effective date hasn’t been established.
While the requirements don’t dictate which risks belong in an audit plan, they do provide a clearer definition of what assurance must include once a covered topic is selected. More importantly, they establish a common baseline for assurance work across the profession.
The need for that consistency is evident in cybersecurity, which offers a particularly clear example. One audit team might conduct a broad assessment of governance, risk management, and technical controls, while another might simply confirm that a policy exists. Both may have considered the topic audited, despite significant differences in the depth and rigor of their work. That’s beginning to change.
The implications extend beyond methodology. The requirements introduce new expectations around capability, resourcing, governance, and readiness.
What’s changed?
Several aspects of the Topical Requirements represent a meaningful shift for the profession.
- Conformance is mandatory. When a covered topic reaches the appropriate risk threshold or is included in the audit plan as an assurance engagement, internal auditors must evaluate the minimum criteria established by the applicable requirement. Advisory engagements may have greater flexibility, but assurance work is expected to conform.
- External evaluation is required. External quality assessments conducted after a requirement’s effective date will assess whether the audit function appropriately conformed to applicable Topical Requirements. What was previously viewed as a scoping decision can now become a quality assessment finding.
- The standards recognize that organizations may face legitimate resource or operational constraints. Deviations are permitted, but they must be documented along with the rationale supporting the decision. Transparency has become an explicit component of conformance.
These changes reduce ambiguity around what assurance should entail. More importantly, they establish a common baseline against which audit engagements and, increasingly, audit functions are evaluated.
Why this matters
The significance of the Topical Requirements isn’t limited to the specific topics currently covered — their broader impact is making capability gaps more visible.
Many audit functions have historically relied on methodologies developed over years of practice. In some cases, those methodologies may already align closely with the new requirements. In others, engagements that were previously considered sufficient may not fully meet the newly established baseline.
This doesn’t mean organizations must suddenly audit every covered topic; risk assessment and professional judgment remain central to audit planning. However, once an organization determines that a covered topic warrants assurance work, the conversation changes. Internal audit leaders must be prepared to demonstrate that the engagement’s scope, methodology, and execution align with the applicable requirements. That shifts the discussion from compliance to capability. Organizations must evaluate whether they possess the methodologies, expertise, and resources necessary to meet the new baseline and, if not, how to address those gaps.
Readiness is a portfolio question
Few internal audit teams possess deep expertise across every emerging risk domain. Each requires different knowledge, methodologies, and resource commitments. The question then isn’t whether an internal department can audit these areas at all — it’s whether they can audit them in a manner that satisfies the new baseline.
Addressing that challenge generally falls into three categories: building capability internally, sourcing specialized expertise, or documenting legitimate limitations when conformance can’t reasonably be achieved.
Building internal capability may make sense when a topic appears regularly in the audit plan and is likely to recur. Sourcing expertise may be the more practical option when a topic requires highly specialized knowledge or appears only periodically. Meanwhile, documentation provides transparency when resource constraints or organizational circumstances limit the scope of an engagement. Importantly, documentation doesn’t substitute for capability but serves as a mechanism to ensure stakeholders understand where and why limitations exist.
However, organizations should be careful not to view Topical Requirement readiness as a single operating-model decision. The appropriate approach may vary based on risk priorities and organizational circumstances. In practice, it could mean building expertise in one area, sourcing specialized support in another, and documenting a limitation in a third. Viewed this way, readiness becomes a portfolio of decisions rather than a single strategic choice.
Preparing for what’s next
Organizations preparing for current and forthcoming Topical Requirements should begin by identifying where covered topics intersect with the audit plan and risk assessment. From there, internal audit leaders can evaluate existing methodologies against applicable requirements, assess capability and resource gaps, and determine where capabilities should be built, sourced, or otherwise addressed. Significant readiness decisions should be discussed with governance stakeholders before they emerge as issues during an engagement or quality assessment.
The bottom line
Risk assessment and professional judgment still determine what belongs in an audit plan. What’s changed, however, is the minimum expectation once a covered topic is added to that plan. That shift matters. The new requirements establish greater consistency in how assurance is performed, increase visibility into capability gaps, and create new expectations around readiness. Organizations that begin evaluating their methodologies, resources, and sourcing strategies now will be better positioned to meet the new baseline as additional requirements take effect.
