Cyber Strategy
Cyber Secure
Cyber Operations
Cyber Response
Cyber ResilienceCybersecurity is the top risk and the top audit priority for chief audit executives worldwide, according to the IIA’s latest Risk in Focus survey, yet only a third say internal audit’s coverage of it is fully adequate. With the IIA’s Cybersecurity Topical Requirement in force since February 2026, internal audit functions in the GCC are expected to give boards deeper assurance on cyber risk and a clearer view of AI risk.
Internal audit has long been seen as the function that checks what already happened. Boards in the GCC increasingly want something else from it: an independent view of whether the organization can handle the risks moving fastest, particularly cyber attacks, AI adoption and supplier failures. That expectation is now backed by the profession’s own standards.
The gap between risk and coverage
The Internal Audit Foundation’s Risk in Focus 2026/2027 global summary, based on responses from 3,285 chief audit executives in 132 countries, shows how far audit coverage trails the risks boards care about:
- 80% rank cybersecurity among their top five risks, and 75% rank it among their top five audit priorities.
- Only 45% rate their cyber risk governance as managed or optimized, and only 33% say internal audit’s cyber coverage is fully adequate.
- Digital disruption, including AI, is a top-five risk for 58% of respondents but a top-five audit priority for 42%. Only 11% report full audit coverage of it.
Middle East respondents rated cyber risk higher still, with 81% placing it in their top five. One chief audit executive at a Kuwaiti financial services firm told the IIA researchers that technology adoption can move faster than the governance framework around it, a pattern familiar to anyone auditing AI deployments in the region.
New standards, new minimum expectations
The IIA’s Global Internal Audit Standards took effect on 9 January 2025, with a stronger focus on internal audit strategy, stakeholder relationships and performance measurement. Alongside them, the IIA is issuing mandatory Topical Requirements that set a minimum baseline for specific risk areas:
Topical Requirement | Effective date |
|---|---|
Cybersecurity | 5 February 2026 |
Third-party risk | September 2026 |
Organizational behavior | December 2026 |
Organizational resilience | April 2027 |
The Cybersecurity Topical Requirement applies whenever internal audit provides assurance on cybersecurity, based on the function’s own risk assessment. It is organised around governance, risk management and controls, so a review limited to technical controls will not meet it on its own. It also reaches beyond dedicated IT audits: any engagement with cyber risk in scope can trigger it.
Where internal audit adds the most value
The Risk in Focus report points to a set of practices that separate functions boards rely on from those they tolerate.
Assurance mapping. A single view of risk level, governance maturity, audit priority and coverage from other assurance providers shows the board where assurance is thin. The IIA recommends presenting this alongside the risk ranking itself, so the audit committee sees accepted exposure explicitly.
Risk pathways. A cyber incident rarely stays a cyber incident: it can become fraud, a service outage, a privacy breach or regulatory action. Auditing these pathways, instead of reviewing each risk in its own silo, finds the weak handoffs between teams.
AI governance reviews. Where AI is being adopted quickly, there may be few mature controls to test. Internal audit adds value earlier by reviewing AI inventories, ownership, data standards and monitoring before deployment.
Third-party assurance. With the third-party Topical Requirement now effective, internal audit should be testing whether critical suppliers can support recovery during an incident. Our article on managing third-party and supply chain security covers the core controls.
The skills problem
The main constraint on cyber and AI coverage is expertise. Cloud, identity, operational technology and AI each need specialists that most audit functions cannot keep on staff full time. The IIA’s report lists training, recruitment, guest auditors, co-sourcing and external specialists as options, with one condition: access to that capability should be arranged before a crisis makes it urgent.
Capacity is the second constraint. Globally, governance and corporate reporting is a top-five audit priority for 45% of respondents but a top-five risk for only 20%. Much of that work is required by regulation, but it leaves less room for emerging risks unless recurring audits are automated, rotated or supported by reliance on other providers.
Planning for 2027
- Assess conformance with the Cybersecurity Topical Requirement and document how cyber assurance is spread across planned engagements.
- Build a risk, maturity and coverage map for the audit committee.
- Agree criteria for relying on second-line and external assurance work.
- Arrange co-sourced technical support where in-house skills are thin.
- Add third-party and resilience coverage to the 2027 plan ahead of the next Topical Requirements.
- Report cyber security metrics the board can act on, such as time to remediate high-risk findings, through a consistent executive cyber dashboard.
Cybersecurity is the top risk and the top audit priority for chief audit executives worldwide, according to the IIA’s latest Risk in Focus survey, yet only a third say internal audit’s coverage of it is fully adequate. With the IIA’s Cybersecurity Topical Requirement in force since February 2026, internal audit functions in the GCC are expected to give boards deeper assurance on cyber risk and a clearer view of AI risk.
Internal audit has long been seen as the function that checks what already happened. Boards in the GCC increasingly want something else from it: an independent view of whether the organization can handle the risks moving fastest, particularly cyber attacks, AI adoption and supplier failures. That expectation is now backed by the profession’s own standards.
The gap between risk and coverage
The IIA’s Global Internal Audit Standards took effect on 9 January 2025, with a stronger focus on internal audit strategy, stakeholder relationships and performance measurement. Alongside them, the IIA is issuing mandatory Topical Requirements that set a minimum baseline for specific risk areas:
Topical Requirement | Effective date |
|---|---|
Cybersecurity | 5 February 2026 |
Third-party risk | September 2026 |
Organizational behavior | December 2026 |
Organizational resilience | April 2027 |
The Cybersecurity Topical Requirement applies whenever internal audit provides assurance on cybersecurity, based on the function’s own risk assessment. It is organised around governance, risk management and controls, so a review limited to technical controls will not meet it on its own. It also reaches beyond dedicated IT audits: any engagement with cyber risk in scope can trigger it.
Where internal audit adds the most value
The Risk in Focus report points to a set of practices that separate functions boards rely on from those they tolerate.
Assurance mapping. A single view of risk level, governance maturity, audit priority and coverage from other assurance providers shows the board where assurance is thin. The IIA recommends presenting this alongside the risk ranking itself, so the audit committee sees accepted exposure explicitly.
Risk pathways. A cyber incident rarely stays a cyber incident: it can become fraud, a service outage, a privacy breach or regulatory action. Auditing these pathways, instead of reviewing each risk in its own silo, finds the weak handoffs between teams.
AI governance reviews. Where AI is being adopted quickly, there may be few mature controls to test. Internal audit adds value earlier by reviewing AI inventories, ownership, data standards and monitoring before deployment.
Third-party assurance. With the third-party Topical Requirement now effective, internal audit should be testing whether critical suppliers can support recovery during an incident. Our article on managing third-party and supply chain security covers the core controls.
The skills problem
The main constraint on cyber and AI coverage is expertise. Cloud, identity, operational technology and AI each need specialists that most audit functions cannot keep on staff full time. The IIA’s report lists training, recruitment, guest auditors, co-sourcing and external specialists as options, with one condition: access to that capability should be arranged before a crisis makes it urgent.
Capacity is the second constraint. Globally, governance and corporate reporting is a top-five audit priority for 45% of respondents but a top-five risk for only 20%. Much of that work is required by regulation, but it leaves less room for emerging risks unless recurring audits are automated, rotated or supported by reliance on other providers.
Planning for 2027
- Assess conformance with the Cybersecurity Topical Requirement and document how cyber assurance is spread across planned engagements.
- Build a risk, maturity and coverage map for the audit committee.
- Agree criteria for relying on second-line and external assurance work.
- Arrange co-sourced technical support where in-house skills are thin.
- Add third-party and resilience coverage to the 2027 plan ahead of the next Topical Requirements.
- Report cyber security metrics the board can act on, such as time to remediate high-risk findings, through a consistent executive cyber dashboard.
Frequently asked questions
What is the IIA Cybersecurity Topical Requirement?
It is the first mandatory Topical Requirement under the IIA’s Global Internal Audit Standards. It sets a minimum baseline for internal auditors providing assurance on cybersecurity, covering governance, risk management and controls, and took effect on 5 February 2026.
When did the Global Internal Audit Standards take effect?
The Global Internal Audit Standards became effective on 9 January 2025, one year after the IIA released them.
Does internal audit need its own cyber specialists?
Not always. Many functions combine in-house auditors with co-sourced specialists for technical testing, provided the specialists are independent of the areas they review and the arrangement is in place before it is needed.
Frequently asked questions
What is the IIA Cybersecurity Topical Requirement?
It is the first mandatory Topical Requirement under the IIA’s Global Internal Audit Standards. It sets a minimum baseline for internal auditors providing assurance on cybersecurity, covering governance, risk management and controls, and took effect on 5 February 2026.
When did the Global Internal Audit Standards take effect?
The Global Internal Audit Standards became effective on 9 January 2025, one year after the IIA released them.
Does internal audit need its own cyber specialists?
Not always. Many functions combine in-house auditors with co-sourced specialists for technical testing, provided the specialists are independent of the areas they review and the arrangement is in place before it is needed.
See also:
Dubai