Requirement Details
The IIA’s first mandatory Topical Requirement focuses on cybersecurity risk assessment and audit procedures. Released in February 2025 and effective February 5, 2026, this requirement aims to enhance the consistency and quality of internal audit services related to cybersecurity risks. It provides comprehensive guidance on evaluating information security governance, assessing technical controls, reviewing incident response capabilities, and validating compliance with cybersecurity frameworks. The requirement addresses emerging technologies including cloud security, artificial intelligence risks, IoT vulnerabilities, and supply chain cyber threats. Internal audit functions must develop specific competencies in cybersecurity auditing and maintain current knowledge of the evolving threat landscape.