IIA Topical Requirements: Cybersecurity, Third-Party, Organizational Behavior and Resilience

The IIA's International Professional Practices Framework has three layers: the Global Internal Audit Standards, Topical Requirements and Global Guidance. Topical Requirements are the layer that most changes how an engagement is scoped, because they attach to a subject and not to a function. If an engagement's scope touches one of the identified topics, the requirement applies. This post explains the mechanics and lists the requirements the IIA had published as of November 5, 2026, with the dates shown on the IIA's Topical Requirements pages.

What a Topical Requirement is

The Standards describe Topical Requirements as designed to improve the consistency and quality of internal audit services on specific audit subjects and to support internal auditors performing engagements in those risk areas. The mandatory element is stated plainly: internal auditors must conform with the relevant requirements when the scope of an engagement includes one of the identified topics. Global Guidance, by contrast, is nonmandatory information, advice and best practice endorsed by the IIA.

The practical consequence is that the audit plan and the engagement scope memo must identify whether a Topical Requirement is in play. A disbursements audit that includes vendor onboarding and third-party due diligence brings the third-party requirement into scope. An IT general controls review with a cybersecurity component brings in the cybersecurity requirement.

The published requirements and dates

The IIA's Topical Requirements pages list these items with issue and effective dates. Each requirement becomes effective 12 months after it is issued.

The Standards state that conformance is required whenever an engagement's scope includes an identified topic. The IIA's Topical Requirements page lists Anti-Corruption and Talent Management as in development, so compare the IIA list with each engagement's scope at planning.

How to scope with them

Use a short decision step in the planning memo, tied to Standard 13.2 (engagement risk assessment) and Standard 13.3 (objectives and scope).

1. List the topics in the scope.
2. Compare to the list of Topical Requirements.
3. If one applies, attach the requirement's checklist or conformance evidence to the work program (Standard 13.6) and note which work program steps respond to it.
4. If none applies, record that conclusion. A one-line note is enough.

Standard 13.2 requires auditors to gather information about applicable frameworks, guidance and other criteria that can be used to evaluate the effectiveness of the processes under review, and Standard 13.4 requires them to identify the most relevant criteria. A Topical Requirement belongs in that search, and unlike most criteria it carries a conformance obligation.

Worked example: third-party risk in a procurement engagement

In this hypothetical, a manufacturer's annual plan includes a procurement review. During planning under Standard 13.2, the team learns that the company relies on a third-party logistics provider for warehousing and on a cloud payroll processor. The scope includes onboarding, ongoing monitoring and termination of such providers. Because the scope includes third-party management, the team:

• Records in the scope memo that the Third-Party Topical Requirement applies, because the engagement began after its September 15, 2026 effective date.
• Maps each requirement in the Third-Party Topical Requirement to a work program step, using the IIA's user guide.
• Retains evidence of conformance in the workpapers (Standard 14.6).
• States in the final communication (Standard 15.1) that the engagement was conducted in conformance, or discloses nonconformance, the reason and its effect.

That last point follows from Standard 15.1: if the engagement was not conducted in conformance with the Standards, the report must disclose which standards were not met, the reasons and the effect on findings and conclusions.

Linking to ICFR work

For SEC registrants, third-party and cybersecurity topics also surface in ICFR. The SEC's interpretive guidance for management lists areas of IT general controls that may be relevant to the evaluation of ICFR (program development, program changes, computer operations, and access to programs and data), and says management needs to evaluate only those IT general controls necessary for the proper and consistent operation of other controls that address financial reporting risks. An internal audit engagement on cybersecurity may therefore have a different scope from the IT general controls testing that supports management's ICFR assessment. Keep the two scopes distinct so evidence is not claimed for the wrong purpose. See /us/blog/cybersecurity-governance-nist-csf-2-0-for-internal-audit-scoping and /us/blog/third-party-and-service-organization-risk-in-icfr-and-internal-audit.

Who this affects

Chief audit executives, co-source providers and any CPA firm that states in an engagement letter that its internal audit work follows the IIA Standards. If the letter says that, treat the Topical Requirements as applying to in-scope subjects.

Mistakes to avoid

• Reading the requirement list once and never updating the plan.
• Treating a Topical Requirement as optional guidance.
• Listing the requirement in the plan but not mapping it to work program steps.
• Omitting the conformance statement in the final communication.

For the Standards that govern the work program and the report, see /us/blog/engagement-risk-assessment-and-scoping-standards-13-2-and-13-3.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• The IIA, Global Internal Audit Standards (2024), About the IPPF; Standards 13.2, 13.3, 13.4, 13.6, 14.6, 15.1: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
• The IIA, IPPF and Global Internal Audit Standards documents (Topical Requirements list with issue and effective dates): https://www.theiia.org/en/standards/documents/
• The IIA, Topical Requirements: https://www.theiia.org/en/standards/topical-requirements/
• The IIA, Cybersecurity Topical Requirement and Third-Party Topical Requirement pages: https://www.theiia.org/en/standards/2024-standards/topical-requirements/cybersecurity/ and https://www.theiia.org/en/standards/2024-standards/topical-requirements/third-party/
• SEC, Release No. 33-8810, Section II.A.1.d (role of information technology general controls): https://www.sec.gov/rules/interp/2007/33-8810.pdf

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error