Cybersecurity has become one of the most pressing risks facing organisations today, and internal auditors are expected to provide consistent, reliable assurance in this area. To strengthen this role, the Institute of Internal Auditors (IIA) has introduced a new Topical Requirement on Cybersecurity as part of its International Professional Practices Framework. Designed to be read alongside the Global Internal Audit Standards, this requirement establishes a clear baseline for what every cybersecurity audit must cover—ensuring that governance, risk management, and control processes are all examined with equal rigor.

 

It is built on three simple questions:

1. Is the board overseeing cyber risk (governance)?
2. Are cyber threats being identified, escalated and responded to (risk management)?

• Are day-to-day defences such as access controls, encryption, patching and network security actually working (control processes)?

This blog marks the first installment in a two‑part series dedicated to decoding the IIA’s Cybersecurity Topical Requirement for internal audit. Part 1 provides a detailed explanation of the concept and its place within the Global Internal Audit Standards, while Part 2 will build on this foundation by exploring its practical application in audit engagements.

 

 

1. Where Topical Requirements Fit in the Global Internal Audit Standards

Topical Requirements are a new part of the IIA’s framework, sitting alongside the Global Internal Audit Standards and Global Guidance. Think of it as a minimum checklist for auditing a risk that almost every organisation faces, so that whichever team audits the topic, the work meets the same basic standard.

Topical Requirements do not replace the Standards; they are always used together with them. They also do not list everything an auditor could test. They set the floor, not the ceiling.

How strictly the requirement must be followed depends on the type of work:

• Assurance engagements: Following the Topical Requirement is mandatory.
• Advisory engagements: Following it is recommended, as a good-practice benchmark.

Every Topical Requirement is built around the same three parts: governance, risk management and control processes. These three parts match the IIA’s Three Lines Model:

Component	Three Lines Model	Who does what
Governance	Board / governing body	Oversees cybersecurity and makes sure it supports the organisation’s strategy.
Risk Management	Second line (management)	Identifies, analyses and monitors cyber threats.
Control Processes	First line (management)	Runs the day-to-day controls that reduce cyber risk.
Internal Audit	Third line	Gives independent assurance to the board on all of the above.

In practice, this means a cybersecurity audit should look at the whole chain, from what the board is told down to how controls work on the ground, and not just at technical settings.

 

2. Core Concepts: What Cybersecurity Covers

Cybersecurity is no longer only an IT issue. Online orders, vendor payments, payroll and customer portals all run on technology, so internal auditors need to keep cyber risk in mind in every audit, not only those labelled “IT”.

The Topical Requirement borrows its definitions from the US National Institute of Standards and Technology (NIST):

• Information security means protecting all information and information systems from being accessed, used, disclosed, disrupted, changed or destroyed without authorisation, so that information stays confidential, accurate and available.
• Cybersecurity means protecting the organisation’s use of the internet and connected systems from cyber attacks.

Put simply, cybersecurity is one part of information security. It focuses on the organisation’s outer boundary: keeping hackers, malware and other unauthorised users out.

The requirement contains 17 individual requirements grouped under three pillars:

Pillar	Key question	No. of requirements
Governance	Is there a clear cybersecurity strategy, with objectives, policies and procedures that support the business, and is the board overseeing it?	4
Risk Management	Are cyber threats found, assessed, managed and tracked across the organisation, and are serious ones escalated quickly?	6
Control Processes	Has management put controls in place to reduce cyber risk, and are they checked regularly to see that they work?	7

These requirements are only the minimum. If an organisation rates its cyber risk as very high, the Chief Audit Executive (CAE) should consider testing more than the baseline.

 

3. When Does the Requirement Apply?

The CAE is responsible for making sure the requirement is followed. This starts with the annual audit plan and carries on into the planning of each audit. The requirement applies in three situations:

1. It is in the audit plan: Cybersecurity is picked up during annual planning, and one or more cyber audits are included in the plan.
2. It comes up during another audit: For example, while auditing accounts payable, the team finds that purchase orders are submitted through a web portal with cyber risks. The team must then check, during the audit itself, which requirements apply.
3. Someone asks for it: The board, management or a regulator asks for a cyber review that was not in the plan, often after a cyber incident.

 

 

4. Three Principles That Run Through the Requirement

Consider everything, justify every exclusion. Auditors must consider every one of the 17 requirements. A requirement may be left out, for example because the risk is low or the area is covered in another audit this cycle, but the reason must be written down. This record can sit in either the audit plan or the audit workpapers, and the requirements can be spread across more than one audit.

Outsourcing the work does not outsource the responsibility. If the audit team lacks the technical skills, the CAE may bring in specialists, but the CAE still answers for the result. If the team does not have enough resources, the CAE must tell the board what the impact is and how the gap will be filled.

Build on what already exists. Many organisations manage cybersecurity using frameworks such as the NIST Cybersecurity Framework or COBIT, and internal audit may already have audit programmes built on them. There is no need to start again; the existing programme only needs to be checked against the Topical Requirement so that nothing is missed.

Conformance will also be checked in quality assessments, so this is not optional paperwork.

 

In conclusion, the IIA’s Cybersecurity Topical Requirement represents a significant step in ensuring that internal audit consistently addresses one of the most critical risks facing organisations today. By setting a clear baseline across governance, risk management, and control processes, it helps auditors provide assurance that is both comprehensive and aligned with global standards.

This first part of the series has focused on explaining the concept and structure of the requirement; in Part 2, we will move into its practical application, showing how internal auditors can embed these principles into their audit planning and execution.

 

This concludes Part 1 of our two-part series. In Part 2, we’ll discuss the six step approach, what to review under each pillar, mapping to the NIST and COBIT standardand a ready to use checklist for all the 17 requirements. See you all next week!

 

About the Author

Apoorv Mathur is a seasoned Risk Consulting and Business Advisory professional with years of experience in Internal Audit, Enterprise Risk Management, Corporate Governance, and Compliance Advisory. He is a Partner at AMP & Co., Chartered Accountants, and Promoter of Compezz Solutions Pvt. Ltd., a RegTech company specialising in compliance automation.

He currently serves on the Board of Governors of IIA Delhi Branch and is the President of IIA Jaipur Audit Club.

 

Source: The Institute of Internal Auditors, Cybersecurity Topical Requirement User Guide (2025).