Our summary
Topical Requirements are a mandatory part of The IIA’s International Professional Practices Framework (IPPF). They sit next to the Global Internal Audit Standards. Each one sets a minimum baseline and criteria for reviewing governance, risk management and controls in one specific risk area, called a “topic”. The aim is more consistent and complete audit work on these subjects. For assurance work, auditors must apply a Topical Requirement when their risk assessment shows the topic is in scope, and they do this in line with the Global Internal Audit Standards. For advisory work, using them is recommended but not required.
Four have been issued so far, each with its own effective date: Cybersecurity (5 February 2026), Third-Party (15 September 2026), Organizational Behavior (15 December 2026) and Organizational Resilience (30 April 2027). In general, a Topical Requirement takes effect 12 months after it is issued. The IIA also lists Anti-Corruption (planned for Q4 2026) and Talent Management (public consultation planned for January 2027) as upcoming. Each issued requirement comes with a supplemental User Guide, and there is general Application Guidance on topics such as limitations, critical risk thresholds, exclusions and using several requirements together. The page is for chief audit executives, audit teams and quality reviewers.
How auditors use it: Check this page to see which Topical Requirements exist and when each becomes effective. Map them to your risk-based audit plan, decide where each one applies, and record the reasons for any exclusions so you can show conformance in quality assessments.