Since its first publication in 2017 as “10 Hot Topics for the Internal Audit Plan”, Risk in Focus has grown into a pan-European benchmark for understanding the top risks organisations face, providing valuable insights for Chief Audit Executives (CAEs), audit committees and boards.

Over the past decade, the project has:

• Expanded from 3 to 20 participating countries at its peak
• Collected more than 5,600 completed surveys from CAEs
• Conducted over 100 in-depth interviews with audit leaders and industry experts
• Introduced roundtables to capture richer perspectives and exchange best practices

Key milestones include:

• 2019: Cybersecurity becomes the top-ranked risk for the first time
• 2020–2021: COVID-19 reshapes risk priorities and accelerates digital transformation
• 2023–2024: A “poly-crisis” of geopolitical conflict, supply chain shocks, inflation and AI disruption dominates the landscape
• 2026: The report involves 879 CAEs, 10 interviews and 5 roundtables, confirming cybersecurity as the leading risk while highlighting growing challenges in AI, human capital, and geopolitical uncertainty

Over ten years, Risk in Focus has become much more than a survey: it is now a strategic tool for internal auditors, boards and governance professionals to align audit priorities with an increasingly complex risk environment.

Download the 10 Year Anniversary report:

The post Celebrating 10 Years of Risk in Focus appeared first on ECIIA.

This concise and visual document offers board members and executive committees a clear summary of the top risks for 2026 and beyond, based on the perspectives of 879 CAEs across 15 countries.

The Board Briefing outlines:

• The top five risks today and how they are expected to evolve by 2029
• The main challenges for organisations in areas such as cybersecurity, digital disruption and AI, geopolitical uncertainty, human capital and sustainability
• Key questions for boards to consider in order to strengthen resilience, align strategies and support informed decision-making

As organisations face persistent uncertainty and rapid technological change, this briefing is a practical resource to help board members and executives focus on the right priorities, engage with internal audit, and reinforce governance effectiveness.

Download the Board Briefing here:

The post Risk in Focus 2026 Board Briefing: a tool for governance appeared first on ECIIA.

Key findings

Cybersecurity and data security remain the top organisational risk. 82% of CAEs rated it their most important threat, and 72% say it is where internal audit currently spends the most time; CAEs also expect it to stay number one in three years. Post-quantum readiness is beginning to feature in audit scopes.

Human capital, diversity, talent management and retention holds second place again in 2026. Yet it ranks lower for internal audit effort today, signalling a gap between perceived risk and audit coverage.

Digital disruption, new technologies and AI rises to third place (up from 4th in 2025). 58% of CAEs expect it to be a top-five focus area for internal audit within three years, second only to cybersecurity.

Macroeconomic and geopolitical uncertainty sits joint 4th with changes in laws and regulations, with CAEs highlighting its knock-on effects across other risk categories (trade, compliance, cyber, AI).

Climate change, biodiversity and environmental sustainability falls to 10th in this year’s ranking. Only 24% of CAEs expect it to be a top-five area of audit focus by 2029 (down from 40% last year), reflecting policy and regulatory uncertainty despite worsening climate impacts.

Across the survey, the top four risks beneath cybersecurity are now tightly clustered (≈45–48%), underlining how interconnected they’ve become and why boards need agile assurance and advice.

Download the full report:

More to explore

In addition to the full Risk in Focus 2026 report, two companion documents are now available to support governance bodies and celebrate this milestone year:

Risk in Focus 2026 – Board Briefing

A concise and visual summary designed for boards and executive committees, highlighting the top risks and providing key questions to strengthen resilience and decision-making:

Risk in Focus – 10 Year Anniversary Report

A retrospective look at a decade of Risk in Focus, tracing how the risk landscape has evolved since 2017 and how internal audit has adapted to shifting priorities:

The post Risk in Focus 2026: Hot topics for internal auditors appeared first on ECIIA.

In an increasingly complex and data-driven environment, actuaries are playing an increasingly important role in Internal Audit Functions of insurance companies. Their expertise in quantitative methods, data analytics, and core insurance areas brings significant added value to audit activities, from audit risk assessment to audit execution and audit operations.

This new paper highlights how actuaries and internal auditors can mutually enhance their work, combining technical skills with business insight, and how Internal Audit offers actuaries exciting career development opportunities in an interdisciplinary working environment.

The publication also features the personal journeys of five actuaries who transitioned into Internal Audit, sharing their experiences, challenges, and the impact of their work.

The post New ECIIA Paper: The Role of Actuaries in Internal Audit appeared first on ECIIA.

The report covers:
Stronger engagement with EU institutions and global partners
Strategic initiatives on digitalisation, sustainability, and resilience
Highlights from our publications, events, and outreach activities

We invite you to download the report to explore how the ECIIA continues to promote internal audit and good governance across Europe!

You can also explore our dedicated infographic for a quick overview of the 2024 highlights:

The post ECIIA Annual Report 2024 Now Available appeared first on ECIIA.

IIA Spain, in collaboration with the main stakeholders, has released “Internal Control over Sustainability Reporting (ICSR)”—a practical guide highlighting the vital role of internal audit and other important players in the ESG reporting process. The guide provides concrete examples and insights to support organisations in strengthening their internal control frameworks.

Read the full guide here.

The post Strengthening ESG Reporting – A New Guide on Internal Control Over Sustainability Reporting appeared first on ECIIA.

The post Key Updates to the Corporate Sustainability Due Diligence Directive (CSDDD) appeared first on ECIIA.

The post New ECIIA Factsheet: Key Updates on CSRD Changes appeared first on ECIIA.

Here’s a quick overview:

What’s required? Products must be verified as deforestation-free, legally produced, and have a due diligence statement.
What must companies do? Conduct risk assessments, have mitigation plans, and keep records for at least five years.
What happens if you don’t comply? Fines up to 4% of your EU turnover, product confiscation, or trading bans.
For small businesses: If your supplier already follows the rules, you just need to keep their records.

Check out our full factsheet and get ready for a deforestation-free future!

The post New EUDR Deforestation Rules: What You Need To Know appeared first on ECIIA.

Internal auditors have a vital role in helping organisations navigate these regulations. ECIIA’s latest publication, The AI Act: Road to Compliance, offers essential guidance to ensure compliance and manage risks effectively.

This paper covers the key principles, requirements, and responsibilities for organisations under the AI Act, helping internal auditors assess readiness and contribute to compliance strategies.

The press release is available here.

The post Master the AI Act: ECIIA’s Essential Guide for Internal Auditors appeared first on ECIIA.