Internal Audit Focus Areas for 2026
Organisations continue to face heightened regulatory oversight, rapid technological change, and growing expectations around governance, risk management, and operational resilience. Internal Audit plays a critical role in providing assurance that risk and control frameworks are effective and aligned to strategic objectives. The IIA Global Internal Audit Standards (GIAS) raise the bar on risk-based planning, technology assurance, culture and conduct, and evidence-led auditing. Internal Audit functions should embed these requirements while staying sharply focused on their organisation's key risk drivers.
The Australian landscape is shifting with Privacy Act reforms, CPS 230 implementation for APRA-regulated entities, SOCI obligations, and emerging AI governance requirements. As a result, Internal Audit plans must be strategic, forward-looking, and anchored in the organisation's risk profile. The themes below highlight key focus areas for 2026, with practical considerations to help Internal Audit deliver high-impact, valued assurance.
Technology & Cyber Risk
Cyber Security, AI, Data Governance & Privacy
Cyber threats are becoming more sophisticated, with reliance on digital platforms, cloud services, and automated decision making. Internal Audit should focus on data governance, ensuring that risk management practices remain effective and that data is safeguarded and used appropriately.
Potential audit objectives:
- Assess data governance structures and responsibilities.
- Test operating effectiveness of key controls related to personal and sensitive data.
- Review cloud and system configurations for misconfigurations or inherited vulnerabilities.
- Evaluate privacy controls such as consent management and breach response metrics.
- Assess lessons learned and remediation actions following incidents or simulations used for internal and external reporting.
Regulatory Expectations & Change
Regulators are increasing scrutiny on how obligations are interpreted and embedded across organisations. Internal Audit should direct assurance efforts to confirm that regulatory changes are understood and effectively implemented.
Potential audit objectives:
- Assess process for horizon scanning.
- Evaluate impact assessments.
- Review implementation changes across business areas.
- Assess governance and reporting frameworks.
Operational Risk & Resilience
Business Resilience & Supply Chain Risk
Disruptions driven by technology and complex supply chains necessitate robust resilience and continuity planning. Internal Audit plays a key role in evaluating these capabilities and ensuring that arrangements are designed for incidents and continuity.
Potential audit objectives:
- Assess risk management policies and responsibilities.
- Evaluate critical service identification and impact tolerances.
- Assess alignment between business continuity and disaster recovery practices.
- Review continuity testing programs for effectiveness.
Strategic Transformations & ESG
Large transformation programs and operating model initiatives carry significant delivery risks that need effective management and governance. Internal Audit should ensure that risk management processes are robust and integrated with strategic planning.
Potential audit objectives:
- Assess program governance and oversight mechanisms.
- Evaluate business readiness for new systems or operating models.
- Review design and implementation of sustainable practices.
Our Team
Katherina S - Director
Katherina is a risk and assurance professional with expertise in internal audit and risk management functions across organisations.
Jayasri - Manager
Jayasri has experience supporting assurance plans in both internal and external audits across technology, public and private sectors.