# Risk in Focus 2026: Three Trends Auditors Can't Ignore

An episode of [All Things Internal Audit](https://invisiblenetwork.ai/podcast/1758983201), 16 Dec 2025, 21 min.

Audio: https://traffic.libsyn.com/secure/1984d534-f92f-4772-a722-6ac47400e67e/ATIA_-_Risk_in_Focus_MP3.mp3?dest-id=3677289

The Institute of Internal Auditors Presents: All Things Internal Audit Deborah Poulalion and Brian Tremblay unpack the top three risks from the 2026 Risk in Focus report: geopolitical uncertainty, digital disruption, and cybersecurity. They discuss why these risks are rising, how internal audit can approach "hard-to-audit" areas, and how to use Risk in Focus to drive stronger conversations with leadership. For a global perspective, read insights from audit leaders in the article 'Risk Around the World.' HOST: Deborah Poulalion Senior Manager, Research & Insights, The IIA GUEST: Brian Tremblay, CIA, CISA Vice President of Internal Audit, V2X Member, Internal Audit Foundation, Committee of Research and Education Advisors KEY POINTS: • Introduction \[00:00–00:00:32\] • The Foundation's Research \[00:00:32–00:01:32\] • Using the North American Report & Board Briefing \[00:01:32–00:02:29\] • Geopolitical and Macroeconomic Uncertainty \[00:02:29–00:07:01\] • Digital Disruption and AI Risk \[00:07:01–00:12:13\] • Cybersecurity: Still the Top Risk \[00:12:13–00:18:03\] • Final Takeaways: Going Deeper on Complex Risks \[00:18:03–00:19:41\] • Closing Thoughts and Where to Access Risk in Focus \[00:19:41–00:20:12\] IIA RELATED CONTENT: Interested in this topic? Visit the links below for more resources: • Risk in Focus 2026 • 'Risk Around the World' — Internal Auditor Magazine (December Issue) • 2026 Fraud Unmasked Virtual Conference • All Things Internal Audit: Navigating Sustainability Regulations • Global Perspectives & Insights: Sustainability • Tool: Assessing Sustainability Readiness Visit The IIA's website or YouTube channel for related topics and more. Follow All Things Internal Audit: Apple Podcasts Spotify Libsyn Deezer

## Transcript

[0:00] (instrumental music) The Institute of Internal Auditors
[0:03] presents All Things Internal Audit.
[0:06] In this episode, Deborah Pouillon and Bryan Tremblay unpack the
[0:10] top three risks from the 2026 North American Risk in
[0:14] Focus report, geopolitical uncertainty, digital
[0:17] disruption, and cyber security. They discuss why these risks are
[0:21] rising, how internal audit can approach hard-to-audit
[0:24] areas, and how to use risk in focus to drive stronger
[0:28] conversations with leadership.
[0:32] Bryan, it is great to be with you today to talk about the project that we've been
[0:36] working on together, uh, for many months.
[0:39] Uh, so tell me about, um, your involvement as a
[0:43] part of the research committee for the Internal Audit
[0:46] Foundation.
[0:47] Yeah, Deborah. When you reached out to me to
[0:51] participate in this, I, quite frankly, was
[0:54] ecstatic to, because this is one of the
[0:58] projects that I was involved in contributing
[1:01] to or contributing on as part of
[1:05] CREA, the Committee of Research and Education Advisors that I've sat on for many,
[1:09] many years. This team of dedicated professionals
[1:12] volunteers their time to help solicit ideas for
[1:16] research, review research, and ultimately contribute even
[1:20] after the research is out to providing context to that
[1:24] research. So when you invited me, I just, I had to say yes, and
[1:28] I had to say yes fast so you didn't go somewhere else.
[1:30] (laughs) Well, I am so glad you're talking with me
[1:34] today. The Internal Audit Foundation is proud to be
[1:38] producing Risk in Focus again this year for the third year in a row
[1:42] globally, and we appreciate your input and the committee
[1:46] members in North America and around the world.
[1:48] So, let's get started on a great conversation.
[1:52] As we get started, if you happen to be at a place where you can go
[1:56] ahead and download it now, you can follow along with our
[2:00] graphs and charts in the board briefing.
[2:03] So you would go to the iia.org/riskinfocus,
[2:06] click on the beautiful button for North America, and just go
[2:10] ahead and download the report and then the board briefing as
[2:14] well. And just a little plug for the board briefing.
[2:17] So this is actually set up like a PowerPoint presentation so that
[2:21] you can use it with your audit committee or your team or anybody else
[2:25] that you wanna have a good conversation with about risk.
[2:29] So my job today is the data, and Bryan's
[2:32] job is to tell us how this applies to internal
[2:36] auditors. So, let's get started with the topic
[2:40] of the year, geopolitical and macroeconomic
[2:44] uncertainty. So one of the key results in North
[2:48] America was that there was a significant increase in this risk level
[2:51] compared to the prior year. If you're following along in the board
[2:55] briefing, this is on slide eight. So the increase was
[2:59] 19 percentage points over the prior year.
[3:03] And to put that in perspective, no other region had a jump in risk
[3:07] that big. 45% of respondents in North
[3:10] America said that geopolitical uncertainty was a top
[3:14] five risk for them back in May.
[3:17] So, the other per- part of this to consider
[3:22] is that while CAEs said it was one of the highest risks,
[3:26] they rarely said it was one of the five areas where they spend the most time and
[3:30] effort. So that could be completely appropriate,
[3:34] because you may not be able to spend all your time and effort in this
[3:38] area. But we wanna talk about how you do address
[3:41] this risk. So Bryan, what is your perspective?
[3:46] So something like this can many times feel very out
[3:50] there, difficult to audit, along the lines of something
[3:54] like, "How do you audit corporate culture?" But I think there's two things that
[3:57] jump to mind for me as it relates to how internal audit
[4:00] can integrate this into the work that they do.
[4:04] So one would be is thinking about how the
[4:08] organization itself would respond
[4:11] if there was something that derived from this
[4:15] uncertainty. So if we think about resilience of the business, do we
[4:19] have liquidity in the event of a government
[4:22] shutdown where maybe we're not getting paid for a period of
[4:25] time? How would it impact our supply chain, and how would it
[4:29] impact our competitors? So thinking about on every audit you do
[4:33] if maybe these things are in place or there's an
[4:37] opportunity to layer in the impacts of geopolitical
[4:41] risk and uncertainty into the review sh- that you're doing.
[4:44] The second place that I would think about would be
[4:48] enterprise risk management. So this is all about risk, and
[4:52] some of our companies have risk management functions formally, so
[4:56] liaising with them very closely to understand what they're doing around this.
[4:59] Or if we don't have the luxury of a risk management function in our
[5:03] company, how can we, as internal audit, help
[5:07] to educate management on what we think might be
[5:10] valuable to do with this topic?
[5:14] And I just wanted to add another piece of information
[5:18] from the survey results. There is a report that g-
[5:22] combines the results worldwide. If you went to our website and
[5:26] downloaded North America, you might wanna go back and go ahead and download the
[5:29] global summary too. Um, there's a report and a board briefing.
[5:33] Survey respondents were different from, in different
[5:37] regions for the amount of risk for geopolitical
[5:40] uncertainty. So Europe, Latin America, and North America were
[5:44] almost exactly the same, 45% said that was a top
[5:48] five risk for them, but we saw much lower in
[5:52] Africa and Middle East in May. So they were under
[5:55] 30% saying it was a top five risk. Asia-Pacific was a little
[5:59] higher. And so my takeaway as a person who does a lot of
[6:03] surveys for the IIA is
[6:06] that...Things change, right? I know what people
[6:10] said in May, but at this point, this is a rapidly changing area,
[6:14] and that anticipation and response is probably
[6:17] key. What do you think of that, Brian?
[6:20] I do think that there is an opportunity here for internal audits to just
[6:24] help their organizations prepare
[6:27] for uncertainty, like we were talking about
[6:30] before. Just thinking about what they have
[6:34] in place to
[6:37] help to mitigate any risk that maybe is
[6:40] unknown at the moment that could really disrupt the
[6:44] business. So that same would apply for
[6:48] really any of these very big general, almost unauditable
[6:52] risks. It's just thinking about if they were to happen, how
[6:56] would my organization address it?
[6:58] And if we don't think there's a sufficient response in our view,
[7:02] uh, as the internal audit team and department, then our job is to
[7:06] raise that to the leadership team and the board if
[7:09] necessary.
[7:11] Very good points. So going to digital disruption, g- if
[7:14] you're, uh, in your board briefing, you can look at slide eight
[7:18] again. Um, so risk has been steadily
[7:22] rising for this area. In- in the survey, it's described
[7:25] as digital disruption, including AI.
[7:29] So it's up five percentage points, which means, uh, a little
[7:33] more than half of CAEs said it was one of the five highest
[7:36] risks for their organizations. So looking at
[7:40] slide 13, if you're following along, audit
[7:44] priority is also increasing, and that is at a
[7:48] bit faster rate than, uh, the risk.
[7:51] Uh, 11 percentage points up to 44% of people
[7:54] saying it's the area, one of the five areas where they spend the
[7:58] most time and effort. So Brian, what are the best
[8:02] approaches for internal audit to address the risks of
[8:06] new technology in general, including
[8:09] AI?
[8:10] I think one of the grounding things for me
[8:14] around technology in general is that
[8:18] as fascinating and impactful
[8:21] as topics like AI
[8:24] are, at the end of the day, technology is built
[8:28] on lines of code. And if you think back to some of the very
[8:32] simple things that we have had for a long time around
[8:36] technology audits,
[8:38] a lot of them really come back to the
[8:41] basics of access to that technology,
[8:46] access to the interior of that technology, the
[8:50] changes that are made to that technology.
[8:53] Understanding all of those doesn't change no matter what the
[8:56] technology is and, and what the technology does.
[9:00] What does change
[9:02] maybe a bit more would be really taking the
[9:06] time to understanding how that technology
[9:09] works. And I can say that coming from a place
[9:13] having spent some time at a cybersecurity software
[9:16] company, where I was able to sit down with the folks that were
[9:20] building technology,
[9:23] packaging that technology, ultimately selling that technology.
[9:27] What it may require us to do is just really get a much deeper
[9:31] understanding of those technologies that are out there in the market
[9:35] and that our companies are using. I think that's what's become
[9:39] a lot more paramount in my eyes as it relates to digital
[9:43] disruption
[9:45] and artificial intelligence. Now, I wanna just
[9:49] jump back to what we were talking about around the
[9:52] geopolitical uncertainty, not to talk about geopolitical uncertainty, but I do
[9:56] feel like there is a lot of uncertainty in the profession around the
[10:00] volume and the velocity of these technologies.
[10:03] Again, as, as internal auditors, I think part of
[10:07] our job needs to be to flag that our organizations need
[10:11] to be vigilant in understanding the risks and the opportunities
[10:15] that come with these technologies, and that we shouldn't be just licensing
[10:19] software because it's new and novel and it's gonna make a difference.
[10:22] A lot of companies
[10:24] fall flat in their technology usage because they don't really take
[10:28] the time to understand it. So I would make sure that that is
[10:32] something that we are doing in our job.
[10:35] That's not to say that there's not a ton of opportunities and use cases in our
[10:38] organizations for technologies, especially artificial
[10:42] intelligence. We just can't get away from that topic these days.
[10:45] And really, there's the organization's usage of these
[10:49] technologies, and then there's internal audits usage, because what's happening more
[10:53] and more is a lot of purpose-built technologies for the
[10:57] business or for the consumer have made their way into internal audits
[11:01] usage as well. So I think it's helping not only the
[11:04] business understand the risks and opportunities that come with technology, but also
[11:08] really thinking about the risks and the opportunities
[11:11] that come with internal audit using those technologies
[11:15] as well. I think about one example
[11:19] that the standards cover, which is in a
[11:23] very simple basic blocking and tackling audit management system, we
[11:27] store payroll data, board minutes, a lot of information, and have
[11:31] we really thought about what that means for our department?
[11:33] And if you think about the data and information that are being stored in
[11:37] large language models and other databases and
[11:41] systems and tools that we're using, we just need to think about that.
[11:44] Which brings me to, I think one of my more critical attributes, I know
[11:48] we'll be talking about it shortly, which is if
[11:51] it's technology, it's subject to technology
[11:55] risk and the buzzword that we created years ago called
[11:58] cybersecurity. Given that it's just lines of
[12:01] code, code is not designed perfectly and it creates
[12:05] risks not only to our internal stakeholders and ourselves, but also
[12:09] our customers to the extent that they use our software.
[12:12] Thank you. That's a very good point and also reminds
[12:16] me, um, that in the Risk in Focus reports, we
[12:20] have a lot of discussion about... From our round tables conducted
[12:24] for this research about how organizations are
[12:28] encountering, um, new risks from AI and,
[12:32] and trying to use AI for, uh, organizational
[12:36] opportunities and using AI for internal audit.
[12:40] So start the conversation with this podcast and download the
[12:43] re- report to hear from more internal auditors.
[12:47] So we've hinted at coming back to the
[12:51] issue that has been at the top of the risk
[12:55] levels for several years running, and that is
[12:59] cybersecurity. In North America, it is the
[13:03] highest rated risk by far, and just,
[13:07] uh, hinting again, globally that's not always the case.
[13:10] And I also want to mention that different industries, uh, it can
[13:14] be different levels. Manufacturing does not usually rate cyber risk as
[13:18] high as financial services, for example.
[13:21] Having said that, in North America, 86% of
[13:24] CAEs said cybersecurity was one of the top five risks at their
[13:28] organizations. That's consensus, folks.
[13:32] 78% said it's one of the t- five areas where they spend the
[13:35] most time and effort. Putting that in perspective,
[13:39] we talked about digital disruption increasing, but it's still only
[13:43] 50% say it's one of the five highest risks at their
[13:46] organization. So while, uh, we may spend a lot
[13:50] of time talking about AI, cybersecurity is always,
[13:54] uh, lurking in the background. So I wanted to get your
[13:58] perspective, Brian, on how AI and
[14:02] new technology in general is i- impacting cybersecurity
[14:05] and what internal audit needs to do to stay vigilant and,
[14:09] um, have the skills, uh, to address this
[14:13] issue.
[14:14] One of the things that's always surprised
[14:18] me is that for a couple years now,
[14:22] like you indicated, it's been top risk or close to
[14:25] it in and outside of the IIA's surveys.
[14:29] You pretty much ask any leader what one of their top risks are, and
[14:32] cybersecurity's there. But it feels like it's taken a little bit of a
[14:36] backseat to artificial intelligence and some of the other
[14:39] areas. And at the end of the day,
[14:43] like I alluded to, all of these technologies
[14:47] bring technology risk, also known as cybersecurity,
[14:51] with them. So when we're thinking
[14:55] about or when I'm thinking about how
[14:59] we handle this and what the impacts are, I
[15:03] think about a couple of things. AI and other disruptive
[15:07] technologies strengthen both sides of the cybersecurity coin.
[15:11] They give us better defenses. They also give our threat
[15:14] actors better attack vectors. There was something recently in the
[15:18] news that the first AI native
[15:22] cyberattack happened recently. That's not
[15:25] some coder coding something and
[15:29] then auto breaching a system through a known
[15:33] vulnerability. It's something generated by artificial
[15:37] intelligence that, on its own,
[15:41] figured out a way to go through and penetrate into a vulnerable
[15:45] system. I mention that because in both
[15:49] cases, whether it's hands-on keyboard or not, the way they got through
[15:53] was a vulnerability, which is very simply a software
[15:57] bug, which in most cases is easily patched or
[16:00] remediated if known. So putting those zero days
[16:04] on, on the side, I would say there's a
[16:08] couple of things, probably not surprising based on some of my other
[16:11] comments, that are really imperative here.
[16:14] It's making sure that your basic blocking and tackling
[16:18] software controls, IT general controls are in place, including patch and
[16:21] vulnerability management. It's accepting that there's
[16:25] no perfect solution to cyber risk and ensuring that
[16:29] both within your organizations and within the third parties,
[16:33] maybe even fourth parties or beyond that your organization
[16:37] directly or indirectly works with, that they have the right, as
[16:41] well as we have the right, processes and controls
[16:44] to respond to an incident. If you look at so
[16:48] much of what's out there today as it relates to
[16:52] outages, incidents,
[16:54] they're generally tied to organizations that we rely on,
[16:58] not the organizations that we work at.
[17:02] Maybe one other last thought around this topic is I was really
[17:06] surprised that I think it was 75 or almost
[17:10] 80% of folks sa- they spent a lot of time on
[17:14] this topic, and I'm a bit skeptical that that's
[17:18] what's happening out in the wild based on the CAEs that I talk
[17:22] to. Maybe beyond doing a
[17:25] cybersecurity readiness assessment through a standard like
[17:29] NIST or maybe some other governance framework, I really
[17:33] do feel like we can spend a lot more time, like
[17:37] I suggested, around the technology section we just spoke
[17:41] about. This is another area where I think we need to go a little bit
[17:44] deeper than an assessment. We need to understand technology and technology
[17:48] risk. We need to understand the mechanics of how our IT
[17:52] teams and our third parties
[17:55] actually think about,
[17:58] identify, monitor, and mitigate this
[18:02] risk.
[18:03] Brian, I just want to say thank you for sharing your knowledge and
[18:07] experience on these three topics, uh, that were raised
[18:11] from Risk in Focus North America. And one thing that really stood out to
[18:14] me is, um, you talked about going
[18:18] deeper and getting a better understanding of the
[18:22] technical side of these technology areas that
[18:25] internal audit needs to review. Do you want to make any final
[18:29] comments for people to remember?
[18:32] Really, the theme is to do any of these
[18:36] topics justice, you have to spend more time with them than, than
[18:40] maybe you're thinking you need to spend with them.
[18:42] This isn't a standard, maybe more blocking and
[18:45] tackling type engagement that you may go execute,
[18:49] or a topic that every
[18:52] company deals with in a similar
[18:55] manner. These are topics that really deserve a bit
[18:59] of a deeper dive or some expertise, either on your
[19:03] teams or leveraging folks in your organization, or third
[19:06] parties or whoever you get
[19:10] specific information on these topics from in your organization, but
[19:14] it's really... I don't think skimming the surface is gonna cut it in
[19:18] general, but specifically in these topics.
[19:20] You just have to commit to digging deeper and really understanding it more than
[19:24] maybe historically the profession has.
[19:26] To go along with that, it sounds to me like, um,
[19:30] with that knowledge, thinking very strategically about the
[19:34] impacts on the organization as, as a whole,
[19:38] um, which you talked about earlier.
[19:41] Yeah. Definitely.
[19:42] Well, I want to encourage everyone again, and they, uh, to go
[19:46] to, uh, the
[19:47] iia.org/riskinfocus. Pick your
[19:50] favorite reports, um, use them to start a
[19:54] conversation with your stakeholders, keep following The Internal Audit
[19:58] Foundation for more, uh, good-quality research about our
[20:02] profession. Bryan, it has been a pleasure talking with you
[20:06] today.
[20:07] I really enjoyed doing this, and I appreciate you having me.
[20:11] (instrumental music)
[20:12] Fraud is getting trickier, but you can stay ahead.
[20:15] Join us online for the 2026 Fraud Unmasked Virtual
[20:19] Conference on February 17th. It's one packed day of
[20:23] practical tips, expert insights, and 13-plus
[20:26] CPEs. So save your spot today and register at the
[20:29] iia.org. If you liked this
[20:33] podcast, please subscribe and rate us.
[20:35] You can subscribe wherever you get your podcasts.
[20:38] You can also catch other episodes on YouTube or at the
[20:41] iia.org. That's
[20:43] T-H-E-I-I-A.O-R-G.
[20:48] (instrumental music)

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.