Every CIA has 40 hours a year to spend on learning, and the question is what to spend them on. For 2026 and 2027 the profession’s own evidence gives an unusually clear answer. The Global Internal Audit Standards, in effect since January 2025, require continuing development rather than just CPE hours. Four Topical Requirements now turn specific subjects into obligations, with more on the way. Chief audit executives rank cybersecurity and digital disruption, including artificial intelligence, as the top risks, and digital disruption and geopolitical uncertainty rose fastest in the latest survey. Data analytics remains the skill leaders say matters most and teams use least. And budgets are tighter than they were, which makes every paid hour count for more.
This guide sets out seven shifts that should shape an internal auditor’s continuing education over the next two years. Each is backed by the evidence behind it: the IIA’s Standards and Topical Requirements, its Risk in Focus and Pulse surveys, its Vision 2035 research, and regulatory developments in sustainability reporting, all checked in September 2026. Each shift then becomes concrete learning choices. It ends with a 40-hour plan for 2026 and 2027 and a reminder of what has not changed. For the mechanics of the requirement itself, see the guide to CIA CPE requirements. For turning priorities into a plan, see the guide to planning your CPE year.
In this guide
- Seven shifts at a glance
- 1. The Standards now require development
- 2. Topical Requirements turn topics into obligations
- 3. AI moves from curiosity to practice
- 4. Cybersecurity stays at the top
- 5. Data analytics: the gap that will not close itself
- 6. Disruption, geopolitics and resilience
- 7. Sustainability assurance, recalibrated
- Tighter budgets, sharper learning
- Credential and CPE rule changes, 2025 to 2027
- The skills the profession expects by 2035
- What the trends mean by role
- Dates to watch in 2026 and 2027
- How to read a trend claim
- A 40-hour plan for 2026 and 2027
- What has not changed
- Questions about what to learn
- Related guides
Seven shifts at a glance
| Shift | The evidence | What to learn |
|---|---|---|
| The Standards require development | Standards 3.1 and 3.2, in effect since 9 January 2025 | A deliberate plan tied to competencies, not a pile of hours |
| Topical Requirements | Cybersecurity and Third-Party in force; Organizational Behavior from 15 December 2026; Organizational Resilience from 30 April 2027 | Each requirement before the engagements it governs |
| AI in audit practice | About four in ten CAEs reported using generative AI in 2025; 83 percent of North American audit leaders expect their AI use to grow | Using AI safely in audit work, and auditing AI |
| Cybersecurity | A top-five risk for 80 percent of CAEs and a top-five audit priority for 75 percent (Risk in Focus 2026/2027) | Cyber program auditing to the Topical Requirement |
| Data analytics | 92 percent of CAEs call it the most important technology skill; 28 percent report high or advanced use | Full-population testing on your own data |
| Disruption and resilience | Digital disruption and geopolitical risk each up 10 points; only 11 percent report full audit coverage of digital disruption | Emerging-risk assessment; resilience auditing |
| Sustainability assurance | EU reporting scope narrowed in 2026; ISSA 5000 effective for periods from 15 December 2026 | Sustainability data controls and limited assurance |
1. The Standards now require development
The IIA released the Global Internal Audit Standards on 9 January 2024, and they took effect on 9 January 2025. Two standards change how CPE should be thought about. Standard 3.1, Competency, makes each internal auditor responsible for continually developing and applying the competencies needed to fulfill their professional responsibilities. Standard 3.2, Continuing Professional Development, requires internal auditors to maintain and continually develop their competencies to improve the effectiveness and quality of internal audit services, and to pursue continuing professional development including education and training.
The shift is from counting to developing. Forty hours of anything meets the IIA’s renewal requirement. The Standards ask a different question: are your competencies keeping pace with your responsibilities? An external quality assessment can now ask how a function’s development links to its work. The IIA supplied the map in June 2025, with an updated Internal Auditing Competency Framework that supersedes the 2022 version. It groups competencies into four categories (internal auditing, professional, governance and risk management, and operational areas) and describes four proficiency levels, from basic to expert. For 2026 and 2027, the practical implication is to rate yourself against the framework once a year and let the gaps choose the depth in your CPE. The GIAS Domain II guide covers Standards 3.1 and 3.2 in context, and the IPPF to GIAS mapping shows what changed from the old framework.
2. Topical Requirements turn topics into obligations
The Topical Requirements are the most concrete driver of learning in this period, because they come with dates. They are mandatory for assurance work: depending on the function’s risk assessment, internal auditors must apply a requirement when providing assurance services on its topic. For advisory work the IIA recommends them but does not require them. Each has so far taken effect one year after it was issued, and the IIA’s pipeline has more to come.
| Topical Requirement | Issued | Effective | Learning it implies |
|---|---|---|---|
| Cybersecurity | 5 February 2025 | 5 February 2026 | Cyber governance, risk management and controls, and how to test them against the requirement |
| Third-Party | 15 September 2025 | 15 September 2026 | The third-party lifecycle, from due diligence to exit, and assurance over outsourced processes |
| Organizational Behavior | 15 December 2025 | 15 December 2026 | Auditing culture, conduct and behavior, including evidence that is not documentary |
| Organizational Resilience | 30 April 2026 | 30 April 2027 | Resilience, continuity and crisis management, and how to assess them |
| Anti-Corruption | To be issued in the fourth quarter of 2026 | To be set on issue | Corruption risk and anti-corruption programs |
| Talent Management | Public consultation planned for January 2027 | Not yet set | People risk and talent processes |
The learning implication is straightforward. If your audit plan includes a covered topic, two to four hours on the requirement before the engagement starts is the minimum. For the requirements already in force, the time is now. The site’s guides to the Topical Requirements, the Cybersecurity requirement and the Third-Party requirement map each one to audit steps, and the guide to auditing corporate culture covers methods relevant to the Organizational Behavior requirement.
3. AI moves from curiosity to practice
Two years ago, artificial intelligence was mostly a subject internal auditors read about. The evidence now shows it moving into practice, faster than the skills to use it well. In the IIA’s 2025 North American Pulse survey, about four in ten chief audit executives said their functions were using generative AI for internal audit activities. The IIA’s announcement of the survey described that as more than doubling in a year, from 15 percent to 40 percent. A survey of 373 senior internal audit leaders in North America by the IIA and AuditBoard, published in February 2026, showed where the use is concentrated.
| Audit activity | Extensive AI use | Occasional AI use |
|---|---|---|
| Audit planning | 35% | 33% |
| Reporting | 35% | 34% |
| Risk assessment | 25% | 39% |
| Fieldwork | 19% | 39% |
The same survey, whose main subject was AI-enabled fraud, shows the skills lagging. Only four in ten leaders believed their functions were adequately prepared to detect or respond to AI-enabled fraud, and asked what held back a stronger response, 57 percent named a lack of appropriate technology or tools and 55 percent insufficient staff with relevant skills or expertise. Yet 83 percent expected their function to increase its AI use over the following year. The learning has two strands, and most auditors need both. The first is using AI in audit work safely: prompting well, validating outputs, protecting confidential information, and documenting AI-assisted work so a reviewer can follow it. The second is auditing AI: governance, model risk, data quality, and the controls over AI in the business. The IIA’s AI Auditing Framework, updated in September 2024, covers the second strand. Its AI-Enabled Internal Audit certificate program (8 CPE, included with North American membership) covers the first. The site’s prompt library for auditors, the guide to auditing AI and algorithms and the overview of AI in internal audit tools are starting points.
4. Cybersecurity stays at the top
Cybersecurity has led chief audit executives’ risk rankings for years, and the IIA Foundation’s Risk in Focus 2026/2027 survey, released on 15 September 2026, shows no change. Among 3,285 chief audit executives and directors in 132 countries, 80 percent ranked cybersecurity a top-five risk, and 75 percent ranked it a top-five audit priority. In the 2025 Pulse survey, 51 percent of chief audit executives named cybersecurity among the competencies they most wanted to improve in their teams. With the Cybersecurity Topical Requirement in force since 5 February 2026, the gap between what is expected and what teams can do is now a conformance issue as well as a skills issue.
For most internal auditors who are not IT specialists, the useful target is not deep technical expertise. It is enough fluency to plan and scope a cyber engagement, test governance and control design against the requirement, read a penetration test or maturity assessment critically, and know when to bring in a specialist. The site’s guides to auditing cybersecurity programs and auditing cyber resilience set out what that looks like in an engagement. For those who want to go further, the CISA guide covers the specialist route.
5. Data analytics: the gap that will not close itself
Analytics is the longest-running skills gap in the profession, and the numbers still show it. In the 2025 Pulse survey, 92 percent of chief audit executives said data analytics was the most important technology skill for the future, yet only 28 percent reported high or advanced levels of analytics use in their functions. Data analysis was also the competency most often named for improvement, by 78 percent. The IIA’s Vision 2035 research, drawing on more than 7,000 practitioners and stakeholders, found that 91 percent considered analytics extremely or very important to the profession’s ideal future.
The lesson of a decade of analytics training is that courses alone do not close the gap. Practice on real data does. The most effective analytics CPE pairs a structured course with an immediate application: full-population tests in accounts payable, payroll or journal entries, run on the function’s own data and written into the audit program. The site’s catalogs of accounts payable tests and journal entry tests are ready-made practice. The analytics skills guide covers where to start.
6. Disruption, geopolitics and resilience
The fastest-moving risks in the latest Risk in Focus survey are not new, but they are rising quickly. Digital disruption, including artificial intelligence, was ranked a top-five risk by 58 percent of respondents, up 10 percentage points. Geopolitical uncertainty was ranked by 48 percent, also up 10 points. Digital disruption also saw the largest rise of any area in audit priority, up 10 points to 42 percent. The report found a governance gap behind it: only 23 percent rated their organization’s risk governance of digital disruption as managed or optimized, and only 11 percent reported full audit coverage.
| Area (Risk in Focus 2026/2027, global) | Share ranking it a top-five risk | Share ranking it a top-five audit priority |
|---|---|---|
| Cybersecurity | 80% | 75% |
| Digital disruption, including AI | 58% (up 10 points) | 42% (up 10 points) |
| Geopolitical uncertainty | 48% (up 10 points) | — |
| Human capital | 38% | — |
| Business resilience | 35% | 44% |
| Financial and liquidity | — | 49% |
| Fraud | — | 46% |
| Governance and corporate reporting | — | 45% |
The table shows the five highest-ranked areas in each column, plus digital disruption’s audit-priority share. A dash means the area was not among the five highest in that column. Two kinds of learning follow. The first is emerging-risk assessment: how to scan for and assess risks that do not yet appear in the risk register, and how to advise on them before assurance is possible. The second is resilience. The Organizational Resilience Topical Requirement takes effect on 30 April 2027, and the IIA’s competency framework places organizational resilience under governance and risk management. The site’s guides to AI and risk assessment and third-party resilience are relevant starting points.
7. Sustainability assurance, recalibrated
Sustainability reporting drew heavy training demand in the early 2020s, as the CSRD and the ISSB standards arrived. In 2025 and 2026 it was recalibrated rather than abandoned. In the European Union, a “stop-the-clock” directive in April 2025 postponed reporting for companies that had not yet started. The Omnibus simplification, Directive (EU) 2026/470, adopted on 24 February 2026, narrowed the scope of the Corporate Sustainability Reporting Directive to companies with more than 1,000 employees and more than €450 million in net turnover. It removed the move to reasonable assurance, and it requires the Commission to adopt limited-assurance standards by 1 July 2027. Internationally, the IAASB’s sustainability assurance standard, ISSA 5000, applies to periods beginning on or after 15 December 2026. And more than 40 jurisdictions had decided to use, or were introducing, the ISSB’s sustainability standards by April 2026.
For internal auditors, the recalibration changes the emphasis of learning more than its need. Fewer EU companies will report, and assurance will stay at the limited level. But where reporting continues, under the EU rules, ISSB-based regimes or voluntary frameworks, sustainability data needs the same controls as financial data, and internal audit is well placed to test them. The learning that stays relevant is data governance and controls over non-financial information, the difference between limited and reasonable assurance, and enough of ISSA 5000 to coordinate with the external assurance provider. The IIA’s ESG certificate program and the site’s ESG auditing guide cover the ground.
Tighter budgets, sharper learning
The final trend is not a subject but a constraint. The IIA’s 2026 North American Pulse, published in March 2026, found internal audit being asked to do more with less. The share of functions reporting budget cuts rose from 11 percent to 19 percent between 2024 and 2025. The share reporting budget increases fell from 34 percent to 23 percent. Staff cuts rose from 11 percent to 18 percent. Training budgets rarely escape those pressures.
The response is to spend deliberately. Take breadth from free and member sources, pay only for depth in a priority skill, and turn every paid course into an in-house session so one purchase trains the team. The IIA’s inclusion of its on-demand library and three certificate programs in North American membership makes that easier than it was. The guides to free CIA CPE and affordable CPE put figures on the options.
Credential and CPE rule changes, 2025 to 2027
The rules around credentials and CPE have also moved. Several changes affect what CIAs and those around them need to learn, or how their learning is counted.
| Change | Date | What it means for learning |
|---|---|---|
| Updated CIA exam (2025 syllabus) | From 28 May 2025 | Candidates study the new structure; the syllabus guide covers it |
| The IAP exam became CIA Part 1 | 28 May 2025 | The IAP is now the entry route for students and candidates without a degree |
| The IAP became a permanent designation | July 2025 | IAP holders renew annually with 20 CPE hours from 2026 |
| CRMA no longer requires the CIA | July 2025 | Risk specialists can earn the CRMA directly |
| Internal Auditing Competency Framework updated | June 2025 | The map for planning development |
| CIA Challenge Exam: experience-based pilot for professionals with 10 or more years’ experience | Applications 1 April to 30 September 2026 | A new route to the one-exam Challenge for long-serving auditors |
| NASBA and AICPA CPE standards, 2026 edition | Phased from 1 August 2026 to 1 November 2028 | Shorter self-study units; certificates state the 50-minute basis |
| ISACA CPE alignment rule | From 1 January 2027 | At least 90 of every 120 ISACA hours must align with the certification’s exam content outline |
For CIAs who also hold an ISACA credential, the last row is the one to plan for now. From 2027, CPE that is relevant to internal audit in general will not be enough to keep a CISA current unless most of it also matches the CISA’s exam content. The guides to the CIA Challenge Exam, the CRMA and IAP vs CIA cover the IIA credential changes.
The skills the profession expects by 2035
For a longer view, the IIA’s Internal Audit: Vision 2035 report, released in July 2024 and based on feedback from more than 7,000 practitioners and stakeholders, is the best single source. Its findings on skills point the same way as the surveys. Ninety-six percent agreed that experienced internal auditors will need to increase their technology skills to remain relevant, and 81 percent that entry-level auditors will need an elevated skill set. Adaptability and learning agility were among the most important skill sets today, cited by 56 percent, and were expected to remain so (48 percent). The research also found that fewer than half of respondents (48 percent) were then involved in AI-related activities.
The finding about learning agility deserves attention in a guide about CPE. The profession’s own forecast is that the most durable skill is the ability to keep learning. The best evidence of it is a record of deliberate development: priorities chosen, skills built and applied. That is the record a planned CPE year produces, and a year of random webinars does not.
What the trends mean by role
The same seven shifts land differently depending on the job. A staff auditor needs hands-on skills. A chief audit executive needs to understand the risks well enough to plan coverage and explain it to the board. The table suggests where each role should put its emphasis.
| Role | Emphasis for 2026 and 2027 | Why |
|---|---|---|
| Staff and senior auditors | Applied analytics; using AI tools safely; the Topical Requirements in engagements they will staff | The hands-on skills with the widest gap between importance and practice |
| Audit managers | Scoping engagements under the Topical Requirements; reviewing AI-assisted work; emerging-risk assessment | Managers set the scope and sign off the work |
| Chief audit executives | Digital disruption and geopolitical risk; coverage planning; the Standards’ governance and development duties; budgeting for skills | Coverage gaps and board conversations sit here |
| IT auditors | The Cybersecurity requirement in depth; auditing AI; ISACA’s 2027 CPE alignment rule if they hold ISACA credentials | Specialists carry the technical load of the top risk |
| Public-sector auditors | Resilience; third-party and outsourcing risk; sector-specific updates | Public bodies depend heavily on outsourced services and continuity |
| Auditors in reporting companies with sustainability obligations | Controls over non-financial data; limited assurance; coordination with the assurance provider | Where reporting continues, the data needs assurance-grade controls |
Dates to watch in 2026 and 2027
Several of the changes above have fixed dates, which makes them easy to plan around. The table lists the ones known in September 2026 that affect what internal auditors need to learn, or how their CPE is counted.
| Date | What happens | Learning implication |
|---|---|---|
| Fourth quarter of 2026 | The IIA plans to issue the Anti-Corruption Topical Requirement | Read it on release; plan training before any related engagement |
| 15 December 2026 | Organizational Behavior Topical Requirement takes effect | Culture and behavior audit methods before 2027 engagements |
| Periods beginning on or after 15 December 2026 | ISSA 5000 applies to sustainability assurance engagements | Basics of the standard, for coordination with assurance providers |
| 1 January 2027 | ISACA’s CPE alignment rule begins | CISA, CISM and CRISC holders plan aligned hours |
| January 2027 | The IIA plans a public consultation on a Talent Management Topical Requirement | Follow it; comment if people risk is in your universe |
| 1 March 2027 | New CPE programs follow the 2026 NASBA and AICPA standards | Shorter self-study units become more common |
| 30 April 2027 | Organizational Resilience Topical Requirement takes effect | Resilience and continuity auditing before the date |
| By 1 July 2027 | The European Commission is to adopt limited-assurance standards for sustainability reporting | For EU reporters: the assurance framework settles |
How to read a trend claim
Internal auditors should read trend claims the way they read any evidence. The surveys behind this guide are good, but they measure different things. Risk in Focus asks chief audit executives and directors worldwide which risks they see as most significant and where audit effort goes. The North American Pulse asks chief audit executives in the United States and Canada about their functions. Vision 2035 gathered practitioners’ and stakeholders’ views of the profession’s future. A figure from one is not interchangeable with a figure from another, and a regional result does not describe the world.
Three checks keep trend reading honest. Who was asked, and how many? When were they asked? The 2026/2027 Risk in Focus fieldwork ran in March to May 2026, the 2026 Pulse in late 2025. And does the claim describe what people think or what they do? “Analytics is important” and “we use analytics” are different findings, and the gap between them is the story. Applying those checks is itself a small exercise in the professional skepticism the Standards require.
A 40-hour plan for 2026 and 2027
The trends above do not all apply to every auditor. The plan below is a starting point for a practicing CIA in a general internal audit function. Adjust the weights to your audit plan: more cyber for a technology-heavy universe, more fraud for a high-risk process portfolio, more sustainability for a reporting company.
| Area | Hours | Why now | Source ideas |
|---|---|---|---|
| Ethics under the Standards | 2 | Required every year; Domain II is still new to many | IIA member ethics course; chapter session |
| Topical Requirements relevant to your plan | 4 to 6 | Two in force, one effective December 2026, one April 2027 | IIA webinars; in-house session using the requirement itself |
| AI: using it and auditing it | 8 | Rapid adoption, with skills lagging behind it | IIA AI-Enabled Internal Audit certificate; AI Auditing Framework |
| Cybersecurity auditing | 6 | Top risk and top audit priority; Topical Requirement in force | IIA or ISACA courses; firm webcasts |
| Data analytics, applied | 8 | The persistent gap between importance and use | A structured course plus tests on your own data |
| Emerging risk and resilience | 4 | Digital disruption and geopolitics rising; resilience requirement due | Chapter sessions; firm webcasts |
| Sector updates, reporting or sustainability | 4 to 6 | Depends on your organization’s obligations | Firm webcasts; the IIA ESG certificate |
| Communication and influence | 4 | The skill that turns findings into change | Workshop; team presentation of what you learned |
| Total | 40 to 44 |
What has not changed
Trends pull attention toward what is new, and a CPE plan should resist being all trend. The craft of internal audit has not changed much. Deciding what matters, gathering sufficient evidence, applying professional skepticism, writing findings that management acts on, and keeping objectivity under pressure are still what separate good auditors from average ones. Several of those skills are behavioral, and the Organizational Behavior Topical Requirement suggests the profession is paying more attention to them, not less. A year that adds AI and cyber fluency but lets report writing and judgment slide is not a better year.
The Pulse figures make the same point from another angle. Communication and collaboration were the second-most-cited competencies chief audit executives wanted to improve, named by 53 percent, second only to data analysis at 78 percent. The site’s guides to soft skills and writing are reminders that the oldest skills are still in demand.
Questions about what to learn
What is the single most important subject for 2026 and 2027?
For most internal auditors, applied technology: using AI safely in audit work and auditing technology risk, with cybersecurity first. It combines the top-ranked risk, the fastest-rising risk and the largest skills gap chief audit executives report. But if your audit plan is dominated by one Topical Requirement, that requirement comes first, because conformance is not optional.
Do I need to become a data scientist?
No. The gap the surveys describe is between knowing analytics matters and using it routinely. For most auditors, closing it means running full-population tests on standard processes, interpreting the results and documenting them to the Standards. That takes structured practice, not a new career.
Is sustainability still worth learning after the EU changes?
Yes, but with a sharper focus. Fewer EU companies will report under the narrowed scope, and assurance stays limited. Where reporting continues, sustainability data needs controls and assurance, and internal audit’s role in testing them remains. Learn data governance over non-financial information and the basics of limited assurance under ISSA 5000.
How do I keep up without spending all my CPE on trends?
Use free sources for awareness of what is changing, such as firm webcasts and IIA member webinars, and keep your paid, structured learning for one or two priorities a year. A plan that is half craft and half emerging subjects is a sensible default.
Should I take an AI certificate program?
If AI is, or will soon be, part of your function’s work, a structured program is a sensible way to build the foundation. The IIA’s AI-Enabled Internal Audit program is 8 CPE hours and included with North American membership. Treat it as a starting point, and apply what it teaches to one real task, such as planning or drafting a report, with the controls the function has agreed for AI use.
Where do the figures in this guide come from?
The risk rankings are from the IIA Foundation’s Risk in Focus 2026/2027 global report, released on 15 September 2026. The function-level figures on analytics, AI and budgets are from the IIA’s North American Pulse of Internal Audit, 2025 and 2026 editions. The AI use figures are from an IIA and AuditBoard survey published in February 2026. The skills outlook is from the IIA’s Vision 2035 report of July 2024. The regulatory dates are from the IIA’s Topical Requirements pages, the EU’s Directive 2026/470 and the IAASB’s ISSA 5000.
Do these trends apply outside North America?
Mostly, yes. The Standards, the Topical Requirements and the Risk in Focus global rankings apply worldwide, and cybersecurity leads almost everywhere. The Pulse figures describe North American functions. Regional editions of Risk in Focus exist and are worth reading for your region’s order of priorities. Sustainability rules are the most jurisdiction-specific part of this guide.
Related guides
- Planning your CPE year — turning these trends into a plan.
- IIA Topical Requirements explained — what is mandatory, and when.
- The auditor’s prompt library — using AI in audit work.
- Auditing cybersecurity programs — the top risk, in an engagement.
- Data analytics skills for internal audit — closing the oldest gap.
- ESG auditing — sustainability assurance for internal auditors.
- CIA CPE requirements — the rules the hours must meet.
- Online CPE for CIAs — formats and providers.
- A certification roadmap by career stage — when a second credential fits.
- The CIA exam, explained — the hub for every CIA guide.
Leave a Reply