The IIA’s Organizational Behavior Topical Requirement takes effect on 15 December 2026. From that date, any assurance engagement in which organizational behavior is the subject, or in which behavior surfaces as a significant risk while the auditors are doing something else, must assess fifteen named governance, risk management and control requirements, record which of them apply, and keep a rationale for every one it leaves out. Quality assessments after the effective date will check the file. The requirement was issued on 15 December 2025 with a user guide, and it turns the old, vague question of “auditing culture” into a narrower one that can actually be tested: does the organization govern, manage and control the risk that the way people really behave works against its objectives?
This workbook is the conformance side of that question. The site’s culture audit method covers how to design and run an engagement whose subject is behavior; this guide covers what the file has to show. It explains the trigger most functions will meet first, gives test steps, evidence requests and exclusion tests for each of the fifteen requirements, sets out how to sample behavioral evidence, maps the requirements to COSO and to audits you already run, offers a library of exclusion rationales, a conformance record and an eighty-day readiness plan, and works through a bank audit in which the requirement arrived halfway through fieldwork. The requirement statements below are paraphrased from the IIA’s published text (December 2025), read in full for this guide; the procedures, examples and judgments are practitioner commentary, not IIA text.
In this guide
- What the requirement says, and what it changes
- When it binds: the trigger most functions will meet first
- Governance: four requirements, with test steps
- Risk management: four requirements, with test steps
- Controls: seven requirements, with test steps
- Sampling and evidence when the subject is behavior
- How the fifteen map to COSO and to audits you already run
- Exclusion rationales that survive a quality assessment
- Rating conformance and writing about behavior
- The conformance record: a template
- Eighty days to 15 December 2026: a readiness plan
- Worked example: a bank audit where behavior arrived mid-fieldwork
- Questions about the requirement
- Related guides
What the requirement says, and what it changes
The requirement defines organizational behavior as the observable choices employees make in doing their jobs and how they work with others: in its own shorthand, “the way we do things”, treated as a subset of culture. The user guide draws the line precisely. Culture, in its glossary, is those choices together with what drives them, formal drivers such as incentives and goals and informal ones such as shared values and beliefs. The requirement audits the observable part and the controls that shape it. It does not ask anyone to measure morale or grade values. It asks whether the organization has structured, monitored and controlled behavior the way it would any other risk, and whether behavior that works against its objectives gets noticed and corrected.
The structure is the one every Topical Requirement uses. There are three sections, each a list of lettered requirements that internal auditors must assess: four under governance, four under risk management and seven under controls, fifteen in all. They are a minimum baseline, and the user guide notes that an organization which rates behavioral risk as very high may need more. The user guide adds non-mandatory considerations lettered to match each requirement, a documentation tool for recording coverage or the rationale for exclusion, a mapping of every requirement to the COSO internal control framework (2013) and COSO enterprise risk management framework (2017), and a table of focused audits and common test elements that often provide coverage already. The facts that matter for planning are these.
| Item | What applies |
|---|---|
| Issued | 15 December 2025, with a user guide |
| Effective | 15 December 2026; quality assessments after that date evaluate conformance |
| Structure | Governance A to D, risk management A to D, controls A to G: fifteen requirements |
| Services | Mandatory for assurance services; recommended for advisory services |
| Triggers | Behavior is the subject of an engagement in the plan; it is identified while performing an engagement; or it is the subject of a requested engagement that was not in the plan |
| Documentation | Evidence that each requirement was assessed for applicability; a documented rationale for each exclusion; conformance documented under Standard 14.6 |
| Relationship to the Standards | Applied in conformance with the Global Internal Audit Standards, including Domain V for planning, performing and communicating the engagement |
| CIA exam | The IIA’s policy is that scored questions on a new Topical Requirement do not appear until at least six months after its effective date |
| The rest of the series | Cybersecurity, effective 5 February 2026; Third-Party, effective 15 September 2026; Organizational Resilience, issued 30 April 2026 and effective 30 April 2027 |
What changes in practice is not that behavior enters the scope of internal audit. Auditors have written findings about tone, pressure and incentives for decades, usually in the root-cause paragraph. What changes is the documentation duty. An auditor who meets a behavioral pattern halfway through a procurement audit must now make an applicability decision about fifteen requirements, write it down, and either test the requirements that bear on the risk or explain why not. The Topical Requirements explainer sets out the mechanism for the whole series; the rest of this guide is specific to behavior.
When it binds: the trigger most functions will meet first
Most functions will not plan a standalone behavior engagement in their first year. They will meet the requirement through the second trigger: behavior identified while performing an engagement about something else. The IIA’s application guidance for Topical Requirements explains what “identified” means. A topic identified during an engagement is one that has reached a prioritized level above the critical threshold set by the organization’s risk appetite, so it is treated as a significant risk. Not every part of the requirement has to be applied when the risk concerns only a subset of governance, risk management and controls, and the scope of application follows the nature of the risk. The user guide’s definition of behavioral patterns helps with the first cut: a pattern is behavior that recurs or happens more frequently, “how things are done” rather than a one-off.
Those two ideas combine into a working rule a methodology can adopt. When a finding’s root cause is a behavioral pattern, such as an incentive that rewards the wrong result, pressure to hit a number, a workaround everyone tolerates or a reluctance to report, and the finding is rated at or above the level your methodology treats as significant, the trigger is met. Run the applicability assessment that week, apply the requirements that bear on the cause, and exclude the rest with reasons. One person’s misconduct is not by itself a pattern, and a documentation lapse is not a behavioral risk. The table shows how the rule plays out across common engagements.
| Engagement | Does the requirement apply? | Requirements usually in play |
|---|---|---|
| Culture or risk culture review | Yes, in full | All fifteen, with any exclusions justified |
| Incentive compensation audit | Yes | Controls D; governance B; risk management A and B |
| Ethics and compliance program, or speak-up and hotline audit | Yes | Controls C and E; risk management B to D; governance D |
| Sales practices or conduct audit | Yes | Controls A, B, D and E; risk management B and C |
| Recruitment, onboarding or performance management audit | Yes | Controls G, F and A |
| Process audit in which a significant finding has a behavioral root cause (threshold-splitting in procurement, overrides tolerated across sites) | Yes, once the behavioral risk is assessed as above the threshold | The subset tied to the cause, most often controls A, D and E and risk management B and C |
| Fraud or misconduct investigation | Investigations are usually run outside the assurance methodology; the requirement governs assurance work | Record the behavioral themes for the next risk assessment and for any follow-on assurance engagement |
| Advisory culture diagnostic or survey | Recommended | Use the fifteen as the design criteria and record the decision |
| Public sector engagement with legal limits on scope | Yes, with documented scope limitations | As for the engagement type; the user guide recognizes legislative and structural restrictions and asks for them to be documented and communicated |
Governance: four requirements, with test steps
The governance requirements ask whether the board and senior management have arranged roles, accountability, oversight and policy so that behavior is steered rather than left to chance. They are assessed mostly through documents, minutes and decision records, which is why they are easy to test superficially. The test steps below are designed to get past the charter to the decisions it produced. The first column paraphrases the requirement; cite the IIA’s text in the workpaper.
| Requirement (paraphrased) | Test steps | Evidence to request | Exclusion is defensible when |
|---|---|---|---|
| Governance A. The board oversees, and senior management structures, roles and responsibilities so that misaligned behavior does not produce unintended consequences such as conflicts of interest or unclear decision-making | Read the board and committee terms of reference for explicit oversight of conduct or behavior. Map the decision rights for three high-risk decisions (pricing overrides, credit or write-off exceptions, changes to incentive plans) and check whether one person can both propose and approve. Test a sample of declared conflicts of interest for the action management took | Charters and terms of reference; delegation of authority; conflicts register; organization changes in the last two years | The engagement covers one process, and board-level governance of behavior is scheduled for assessment in another engagement in the approved plan |
| Governance B. The board oversees, and senior management establishes and maintains, individual and group accountability for behavioral expectations, so that roles and responsibilities are owned, understood and aligned with objectives | Trace the code of conduct’s expectations into role profiles and performance objectives for a sample of roles at several levels. Test whether consequences follow: compare disciplinary outcomes for similar conduct at junior and senior grades. Check understanding through interviews or the organization’s own survey data | Code of conduct; leadership competency model; objectives for sampled roles; disciplinary case log with grades | As for A; or the engagement is limited to a unit whose accountability framework is set and tested elsewhere |
| Governance C. Governance processes monitor, evaluate and challenge whether behavioral insights align with objectives, and act on misalignment | Obtain the behavioral indicators reviewed by the board or executive committee for the last four quarters. Test that each indicator has a definition, a source and an owner. Read the minutes for challenge, not just receipt. Trace three actions agreed at those meetings to completion | Indicator packs; reporting calendar; minutes; action logs | No governance body reviews behavioral insight at all, in which case the requirement is not excluded but concluded as not met |
| Governance D. Policies and procedures on behavioral risk are established, reviewed periodically for relevance and accuracy, communicated effectively and built into operations and decision-making | Inventory the relevant policies (conduct, conflicts, gifts, speak-up and non-retaliation, discipline, governance of incentive plans) with owners and review dates. Test integration: pick three decision processes and check whether the policy appears as a step in the workflow rather than only in a document. Check attestation completion and what happens to people who do not attest | Policy inventory; version histories; workflow screenshots or configuration; attestation reports | The engagement is a process audit and the policy framework is covered by a planned ethics and compliance program audit |
Risk management: four requirements, with test steps
The risk management requirements follow a behavioral risk from definition to resolution: is it named, is it watched, are gaps and their causes communicated, and are they fixed and measured? The trap here is testing that a process exists without testing that it would have caught anything. The most useful single step is to take the behavioral problems the organization has already had, from incidents, hotline themes or earlier audit findings, and ask whether the process as designed would have found each one sooner.
| Requirement (paraphrased) | Test steps | Evidence to request | Exclusion is defensible when |
|---|---|---|---|
| Risk management A. The organization has defined an approach to managing behavioral risks, including the behavioral characteristics critical to its objectives | Look for behavioral risks in the risk taxonomy and register, with owners, appetite and indicators. Check whether the critical behaviors are defined for key roles (accurate reporting, speaking up, following the approval chain). Run the last three years’ behavioral incidents against the approach to see whether it would have flagged them | Risk register extract; risk appetite statement; behavioral risk framework or policy; incident list | The engagement is a process audit and the enterprise approach is assessed in a planned risk culture or ERM engagement |
| Risk management B. Monitoring of organizational behavior is adequate and timely, and its results reach stakeholders | List the behavioral indicators with source, frequency and owner. Test timeliness over the last four cycles. Re-perform two indicators from source data. Check that results reach the people who can act, not only a committee | Indicator definitions; data lineage; distribution lists; the last four reports | Rarely; monitoring is usually central to whatever behavioral risk triggered the requirement |
| Risk management C. Gaps between expected and actual behavior, with their root-cause analyses, are communicated to stakeholders effectively and consistently | Select five behavioral gaps from the period (hotline themes, survey gaps, audit findings with behavioral causes). For each, check whether a root-cause analysis was done and whether it reached the owners of the fix. Compare treatment across business units for consistency | Root-cause analyses; communications to owners; case themes; survey results by unit | No gaps were identified in the period and the monitoring under B is itself found inadequate, in which case conclude on B and record why C could not be tested |
| Risk management D. Gaps are resolved with stakeholder input, tracked to completion and measured to confirm the actions were sufficient | Trace the actions arising from the gaps under C into a tracking system. Test closure evidence. Check whether anyone measured effect: did the indicator move after the fix? | Action tracker; closure evidence; before-and-after indicator data | As for C |
Controls: seven requirements, with test steps
The seven control requirements are where most of the fieldwork sits and where most findings will come from. They cover detecting patterns, setting and checking the tone, speaking up, incentives, issue management, training and hiring. Each has evidence that leaves a trail in data, which is the practical difference between auditing behavior and auditing attitudes. For incentive plans in particular, look at what was paid, not only at how the plan is written; a plan whose document mentions conduct and whose payouts never vary with it has told you what it values.
| Requirement (paraphrased) | Test steps | Evidence to request | Exclusion is defensible when |
|---|---|---|---|
| Controls A. The organization has designed an approach to identify and mitigate patterns of behavior that threaten its objectives, for example through performance reviews or operational risk reviews that look at behavior | Identify the routines that look for patterns: analytics on overrides, exceptions and outliers, calibration of performance ratings, operational risk reviews. Test their operation for a sample of periods and the follow-up on what they found. Run one independent analytic to see whether the routine would have caught a known pattern | Pattern reports and follow-up records; calibration minutes; the organization’s analytics definitions | Rarely; this is the requirement that ties the other controls to real behavior |
| Controls B. The organization sets a clear, consistent tone about expected behavior, communicates it through trusted and accessible channels, and keeps a structured feedback mechanism to gauge understanding and support and to prompt change | Review a year of leadership communications for consistency with the stated expectations. Test the feedback mechanism: its design, response rates by group, whether results are broken down by unit and grade, and what changed because of them. Check accessibility for staff without email or desks | Communications log; survey instrument and results by group; action plans from survey results | The identified risk is confined to a mechanism (an incentive plan, a control override) and tone is assessed in a planned culture review |
| Controls C. Processes encourage reporting of behavior that conflicts with objectives, with protection and resolution protocols | Map every reporting channel. Sample hotline and other cases for triage time, independence of investigation, outcome, feedback to the reporter and monitoring for retaliation. Analyze reports per 1,000 employees by unit, the anonymity rate and the substantiation rate. Test anti-retaliation monitoring for named reporters | Case management extract; protocol documents; retaliation monitoring records; channel statistics | The risk in scope does not depend on anyone reporting it, which is uncommon enough that the rationale should say why |
| Controls D. Incentive programs, monetary and non-monetary, are in place, communicated and aligned with objectives and regulation, and include disincentives and consequences for improper behavior | Inventory the material incentive plans. For each, record the metrics and weights, any conduct gate or modifier, caps, deferral and clawback, and who approved the design. Correlate payouts with risk indicators such as exceptions, complaints and overrides. Test a sample of payouts to people with confirmed conduct issues for the disincentive the plan promises | Plan documents; approvals; payout data; conduct case outcomes; any regulatory guidance that applies to the sector | The behavioral risk has no plausible link to rewards, and the rationale says what the actual driver is |
| Controls E. A process manages behavioral issues: identifying and correcting patterns that do not align with objectives and escalating when necessary | Trace a sample of behavioral issues from hotline, HR and audit sources through case management. Test whether patterns, not just individual cases, were identified and escalated. Check for thematic reporting across cases | Case management records; escalation criteria; thematic reports | Rarely |
| Controls F. Training and awareness programs that align behavior with objectives are delivered periodically and effectively | Inventory the training, completion and frequency. Test effectiveness measures rather than completion: scenario assessments, follow-up indicators. Check whether content covers the dilemmas the role actually meets, such as what to do when a manager asks for a write-off | Learning records; course content; assessment results; indicator trends after training | The risk arises from design (an incentive, a control gap) that training could not address, and the rationale says so |
| Controls G. Recruitment and onboarding align with behavioral expectations and incorporate behavioral competencies | Inspect job profiles and interview guides for behavioral competencies. Sample recent hires and promotions into high-risk roles for evidence that those competencies were assessed. Review onboarding content and completion | Job profiles; structured interview records; promotion files; onboarding records | Hiring and promotion show no link to the identified pattern, and the rationale records the evidence for that |
Sampling and evidence when the subject is behavior
Behavioral evidence comes from four places: data (overrides, exceptions, complaints, hotline cases, attrition, overtime, training records, incentive payouts), documents (plans, codes, minutes, case files), people (interviews, focus groups, the organization’s surveys) and observation. Each is weak alone. Data shows what happened but not why; people explain why but remember selectively; documents show intent but not practice. A working rule that holds up in quality review is triangulation: every conclusion on a behavioral requirement rests on at least two independent sources, and at least one of them is data or a document. A focus group theme that the payout data confirms is a finding. A focus group theme on its own is a lead.
| Evidence | How much to take | What it can support | Handle with care |
|---|---|---|---|
| Incentive plans and payouts | Every material plan (a census, not a sample); payouts for the full period | Controls D, and the link between rewards and patterns | Pay data is personal; work with HR on anonymized or aggregated extracts |
| Hotline and other reported cases | Size from the number of cases, using the small-population sample tables: 17 of 40 cases for 90% confidence and a 10% tolerable rate | Controls C and E; risk management C | Reporter identity is protected; auditors see only what the protocol allows |
| Analytics on overrides, exceptions and outliers | The full population, run by the auditors | Controls A; risk management B; the pattern that triggered the requirement | Patterns show where to look, not who did wrong; never publish outlier lists by name |
| Performance reviews and ratings | A stratified sample by unit and grade, plus the calibration records | Governance B; controls A and G | Rating distributions can mislead when units differ in size |
| Leadership communications | Everything for twelve months | Controls B | Absence of a theme is evidence; count what is said as well as what is not |
| The organization’s own survey | The full dataset, broken down by unit and grade | Controls B; risk management B | Test the instrument’s design before relying on its results |
| Focus groups and interviews | Six to ten groups of six to eight people, stratified by level and location, with a stated confidentiality commitment | Explanations for patterns found in data; controls B and C | Record themes, not attributed quotes; Standard 5.2 governs what you keep and share |
Two practical points make behavioral fieldwork go smoothly. Agree data access with HR, legal and compliance at planning, in writing, including what will be anonymized and who sees raw data; the board’s duty under Standard 6.3 to enable unrestricted access does not remove the organization’s privacy obligations, and a plan agreed up front avoids a standoff in week three. And keep any individual matter out of the engagement. If testing surfaces possible misconduct by a person, refer it under the organization’s investigation protocol and carry on with the controls; the site’s guide to the first 48 hours after internal audit finds fraud sets out the referral discipline that keeps an audit an audit.
How the fifteen map to COSO and to audits you already run
Very little in the requirement is new territory. Most of it maps onto the COSO internal control principles that financial and operational audits already test, and onto audits many functions already run under other names. The table gives the principal COSO 2013 principles for each requirement and the audits most likely to hold existing coverage. The user guide’s own mapping is fuller and includes the COSO enterprise risk management framework; use it as the reference when you build your methodology crosswalk.
| Requirement | Principal COSO 2013 principles | Audits that often hold existing coverage |
|---|---|---|
| Governance A | 2 (board oversight), 3 (structure, authority and responsibility) | Corporate governance review; delegation of authority; board effectiveness |
| Governance B | 1 (integrity and ethical values), 5 (accountability) | Performance management; executive objectives and remuneration |
| Governance C | 13 to 17 (information, communication and monitoring) | Risk culture review; board and committee reporting |
| Governance D | 10 and 12 (control activities deployed through policies) | Policy management; ethics and compliance program |
| Risk management A | 6 to 9 (objectives, risk identification, fraud risk, significant change) | ERM framework; fraud risk assessment |
| Risk management B | 13, 14 and 16 | Key risk indicator and monitoring audits |
| Risk management C | 14, 15 and 17 | Issue management; management reporting |
| Risk management D | 10, 12, 16 and 17 | Remediation tracking; issue validation |
| Controls A | 7, 8, 9, 16 and 17 | Fraud risk; management review and monitoring controls |
| Controls B | 1, 5 and 13 to 15 | Internal communications; employee survey process |
| Controls C | 2 and 14 | Whistleblower hotline; ethics program |
| Controls D | 1 and 5 | Incentive compensation; sales practices |
| Controls E | 13, 16 and 17 | HR case management; investigations process |
| Controls F | 4 (competence) and 13 | Training and competence |
| Controls G | 1 and 4 | Recruitment and onboarding |
The mapping earns its keep in two ways. It lets a function show coverage from work it already does, provided the linkage is documented and the evidence is judged sufficient, which is the approach the IIA’s application guidance describes for all Topical Requirements. And it shows where existing audits leave gaps. Very few functions have ever tested controls E (issue management across behavioral cases) or risk management C (communicating root causes of behavioral gaps), because no traditional audit owns them.
Exclusion rationales that survive a quality assessment
Every requirement not applied needs a rationale on file, and the rationale is the part of the record an assessor reads most closely. A good rationale does three things: it ties the exclusion to the nature of the risk found, it says where else the requirement is covered (with a plan reference and a date) if it is covered anywhere, and it is written before the conclusion, not reverse-engineered from it. The library below covers the situations that recur.
| Situation | Requirements often excluded | Rationale wording that holds up |
|---|---|---|
| Process audit; behavioral cause found in one process | Governance A to D; risk management A | “Board and executive governance of organizational behavior, and the organization’s behavioral risk framework, are outside the scope of this process engagement and are assessed in [engagement, plan reference, date]. The identified risk arises from [process] incentives and monitoring and is covered by controls A, D and E and risk management B and C.” |
| Speak-up or hotline program audit | Controls D and G | “Incentive design and recruitment are not drivers of the reporting and resolution risks in scope; they are assessed in [plan reference].” |
| Incentive compensation audit | Controls C and G | “Reporting channels and recruitment do not bear on the design and payout risks in scope; the speak-up program is assessed in [plan reference].” |
| Recruitment and onboarding audit | Controls C and D | “The engagement addresses whether behavioral competencies are assessed at entry; reporting and reward mechanisms are assessed in [plan reference].” |
| Coverage planned across several engagements | Whatever the coverage map assigns elsewhere | “Coverage of the fifteen requirements is planned across [engagements] over [years], as recorded in the coverage map approved by the audit committee on [date]; this engagement covers [list].” |
| Legal limits on data (privacy law, works council agreements, public sector restrictions) | Specific procedures, not whole requirements | “Access to individual [records] is restricted by [law or agreement]; the requirement was assessed using [anonymized or aggregated data]; the residual limitation is disclosed in the report.” |
| Not enough time, skills or budget | None: this is not a valid exclusion | Record it as a resource constraint instead. The application guidance is explicit that constraints do not waive applicability; the chief audit executive informs the board under Standard 8.2 and addresses the gap through training, co-sourcing or a rescoping the board approves |
Rating conformance and writing about behavior
Conclude on each applicable requirement on a simple scale: meets, partially meets, does not meet, or not established where the evidence was insufficient to conclude. Keep that per-requirement conclusion separate from the engagement’s findings and their severity ratings, which follow your normal methodology under Standard 14.3. A requirement concluded as not met usually produces a finding; a finding does not need a requirement to exist, and a report that forces every observation into the fifteen letters reads like a checklist. The report itself needs a short coverage statement naming the requirement, the number of requirements applied and excluded, and where the exclusions are covered.
Writing about behavior is where engagements go wrong in front of a board. The discipline is to describe observable patterns and the structures that produce them, never motives or character, and never individuals. The guide to writing finding conditions covers the general craft; the table shows what it means here.
| Instead of | Write | Why |
|---|---|---|
| “Staff at the northern branches are cutting corners.” | “Seven of 60 branches produced 44 percent of the accounts that were never funded and were closed within 90 days, while opening 15 percent of all accounts.” | A pattern in data, with its denominator, is a condition; an impression is not |
| “The culture is toxic.” | “Agreement with ‘I can raise concerns without fear of retaliation’ was 27 points lower among branch staff than among executives in the 2026 survey.” | Measurable, sourced and attributable to a group, not a person |
| “Management does not care about conduct.” | “Conduct indicators did not appear on the executive committee agenda in any of the eight meetings reviewed.” | Evidence of a governance gap rather than an accusation |
| “The hotline is ineffective.” | “Three reports that mentioned sales pressure were closed as separate HR matters; no thematic analysis across them was performed.” | Specific enough to fix |
| Naming the branch manager whose branch led the pattern | Refer any individual matter under the investigation protocol and report on the plan design and monitoring | The engagement’s subject is the control environment; individual accountability is management’s process |
The conformance record: a template
The record below is designed to be filled in as fieldwork proceeds, not assembled at the end. It sits alongside the user guide’s documentation tool, which records the same three things per requirement (the requirement, the coverage executed or the rationale for exclusion, and the documentation reference), and adds the trigger and threshold decision that the second trigger makes necessary. Keep it with the engagement workpapers under Standard 14.6.
Organizational Behavior Topical Requirement: applicability and conformance record
Header. Engagement name and reference | Requirement version: Organizational Behavior Topical Requirement, issued 15 December 2025, effective 15 December 2026 | Engagement type: assurance / advisory | Trigger: planned subject / identified during the engagement / requested engagement | Date the trigger was met and by whom | Threshold assessment: the behavioral risk identified, its impact and likelihood, the threshold it was compared with, and the conclusion | Prepared by, reviewed by, dates.
Rows, one per requirement (governance A to D, risk management A to D, controls A to G). Applicable: yes / no | If excluded: rationale, tied to the risk identified, with the plan reference where it is covered | Criteria: the requirement text; the organization’s policy reference; any regulatory or framework reference | Procedures performed, with work program step references | Evidence references | Conclusion: meets / partially meets / does not meet / not established | Finding reference, if any.
Footer. Requirements applied: __ of 15 | Excluded: __ (rationales above) | Conclusions: meets __, partially meets __, does not meet __, not established __ | Data access agreed with HR, legal and compliance on (date), anonymization used: yes / no | Individual matters referred under the investigation protocol: __ (details held outside the workpapers) | Coverage statement included in the report: yes / no | Reviewed under Standard 12.3 by (name, date).
For functions that will cover the requirement across several engagements, add a plan-level coverage map: the fifteen requirements down the side, the planned engagements across the top, and a mark where each engagement will conclude on each requirement. The application guidance allows coverage to be spread across engagements and years provided every relevant requirement is eventually covered and the documentation shows how and when. The map is also the simplest thing to show an audit committee.
Eighty days to 15 December 2026: a readiness plan
A function starting in late September 2026 has about eighty days. That is enough to be conformant on the first engagement that begins after the effective date, if the work is done in this order. The plan assumes no standalone behavior engagement in the first year, which is the common case.
| When | Work | Output |
|---|---|---|
| Weeks 1 to 2 | Read the requirement, the user guide and the application guidance. Decide the trigger rule for behavior identified during engagements and the threshold it uses. Add an applicability step to the planning template and a behavioral category to the root-cause taxonomy | A methodology addendum, approved by the chief audit executive |
| Weeks 3 to 5 | Tag the audit universe for entities where behavioral risk is significant (incentive plans, sales, speak-up, recruitment, anywhere with targets and discretion). Build the plan-level coverage map, crediting audits that already give coverage | Coverage map; any plan amendments for the committee |
| Weeks 6 to 7 | Brief the audit committee in one page: what the requirement is, the coverage map, and any resource gap to be reported under Standard 8.2 | Briefing paper; minutes recording the discussion |
| Weeks 8 to 10 | Train the team on behavioral evidence: analytics on patterns, focus groups, reading survey data, confidentiality, and writing about behavior without naming people. Load the conformance record and the exclusion library into the audit management system | Training records; templates in use |
| Week 11 | Pick the first engagement that starts after 15 December 2026, pre-fill its applicability record, and brief the reviewers who will supervise it | A pilot file ready at kickoff |
| From 15 December 2026 | Apply the requirement; review the first three files through the quality program and adjust the method | A quality note and a revised template |
The QAIP playbook covers how to fold the review of the first files into the quality program, and the guide to building the audit plan covers the universe tagging and the plan amendment. If the coverage map shows the function cannot cover the significant behavioral risks with its current skills, say so to the committee now; the application guidance treats that as a resource matter for Standard 8.2, not as a reason to leave the requirement out.
Worked example: a bank audit where behavior arrived mid-fieldwork
Lakeshore Bancorp, the $9 billion regional bank with 60 branches used across this site, scheduled an audit of retail deposit account opening for the first quarter of 2027, as part of its consumer compliance rotation. The planned scope was customer identification, disclosures and the opening workflow. Nobody expected a behavior engagement. In the second week of fieldwork the auditors ran the analytic they run on every account-opening audit, and the requirement arrived with the results.
Of 29,800 consumer checking accounts opened over fourteen months, 1,190 (4.0 percent) never received a deposit and were closed within 90 days. Of those, 58 percent had been opened in the last five business days of a month, against roughly a quarter of all openings, and seven of the 60 branches accounted for 44 percent of them while opening 15 percent of all accounts. At those seven branches the unfunded-and-closed rate was 11.7 percent; at the other fifty-three it was 2.6 percent. The branch incentive plan paid branch bankers a fixed amount for each new checking account above a monthly branch target, with no condition that the account be funded and no clawback. The pattern met the function’s trigger rule on day eleven: a behavioral root cause, recurring across months and branches, with regulatory and reputational exposure well above the bank’s threshold for conduct risk. The team recorded the applicability decision that day.
| Requirement | Applied? | Rationale or procedure | Conclusion |
|---|---|---|---|
| Governance A to D | Excluded | Board and executive governance of conduct is scheduled for the FY28 enterprise conduct risk review in the approved plan; this engagement’s risk arises in one product’s incentives and monitoring | Not applicable to this engagement; covered in FY28 |
| Risk management A | Excluded | The bank’s behavioral risk framework is in the scope of the same FY28 review | As above |
| Risk management B | Applied | Tested retail risk’s monitoring of new-account quality | Does not meet: funding rates were monitored quarterly at portfolio level only, with no branch or month-end view |
| Risk management C | Applied | Traced sales-pressure themes from all sources in 2026 | Does not meet: three hotline reports mentioning pressure were closed as separate HR matters with no root-cause analysis |
| Risk management D | Applied | Looked for tracked actions on any account-quality gap | Does not meet: no gap had been identified, so nothing was tracked |
| Controls A | Applied | Reviewed compliance monitoring of account opening; re-ran the pattern analytic on its data | Partially meets: monthly testing of identification completeness operated, but nothing looked at funding or timing |
| Controls B | Applied | Reviewed twelve months of retail leadership communications and the survey item on pressure | Partially meets: messages centered on growth targets; the survey asked about pressure but results were not broken down by branch |
| Controls C | Applied | Mapped channels; sampled 2026 retail cases | Partially meets: channels existed and were used, and protection protocols operated; resolution treated related reports separately |
| Controls D | Applied | Plan design, approvals and fourteen months of payouts | Does not meet: volume-only metric, no quality gate, no clawback, no risk or compliance review of the design |
| Controls E | Applied | Traced retail conduct cases through case management | Does not meet: no process identified patterns across cases |
| Controls F | Applied | Training content and completion for branch staff | Partially meets: 97 percent completion; content covered product features, not what to do under target pressure |
| Controls G | Excluded | Tenure and hiring channel of branch staff showed no relationship to the pattern; recruitment is assessed in the FY28 HR audit | Not applicable to this engagement |
Nine of the fifteen requirements were applied and six excluded, each with a rationale written on day eleven rather than at the end. One further decision shaped the engagement. In a sample of 40 unfunded accounts from the seven branches, seven carried contact details that matched a branch employee’s phone number or email address. The team referred those on day nine to compliance and legal under the bank’s investigation protocol and kept them out of the audit report; the audit’s subject remained the plan and the monitoring, not the people. The report carried one High finding (the incentive plan rewards volume without a quality gate, and monitoring does not look for the pattern the plan produces) and one Medium (speak-up themes are not analyzed across cases), and a four-line coverage statement naming the requirement, the nine requirements applied and where the six exclusions are covered. The chief audit executive discussed the High finding with the chief executive and the chief risk officer before the report was final, the head of retail took ownership of the plan redesign with HR and compliance, and the per-account payment was suspended for the second quarter while the new design was built.
The requirement did not create the finding. The analytic would have found the pattern in any year. What it changed was the file: the decision to follow the pattern into incentives, speak-up and training was recorded, reasoned and complete, and the exclusions pointed to where the rest would be covered. That is what an assessor will look for. The culture audit method shows what the FY28 conduct review will need to do with the governance requirements this engagement set aside.
Questions about the requirement
Does every behavioral root cause trigger the requirement?
No. The trigger is a behavioral risk that reaches the significance threshold, and the user guide’s definition of patterns, behavior that recurs or happens more frequently, rules out one-off lapses. What every behavioral root cause should trigger is the applicability assessment, briefly recorded, so that the decision not to apply the requirement is visible as a decision.
Can we cover the fifteen requirements over several years?
Yes. The IIA’s application guidance allows a Topical Requirement to be addressed across several engagements, potentially over multiple years, provided all relevant requirements are eventually covered and the documentation shows how and when. A plan-level coverage map approved by the audit committee is the cleanest way to show it.
Does an employee engagement survey count as a behavior audit?
Not by itself. The organization’s survey is evidence, and a well-designed one can be the structured feedback mechanism that controls B expects, but internal audit’s job is to test whether the survey is designed well, whether its results are used, and whether behavior matches what it reports. An advisory diagnostic built on the survey is recommended to follow the requirement, not required to.
What if HR will not give us the data?
Agree the access at planning, in writing, and offer anonymized or aggregated extracts where personal data is not needed. If access is still refused, it is a scope limitation: the chief audit executive raises it with senior management and, if unresolved, with the board, which under Standard 6.3 is expected to enable the function’s unrestricted access, and the report discloses the limitation.
How does this relate to the other Topical Requirements?
They can apply together when the risk warrants it. A third-party audit that finds a supplier’s staff were incentivized to pass inspections might engage both this requirement and the Third-Party Topical Requirement; the application guidance asks auditors to apply each only where the significant risk calls for it and to document the reasoning. The cybersecurity workbook shows the same conformance approach for the first requirement in the series.
Related guides
- How to audit corporate culture — designing and running an engagement whose subject is behavior.
- IIA Topical Requirements explained — the mechanism for the whole series.
- The Third-Party Topical Requirement — seventeen requirements, mapped and tested.
- The Cybersecurity Topical Requirement workbook — the first requirement in the series.
- The Global Internal Audit Standards — the complete guide.
- GIAS Domain II: ethics and professionalism — the auditor’s own obligations, including confidentiality.
- GIAS Domain V: performing engagements — planning, fieldwork and reporting standard by standard.
- COSO’s 17 principles — the internal control framework the requirement maps to.
- Root cause analysis for audit findings — finding the behavioral cause behind a control failure.
- Fraud risk management and internal audit — where behavioral and fraud risk meet.
- When internal audit finds fraud: the first 48 hours — referring individual matters without derailing the audit.
- Risk appetite statements — setting the threshold the trigger depends on.
- Audit sample sizes — exact sample sizes for small populations such as hotline cases.
- The QAIP playbook — reviewing the first files through the quality program.
- Organizational Resilience Topical Requirement: A Workbook — the 20 requirements and how to assess them.
Leave a Reply