Preparing for the IIA’s Organizational Behavior and Organizational Resilience Topical Requirements
Publication Date: November 3, 2026
By the ACUA Journal Team
Editor’s Note: This information was generated by Chat-GPC based on the IIA’s topical requirements and user guides with the intent to provide timely guidance on these changes.
The Institute of Internal Auditors’ (IIA) forthcoming Topical Requirements for Organizational Behavior and Organizational Resilience are the next two releases following Cybersecurity (effective February 5, 2026) and Third-Party (effective September 15, 2026). Both requirements establish minimum expectations for assessing risk areas that have traditionally been difficult to audit because they are broad, dynamic, and influenced by human judgment. Together, they encourage internal auditors to move beyond evaluating isolated controls and examine how governance, risk management, culture, technology, people, and operations interact to affect organizational objectives.
The requirements are mandatory for assurance engagements when the applicable topic is included in the audit plan, identified during an engagement, or becomes the subject of a requested engagement. Not every requirement will apply in every engagement, but internal auditors must document their applicability assessment and retain a rationale for any exclusions. The Organizational Behavior Topical Requirement becomes effective December 15, 2026, while the Organizational Resilience Topical Requirement becomes effective April 30, 2027.
The following is a summary of the topical requirements and auditing suggestions. Download the complete topical requirements and user guides from the IIA’s website.
Organizational Behavior
Organizational behavior refers to the observable choices employees make in performing their work and interacting with others. It is closely related to culture but provides a more specific and auditable focus. Rather than treating culture as an abstract concept, the Organizational Behavior Topical Requirement frames the issue as the risk that actual behavior may become misaligned with organizational objectives.
This distinction is significant. An organization may have appropriate policies, values, and strategic objectives on paper, while incentives, leadership practices, performance measures, or informal norms encourage employees to act differently. Such misalignment can contribute to misconduct, poor decision-making, weak escalation, customer harm, operational failures, or regulatory issues.
Key requirements
From a governance perspective, internal auditors must assess whether the board and senior management have established clear roles, responsibilities, and accountability for behavioral expectations. Governance processes should support regular monitoring and evaluations of the alignment between actual behavior and organizational objectives. Policies addressing behavioral risk should be periodically reviewed, effectively communicated, and integrated into operational decision-making.
The risk management requirements focus on whether the organization has defined an approach for managing behavioral risk and identified the behavioral characteristics critical to achieving its objectives. Monitoring should be timely, and results should be communicated to appropriate stakeholders. Where gaps exist between expected and actual behavior, the organization should identify root causes, communicate the issues, and develop corrective actions with stakeholder input. Remediation should be tracked and measured for effectiveness.
The control requirements address the mechanisms that influence behavior. These include processes for identifying behavioral patterns that may create risk, communicating expectations, encouraging reporting, protecting individuals who raise concerns, and managing behavioral issues. Auditors should also consider whether incentive and consequence systems align with organizational objectives. Training, awareness, recruitment, and onboarding processes should reinforce expected behaviors and incorporate relevant behavioral competencies.
How to audit organizational behavior
An organizational behavior audit should begin with a clear understanding of the organization’s objectives, values, risk appetite, and behavioral expectations. Auditors should then compare those expectations with evidence of how work is actually performed.
Potential procedures include reviewing board and committee minutes, codes of conduct, human resources policies, performance evaluation criteria, incentive plans, disciplinary records, whistleblower data, employee surveys, customer complaints, turnover statistics, absenteeism, and prior audit findings.
The audit should also test whether reporting channels are accessible and trusted, whether retaliation protections operate effectively, and whether management responds consistently to concerns. Testing incentive programs is particularly important because compensation, recognition, promotion, and performance measures can unintentionally encourage excessive risk-taking or discourage escalation.
Organizational Resilience
The Organizational Resilience Topical Requirement addresses the organization’s ability to absorb and adapt to change while continuing to deliver critical products and services. Resilience encompasses more than business continuity and disaster recovery. It includes strategic, operational, technological, financial, human, supply chain, and stakeholder dimensions.
The requirement recognizes that disruption may arise from natural disasters, cyberattacks, geopolitical events, public health crises, regulatory change, technology disruption, supply chain failures, financial pressures, or the loss of critical personnel. It also emphasizes gradual or slow-building threats that may weaken an organization over time.
Key requirements
The governance requirements call for a formal resilience strategy approved and overseen by the board. The strategy should address operational, technological, and financial needs and align with the organization’s broader risk management approach. Management should provide periodic updates to the board on resilience objectives, risks, resource needs, and improvement activities. Organizations should maintain and periodically review policies for critical processes, establish an incident command structure, validate the competency of personnel in critical resilience roles, and identify and engage relevant internal and external stakeholders.
The risk management requirements focus on the ongoing identification, assessment, monitoring, and escalation of resilience risks. Risks should be mapped to strategic objectives and assigned to accountable individuals or teams. Management should maintain and periodically test processes for responding to and recovering from crises. These processes should include detection, prioritization, containment, recovery, and post-incident analysis, supported by scenario analysis and stress testing.
The control requirements extend across third parties, data, technology, facilities, personnel, training, and resources. Organizations should identify critical suppliers, maintain minimum inventory levels, and identify alternative providers. Critical data should be classified, protected, backed up, and recoverable. Critical IT assets should be inventoried, and cybersecurity controls should include continuous monitoring and restricted access.
Business continuity and disaster recovery plans should define roles and recovery teams and be tested periodically through tabletop exercises, simulations, or other methods. Personnel should receive resilience training, and the organization should ensure adequate operational, technological, human, and financial resources are available during a disruption. Finally, post-incident reviews should identify lessons learned and incorporate them into future planning.
How to audit organizational resilience
A resilience audit should evaluate whether plans are realistic, integrated, current, and tested. Auditors should review the board-approved resilience strategy, business impact analyses, risk registers, continuity and recovery plans, incident response procedures, succession plans, supplier assessments, technology inventories, backup records, and results of prior exercises.
Testing should go beyond confirming that a plan exists. Auditors should determine whether recovery objectives are achievable, assigned personnel understand their responsibilities, communication protocols function as intended, and critical dependencies have been considered. Walkthroughs and tabletop exercises can be used to evaluate decision-making, escalation, resource allocation, alternate work arrangements, and coordination with vendors, regulators, customers, and emergency authorities.
Auditors should also sample critical data and systems to determine whether backups can be restored within required timeframes. Third-party resilience should be assessed through contracts, service-level agreements, business continuity documentation, testing evidence, and alternative-provider plans. Post-incident reviews should be examined to determine whether root causes were identified, corrective actions assigned, and improvements implemented.
Preparing now
Internal audit functions should consider mapping existing audit work to the two requirements. Current audits of culture, ethics, incentives, human resources, cybersecurity, business continuity, disaster recovery, third parties, and crisis management may already provide significant coverage. Audit plans and work programs should be updated to include applicability assessments, documented exclusions, and cross-references to supporting evidence, which should be in place by the implementation dates.
The two requirements also provide an opportunity for internal audit to deliver more integrated assurance. Organizational behavior examines how people and incentives influence outcomes, while organizational resilience examines whether the organization can withstand and adapt to disruption. Both require auditors to evaluate not only whether controls exist, but whether they operate effectively in practice. Preparing early will help internal audit functions demonstrate conformance, identify emerging risks, and provide the board with more meaningful assurance about the organization’s ability to achieve its objectives.