Pevita Pearce
Organizations worldwide are confronting a significantly altered and increasingly interconnected risk landscape, with digital disruption and geopolitical uncertainty emerging as the most pronounced areas of concern, according to the Internal Audit Foundation’s latest annual "Risk in Focus" research. The comprehensive study, which gathered insights from over 3,000 internal audit practitioners across 132 countries, reveals a palpable shift in the perceived threats facing businesses and institutions.
Key Findings: A Shifting Paradigm of Risk
The research highlights a substantial increase in the perceived risk associated with digital disruption, including the rapid integration of artificial intelligence (AI), and geopolitical uncertainty. Both categories saw their risk ratings climb by a significant 10 percentage points globally compared to the previous year. Digital disruption now stands at 58%, while geopolitical uncertainty has reached 48%. This upward trend in digital disruption was observed across all geographical regions, with North America reporting the highest concentration of this risk at 69%.
However, cybersecurity continues to hold its position as the paramount global risk, experiencing a seven percentage point increase to reach an overwhelming 80%. This sustained dominance underscores the persistent and evolving nature of cyber threats in an increasingly digital world.
A critical takeaway from the "Risk in Focus" report is the interconnectedness of these escalating risks. Digital disruption is no longer an isolated concern confined to IT departments. Its influence now permeates various crucial operational areas, including supply chain management, third-party risk, fraud detection, human capital management, regulatory compliance, and market competition. The findings strongly suggest that modern organizational risks are rarely siloed; a single event, whether a technological breakthrough, a geopolitical upheaval, or a sophisticated cyberattack, can trigger cascading consequences across an enterprise’s operations, liquidity, supply chains, workforce, regulatory exposure, and overall business resilience.
Anthony Pugliese, CIA, CPA, CGMA, CITP, President and CEO of The Institute of Internal Auditors, emphasized the report’s significance. "Risk in Focus provides an important benchmark for organizations and internal audit leaders to understand how rapidly the risk landscape is changing and where governance and organizational preparedness must evolve," Pugliese stated. "The global risk environment continues to be reshaped by the convergence of technology, geopolitical uncertainty, fraud, workforce trends, supply chain pressures, and other emerging challenges. The challenge for organizations is no longer simply identifying individual risks, but understanding how they intersect, how quickly their impact can spread across the enterprise, and whether governance, internal audit, and decision-making are keeping pace."
Rising Risks Expose Gaps in Organizational Preparedness
The research also paints a picture of uneven organizational responses to this dynamic risk environment. While cybersecurity, as the highest-rated global risk, demonstrates a relatively strong alignment between perceived risk and organizational and audit attention, other areas reveal notable disparities. Seventy-five percent of global respondents identified cybersecurity as a top-five area for audit time and effort, a six percentage point increase from the previous year, indicating a proactive allocation of resources towards this critical domain.
Digital disruption, fueled by the pervasive integration of AI and other emerging technologies, is also garnering increased attention. It experienced the largest year-over-year increase in audit priority, climbing 10 percentage points to 42%. This surge in audit focus signifies that audit leaders are actively redirecting resources to address these evolving threats. However, even with this increased attention, the risk rating for digital disruption (58%) remains considerably higher than its audit priority. This discrepancy suggests a potential gap between the perceived level of risk and the current capacity and focus of audit functions, underscoring the imperative for organizations to adapt their skill sets, governance structures, and evaluation criteria to effectively manage these rapidly changing technological risks.
Geopolitical and macroeconomic uncertainty presents one of the clearest examples of this preparedness challenge. While 48% of global respondents rank it among their organization’s top five risks, a mere 13% identify it as a top-five audit priority. This significant disparity is particularly pronounced in North America, where 43% of respondents consider geopolitical uncertainty a top-five risk, yet only 6% allocate it as a top-five audit priority. Although direct auditing of geopolitical risks may be limited, it is acknowledged that political instability is likely addressed indirectly through engagements focused on supply chain stability, financial and liquidity health, business resilience, regulatory compliance, and market dynamics.
In contrast, more traditional audit areas continue to command substantial organizational attention and audit resources. For instance, financial and liquidity risk is considered a top-five audit priority by 49% of respondents, even though it is identified as a top-five risk by only 34%. This suggests a potential over-allocation of audit resources to established risks while newer, rapidly evolving threats may not be receiving commensurate attention.
Aligning Fast-Moving Risks with Governance Maturity and Audit Coverage
For the first time, the "Risk in Focus" survey included questions designed to assess risk governance maturity and the adequacy of internal audit coverage. The findings revealed a concerning trend: some of the fastest-changing risks are also among the areas with the least mature governance and the least comprehensive audit coverage.
Digital disruption ranked particularly low in both measures. Only 23% of respondents rated its risk governance as "managed" or "optimized," while a mere 11% reported full audit coverage. Geopolitical uncertainty also exhibited low maturity, with 29% reporting mature governance and only 10% indicating full audit coverage.
Cybersecurity, despite being the highest-rated risk, also shows a preparedness gap, albeit less pronounced than digital disruption or geopolitical uncertainty. It reported 45% governance maturity and 33% full audit coverage. In stark contrast, financial and liquidity risk, a more established and understood risk area, reported a higher 62% governance maturity and 47% full audit coverage. This comparison highlights a recurring theme: newer, more complex, and rapidly evolving risks are not yet being governed and audited with the same rigor as more traditional and historically understood risks.
Implications and Future Strategies for Enhanced Preparedness
The "Risk in Focus" research offers a critical call to action for organizations, boards of directors, and internal audit leaders. The findings suggest several strategic avenues to bolster preparedness in the face of an increasingly volatile global environment.
Firstly, providing boards with a clearer view of how current risk levels align with existing governance maturity and assurance coverage is paramount. This transparency can facilitate more informed decision-making regarding resource allocation and strategic risk management.
Secondly, the adoption of forward-looking assessment methodologies, such as scenario planning and readiness reviews, is essential for effectively addressing rapidly changing risks like digital disruption and geopolitical uncertainty. These proactive approaches can help organizations anticipate potential impacts and develop mitigation strategies before crises fully materialize.
Thirdly, enhanced coordination among various assurance providers, both internal and external, can help create a more holistic and integrated view of the risk landscape. This collaboration can identify and address potential blind spots and ensure that all critical risk areas are adequately covered.
Finally, transparent communication regarding material assurance gaps, capability constraints, and accepted risks is crucial. This open dialogue fosters accountability and allows stakeholders to understand the organization’s risk appetite and the measures in place to manage it.
The convergence of technological advancements, geopolitical shifts, and persistent economic pressures presents a complex and evolving challenge for organizations. The "Risk in Focus" report serves as a vital diagnostic tool, illuminating areas where preparedness must be strengthened to navigate the complexities of the modern risk environment and ensure long-term organizational resilience and success. As the global risk landscape continues its rapid transformation, proactive adaptation and a nuanced understanding of interconnected risks will be critical for organizations seeking to thrive amidst uncertainty.
