The Institute of Internal Auditors' (IIA) Internal Audit Foundation's latest Risk in Focus research showed that internal audit functions worldwide focus mostly on cybersecurity, governance/corporate reporting, and business continuity, although the number of respondents expecting digital disruption and cybersecurity to be in the top five for audit efforts are on the rise.

The Risk in Focus 2025 survey results are based on responses from over 3,500 internal audit leaders throughout Asia Pacific, Europe, Latin America, North America, Africa, and the Middle East.

"Our latest research tells us cybersecurity, business continuity, and human capital continue to hold the top three spots in risk ratings. However, respondents anticipate significant changes as risks related to climate change and digital disruption accelerate in the coming years," Anthony Pugliese, President and CEO of IIA, said in a release.

Indeed, despite the different top three concerns, the global risk levels for digital disruption and climate change are expected to rise 20 percentage points and 16 percentage points, respectively, during the next three years. These numbers are far ahead of other risk areas. The disparity shows a perceived gap between evolving threats and current areas of attention.

The percentage of respondents expecting digital disruption to be in the top five for audit efforts more than doubled, to 52% from 22%. Also noteworthy is that the percentage for climate change more than tripled, to 34% from 11%.

According to the survey, roughly 39% of the participants worldwide ranked digital disruption as a top five risk, with that number anticipated to jump to 59% in three years. For North America, these figures are even higher, which are 48% and 70%, respectively. Respondents worldwide also believe digital disruption will increase from the fourth to the second highest-ranked risk area in three years.

Meanwhile, artificial intelligence (AI) has introduced new risks to monitor, specifically related to cybersecurity, 75% of respondents said. AI has also affected many other risk areas, such as human capital and fraud.

AI is a specific focus for internal audit leaders regarding technology-related risks. Challenges include upskilling and adopting new tools and worldwide differences in access to and knowledge of emerging technology.

Additionally, climate-related risks are now ranked comparatively low, although they are expected to increase considerably soon. Roughly one in four (23%) global respondents consider climate change a top five risk today. But, close to 40% of survey participants anticipate it will reach the top five in three years, rising to 5th place from 13th.

The participants worldwide agree that sustainability reporting and compliance requirements are the main drivers for boards, management, and internal audit functions to allot resources to climate change. The report showed considerable regional differences in climate-related risk perceptions.

In the future, adopting AI and emerging technologies will be crucial, as will prioritizing upskilling, technology-oriented training, and recruitment to manage these risks effectively.

In the release, Pugliese emphasized, "The Risk in Focus findings underscore the importance of agile collaboration and partnership among internal audit functions, boards, and management to stay ahead of emerging threats and improve understanding of potential risk exposures."