The global risk landscape has shifted decisively. According to the IIA Internal Audit Foundation’s Risk in Focus research, a survey of over 4,000 internal audit practitioners across 131 countries, geopolitical uncertainty and digital disruption are experiencing the most significant increases in risk levels in 2025, with cybersecurity holding its position as the single most cited global risk. [1] For boards, audit committees, and Chief Risk Officers, the data signals that the risk environment is not simply becoming more complex. It is becoming faster, more interconnected, and more consequential for organisations that are not actively monitoring and responding in near real time.
Download the Pierag Risk on the Rise Technical Note (PDF)
The Three Risk Themes Dominating 2025
The Risk in Focus survey identifies three distinct themes that are shaping the risk agenda for internal audit functions and enterprise risk management programmes globally.
Cybersecurity remains the top risk. 73% of survey respondents indicated cybersecurity as one of their top five concerns, making it the most consistently cited risk category across all regions and sectors. [1] Third-party involvement in data breaches doubled from 15% to 30% in a single year according to the Verizon 2025 Data Breach Investigations Report, covering more than 22,000 security incidents. [2] Ransomware, supply chain attacks, and data exposure have moved from IT team concerns into audit committee and board agendas, with regulatory enforcement tracking closely behind.
Geopolitical uncertainty increased by 10 percentage points compared with the prior year. [1] Tariffs, sanctions, trade policy volatility, and regional conflicts are forcing risk teams to model scenarios that were considered tail risks three years ago. Supply chain concentration, foreign exchange volatility, and cross-border regulatory divergence are the primary channels through which geopolitical risk enters organisations’ financial and operational performance.
Digital disruption, driven primarily by AI, increased by 9 percentage points. [1] AI is simultaneously a source of risk and a risk management tool. Organisations deploying AI in credit decisions, fraud detection, procurement approvals, and financial reporting workflows are creating control environments that internal audit functions are only beginning to develop the frameworks to assess credibly. 31% of executives surveyed by the NC State ERM Initiative and Protiviti ranked AI integration as one of their top three risk concerns for 2026. [3]
From Periodic Review to Continuous Risk Intelligence
The pace at which these risks develop and compound has outpaced the cadence of traditional enterprise risk management. A cyber breach cascades before the next quarterly review. An AI system makes thousands of consequential decisions before the next audit cycle covers it. A geopolitical development reprices supply chain risk before the annual risk assessment is refreshed.
The strategic response that leading organisations are implementing is a shift from periodic, reactive risk reviews to continuous, data-driven risk intelligence. [4] This means real-time risk signal monitoring through integrated platforms, automated key risk indicator tracking, and board dashboards that reflect current risk exposure rather than the state of the risk environment three months ago. The enterprise risk management market reflects this directional shift, valued at USD 72.4 billion in 2025 and projected to reach USD 203.7 billion by 2033 at a CAGR of 13.7%. [5]
What Audit Committees and Risk Functions Must Do Now
Three actions are no longer optional for mature risk programmes responding to the 2025 and 2026 risk environment.
Audit plans must be dynamic, not fixed annually. A twelve-month plan is structurally incapable of covering risks that materialise between planning cycles. Monthly or quarterly plan refresh cycles informed by live risk signals are the minimum standard for a risk-responsive internal audit function.
Technology risk, AI governance, and third-party risk must be standard components of the audit programme. These are not specialist areas. They are baseline requirements in any organisation that uses cloud infrastructure, third-party platforms, or AI-assisted processes.
Risk intelligence must reach the board in near real time. The audit committee’s ability to provide meaningful oversight depends entirely on the quality and timeliness of the information it receives. A quarterly summary of what was true three months ago does not meet that standard in the current environment.
Pierag’s Business Risk Advisory practice works with boards, audit committees, and Chief Risk Officers to assess enterprise risk management maturity, design dynamic risk monitoring frameworks, and build the governance infrastructure that the current risk environment requires. Pierag’s Technology Risk Advisory teams address cybersecurity, AI governance, and third-party risk dimensions specifically.
Frequently Asked Questions
What are the top risks identified in the IIA Risk in Focus 2025 survey?
Cybersecurity is the top risk, cited by 73% of respondents as a top-five concern. Geopolitical uncertainty increased by 10 percentage points, and digital disruption, driven primarily by AI, increased by 9 percentage points compared with the prior year. [1]
Why is AI considered a risk in 2025?
AI systems are making consequential decisions in financial reporting, procurement, credit decisions, and fraud detection without adequate controls, explainability, or human oversight in many organisations. The governance gap between AI deployment and AI auditing is the primary risk concern. [1][3]
What is continuous risk intelligence?
Continuous risk intelligence replaces periodic risk assessments with real-time monitoring, automated KRI tracking, and data-driven risk detection, providing boards and audit committees with ongoing visibility into risk exposure rather than quarterly retrospective summaries. [4]
How should internal audit respond to rising cybersecurity risk?
Internal audit should ensure cybersecurity is formally covered in the audit plan, that IT general controls and third-party access management are tested at least annually, and that the audit committee receives timely intelligence on emerging cyber threats rather than only retrospective findings.
References
[1] European Confederation of Institutes of Internal Auditing (ECIIA). (2025, September). Risk in Focus 2026: Hot Topics for Internal Auditors Survey of over 4,000 practitioners in 131 countries. Retrieved from https://www.eciia.eu/2025/09/risk-in-focus-2026-hot-topics-for-internal-auditors/
[2] Verizon Business. (2025, April 23). 2025 Data Breach Investigations Report: Third-party involvement in breaches doubles to 30% [Press release]. Retrieved from https://www.verizon.com/about/news/2025-data-breach-investigations-report
[3] Diligent. (2025, November 11). Enterprise risk management trends for 2026: Continuous AI-enabled risk intelligence. Retrieved from https://www.diligent.com/resources/blog/erm-trends-2024
[4] MarketsandMarkets. (2026, February 27). Enterprise Risk Management Market Forecast 2025 to 2030. Retrieved from https://www.marketsandmarkets.com/blog/ICT/enterprise-risk-management-market
