# Which IIA standards changes affect audit-management platforms?

**The implementation requirement is engagement-level applicability and evidence, not merely adding new audit-universe labels.** IIA Topical Requirements are mandatory within its professional framework for applicable assurance work; they are recommended rather than mandatory for advisory services. Applicability decisions and the rationale for excluding individual requirements must be documented and retained. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/))

| Topical Requirement | Effective date | Recommended platform preparation |
|---|---|---|
| Cybersecurity | **5 February 2026** | Check current assurance work programmes and evidence coverage. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/cybersecurity?utm_source=openai)) |
| Third-Party | **15 September 2026** | Link applicable audit criteria to supplier relationships and testing. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/third-party/)) |
| Organizational Behavior | **15 December 2026** | Prepare scope, confidentiality and evidence-handling decisions. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/organizational-behavior/?utm_source=openai)) |
| Organizational Resilience | **30 April 2027** | Update the 2027 methodology and engagement templates. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/organizational-resilience/)) |

These are professional requirements, not a universal US statute requiring every organisation to audit every topic annually. Their application is risk-based within the professional framework. ([theiia.org](https://www.theiia.org/en/standards/2024-standards/topical-requirements/))

### What should internal audit test in a shared GRC platform?

**Recommended demonstration:** give the supplier an assurance engagement in which only part of a topical requirement applies. Ask it to retain:

- The assessment of every requirement’s applicability.
- The exclusion rationale and reviewer.
- The engagement-specific testing programme.
- Links to supporting evidence and findings.
- Auditor conclusions separately from management’s control assertions.
- The version of the methodology used at the time.

Then ask a management control owner to edit the underlying control record. The historical audit conclusion should remain identifiable and attributable.

For **audit-management software requirements**, insist on controlled methodology updates and reviewer permissions. Reusing evidence is a useful design objective; merging management ownership and independent assurance is not the objective.