The Institute of Internal Auditors Releases Organizational Behavior Topical Requirement
Press Release | Topical Requirements & Certifications | December 15, 2025
Organizational behavior increasingly recognized as risk domain
LAKE MARY, Fla. (December 15, 2025) – The Institute of Internal Auditors today released the Organizational Behavior Topical Requirement, the third in a series of Topical Requirements and the final to be published in 2025. Incorporating feedback from practitioners and stakeholders around the world, this new requirement reframes the auditing of culture into a structured assessment of behavior-related risks, offering a practical baseline for integrating behavioral insights across the audit portfolio.
The Organizational Behavior Topical Requirement provides a baseline approach for internal audit functions when assessing organizational behavior – considered a subset of culture – as an audit topic or when it is identified as a risk within other audits. It offers straightforward guidance to help internal auditors review how behavior is overseen in the organization, how behavior-related risks are identified and addressed, and whether the structures in place, such as controls, incentives, and accountability, encourage people to act in ways that support the organization’s goals.
“Organizational behavior is increasingly recognized as a key driver of performance and resilience. The actions, decisions, and interactions of people across an organization influence how risks are identified and managed, how decisions are made, and how effectively strategy is executed,” said Anthony Pugliese, CIA, CPA, CGMA, CITP, President and CEO of The IIA. “To achieve their objectives, organizations must understand and actively manage the behaviors that shape outcomes. This Topical Requirement provides internal auditors with clear, practical expectations to support that effort.”
Topical Requirements are one of three key elements of The IIA’s International Professional Practices Framework® (IPPF®), alongside the Global Internal Audit Standards™ and Global Guidance. They provide a consistent baseline for assessing specific risk areas and undergo a detailed review and approval process by the Global Guidance Council, the International Internal Auditing Standards Board, and the IPPF Oversight Council. When evaluating potential subjects for the Topical Requirements, The IIA considered pervasive risks which are most likely to impact organizations globally and therefore be included in audit plans.
The next Topical Requirement will focus on Organizational Resilience, addressing risks that could significantly disrupt or impair an organization’s ability to deliver its core products and services, maintain stakeholder trust, or meet its strategic objectives. This includes natural disasters, public health crises, and other disruptive risks.
About The Institute of Internal Auditors
The Institute of Internal Auditors (The IIA) is an international professional association that serves more than 270,000 global members and has awarded more than 200,000 Certified Internal Auditor (CIA) certifications worldwide. Established in 1941, The IIA is recognized throughout the world as the internal audit profession's leader in standards, certifications, education, research, and technical guidance. For more information, visit theiia.org.
Media contact
Sarah DuBois
952-688-2588
sarah.dubois@theiia.org