Innocent Hlungwani | Acting CEO | The Institute of Internal Auditors South Africa (IIA SA) | mail me |
Cybersecurity has emerged as the leading organisational risk across Africa. However, our new research shows that recognising a risk does not always translate into sufficient audit coverage.
Our 2026/2027 Africa Risk in Focus report found that 73% of African respondents ranked cybersecurity among their organisation’s five biggest risks. This represents an 11-percentage-point increase year-on-year, the largest increase across the risk areas surveyed. Cybersecurity also ranked as the highest internal audit priority at 67%.
We released the findings during Cybersecurity Awareness Month as part of a global study. The study surveyed 3,285 chief audit executives and directors across 132 countries and locations. Our Africa analysis draws on 816 responses from 34 African countries and locations. We supplemented these findings with three roundtables involving 18 participants and three in-depth interviews.
Recognition versus coverage
Cybersecurity is clearly receiving attention, but boards should also ask how much assurance they are actually getting over it. Organisations can recognise a risk and include it in the audit plan without fully covering it. That is where organisations need to look more closely.
The gap becomes clearer when we examine the findings in terms of actual audit coverage. Despite cybersecurity being the leading risk and audit priority, fewer than a quarter of respondents reported full internal audit coverage. Digital disruption also remains a concern, as audit attention and coverage continue to lag behind its perceived risk.
Audit priorities vary across sectors
The sector breakdown also reveals differences in how organisations respond. Financial services respondents show the strongest alignment between cybersecurity risk and audit priority. However, publicly traded organisations show a wider gap. The public sector also assigns cybersecurity a lower audit priority than its identified risk level.
These differences should prompt boards and executives to examine whether audit attention reflects the organisation’s current exposure.
Risk profiles are changing faster than traditional planning cycles in some areas. Boards need to identify where coverage is thin and understand why these gaps exist. They must also assess whether internal audit has the skills and resources to respond.
Closing the assurance gap
Geopolitical and macroeconomic uncertainty is another area where audit attention appears to be lagging. More than a third of respondents ranked it among their five biggest risks, while only 15% placed it among their top five audit priorities.
The report points to the need for more agile audit planning as risk conditions change, supported by the specialist skills and resources needed to provide assurance over emerging areas. It also calls for closer coordination between internal audit, risk management, and other assurance providers when organisations assess where their greatest exposures lie.
These concerns are also reflected in the programme for IIA South Africa’s Annual National Conference, taking place from 23 to 25 November 2026 under the theme Reframe Resilience: Assurance in the Age of Risk Convergence. Discussions on AI governance and the changing role of internal auditors will sit alongside sessions on cybersecurity and combined assurance.