Cybersecurity has emerged as the leading organisational risk across Africa, but new research from The Institute of Internal Auditors (IIA) shows that recognising a risk does not always translate into sufficient audit coverage.
The organisation’s 2026/2027 Africa Risk in Focus report found that 73% of African respondents ranked cybersecurity among their organisation’s five biggest risks – up 11 percentage points year-on-year, the largest increase recorded across the risk areas surveyed. Cybersecurity was also the highest internal audit priority at 67%.
The findings form part of a global study of 3 285 chief audit executives and directors across 132 countries and locations. The Africa analysis is based on 816 of those responses, from 34 African countries and locations, and was supplemented by three roundtables with 18 participants and three in-depth interviews.
“Cybersecurity is clearly receiving attention, but boards should also be asking how much assurance they are actually getting over it,” says Innocent Hlungwani, acting CEO of The IIA South Africa. “A risk can be recognised and included in the audit plan without being fully covered. That is where organisations need to look more closely.”
The gap becomes clearer when the findings are examined in terms of actual audit coverage. Despite cybersecurity being the leading risk and audit priority, fewer than a quarter of respondents reported full internal audit coverage. Digital disruption also remains a concern, with audit attention and coverage falling behind its perceived risk.
Audit priorities vary across sectors
The sector breakdown also reveals differences in how organisations are responding. Financial services respondents show the strongest alignment between cybersecurity risk and audit priority, while the gap is wider among publicly traded organisations. The public sector also records lower audit priority than the level of cybersecurity risk identified by respondents.
Hlungwani says these differences should prompt boards and executives to examine whether audit attention reflects the organisation’s current exposure.
“Risk profiles are changing faster than traditional planning cycles in some areas,” Hlungwani says. “Boards need to understand where coverage is thin, why that gap exists, and whether internal audit has the skills and resources to respond.”
Geopolitical and macroeconomic uncertainty is another area where audit attention appears to be lagging. More than a third of respondents ranked it among their five biggest risks, while only 15% placed it among their top five audit priorities.
The report points to the need for more agile audit planning as risk conditions change, supported by the specialist skills and resources needed to provide assurance over emerging areas.
It also calls for closer coordination between internal audit, risk management, and other assurance providers when organisations assess where their greatest exposures lie.
These concerns are also reflected in the programme for IIA South Africa’s Annual National Conference, taking place from 23 to 25 November 2026 under the theme Reframe Resilience: Assurance in the Age of Risk Convergence. Discussions on AI governance and the changing role of internal auditors will sit alongside sessions on cybersecurity and combined assurance.