Between September and December, every internal audit function closes next year's plan. It is the most expensive decision of the cycle, because it allocates the one thing that cannot be topped up halfway through the year, which is the team's hours. Risk in Focus 2027, the survey the European institutes of internal auditors publish every September, arrives exactly for that conversation.
This year's edition gathers 797 completed responses from chief audit executives, through joint work by thirteen European institutes covering fourteen countries, Spain among them. The headline is no surprise. Cybersecurity and data security are the top risk, with 86% of CAEs placing them among their top five. Digital disruption, new technology and AI climb from third place to second, with 52%.
The interesting part sits in another column. The report does not only ask what worries them, it also asks how much time internal audit devotes to each area. And the two lists do not match.
The uncomfortable figure
Organisational governance and corporate reporting are chosen as a top risk by 13% of CAEs, seven points fewer than last year. That is near the bottom of the table. And they still receive the fourth-highest level of audit effort in the whole plan.
The reverse happens too. Macroeconomic and geopolitical uncertainty climbs to third place, yet risk maturity and audit effort stay low. Human capital falls from second to fifth, at 39%, precisely when AI is redefining the shape of jobs.
The plan does not go wrong by picking the wrong risks. It goes wrong by splitting the hours the way it did last year.
Before drawing conclusions
The report itself asks readers to treat that mismatch carefully, and it is right. Governance is both a risk category and the capability through which every other risk is identified, assessed and managed. Receiving hours is not an error in itself. The question is a different one. If those hours are still there out of inertia, committee expectation or an inherited rotation cycle, they are coming from somewhere else.
Cybersecurity shows the same thing in reverse. It holds first place and high coverage, but the report warns that the coverage may be driven by regulation and by what the board expects rather than by this year's actual risk. High coverage and well-calibrated coverage are not the same thing.
Three questions for the plan
- Where the two lists disagree. Put the risk ranking and the split of hours in the same table. Every row where they diverge is a conversation worth having before the plan is signed, not in March.
- What holds up each large block of hours. If an area has carried the same allocation for three cycles, the reason has to survive being said out loud. Control maturity, a regulatory requirement or risk appetite are reasons. Habit is not.
- What happens if the plan changes in March. Many CAEs have dropped the rigid annual plan and run risk assessments more often. If yours cannot move one audit without being rebuilt, that is the finding.
The 2027 plan will close on the same information everyone else has. The difference is whether the split of hours answers this year's assessment or last year's. That question is only answered by looking at the risk universe behind the plan.
