Internal auditors name geopolitical risk nearly four times as often as they plan to audit it

Set each risk rating beside the share of respondents who put the same item in their top five for audit time and effort. Cybersecurity's gap is five points, 80 against 75 ^[4][6][1]. Digital disruption's is sixteen, 58 against 42 ^[2][5][2]. Geopolitical and macroeconomic uncertainty runs 48 against 13, a gap of 35 points ^[7][3]. In North America that gap widens to 37, where 43% call it a top-five risk and 6% a top-five audit priority ^[8][4], while the same region rates digital disruption highest in the world at 69% ^[3].

One line runs the other way. Financial and liquidity risk is a top-five audit priority for 49% of respondents and a top-five risk for 34%, so its audit attention sits 15 points above its rating ^[9][5].

None of these figures is money. Each is the share of more than 3,000 practitioners across 132 countries naming an item in a top five ^[1]. The ten points digital disruption gained in audit priority means more plans now list it, not that a measured number of hours or dollars moved ^[5].

The Internal Audit Foundation's own explanation for the thin geopolitical coverage is that the work happens under other names. Political risk, the research says, is likely addressed through engagements for supply chain, financial and liquidity health, business resilience, regulatory compliance and market changes ^[10].

Anthony Pugliese is President and CEO of The Institute of Internal Auditors ^[12]. He said: "The challenge for organizations is no longer simply identifying individual risks, but understanding how they intersect, how quickly their impact can spread across the enterprise, and whether governance, internal audit and decision-making are keeping pace." ^[11]

This year's survey asked for the first time how mature risk governance is and whether internal audit coverage is adequate. It found some of the fastest-changing risks among the least mature and least covered areas ^[13]. Digital disruption ranked among the lowest on both measures ^[14]. The research treats the 58-against-42 spread as a reason for organizations to adapt skills, governance structures and evaluation criteria ^[15].

In my view the 16-point digital disruption gap is where next year's audit hiring gets decided. The same respondents who moved it onto their plans rated its governance among the least mature ^[14]. The competing reading is that geopolitics never becomes its own audit line at all. The research already has digital disruption running through supply chain and third-party risk, fraud, human capital, regulatory obligations and market competition ^[16], and a risk that turns up inside five other engagements is being covered without a label. What would prove me wrong: digital disruption's audit priority climbing another ten points next year while governance maturity stays flat. That would mean plans are being relabelled and not staffed.