The Basics:
- The Institute of Internal Auditors (IIA) has established the Organizational Behavior Topical Requirement, which defines expectations for documenting organizational behavior, i.e., the observable choices employees make in doing their jobs and how they work with others.
- Organizational behavior can be audited because it focuses on tangible actions that leave evidence, unlike the assessment of organizational culture, which may not be clearly defined and is more subjective.
- The Organizational Behavior Topical Requirement becomes effective Dec. 15, 2026. It is the third in a series of six Topical Requirements that are mandatory components of the International Professional Practices Framework.
______________________________________________________________________________________________
What Your Organization Needs to Know
Inadequate organizational behavior may be the root cause of many organizational failures. The Organizational Behavior Topical Requirement provides a consistent, comprehensive approach to assessing design and implementation of governance, risk management, and control processes related to organizational behavior.
Internal Auditors should document overall coverage of the Organizational Behavior Topical Requirement and incorporate the relevant areas within individual audits. Organizational behavior controls help mitigate the risk that behavior is misaligned with strategic objectives.
Why did the IIA create the Organizational Behavior Topical Requirement?
The IIA introduced this requirement because employee behavior can significantly contribute to control failures. The Organizational Behavior Topical Requirement gives internal auditors a clear basis for identifying behavioral warning signs and assessing whether governance and controls reinforce organizational expectations and strategic objectives.
What Requirements are in IIA’s Organizational Behavior Topical Requirement?
The IIA’s Organizational Behavior Topical Requirement contains the following 15 requirements divided among three pillars:
Pillars and Purviews
While the three pillars are interconnected, each plays a distinct role in identifying, managing, and mitigating behavioral risk:
Governance: Focuses on the role of the board and senior management related to defined oversight and accountability, regular review of behavioral risk indicators and related policies, and behavior embedded in executive performance and reporting.
Risk Management: A primary role of the second line of defense: those in human resource, risk, and compliance functions. The controls under risk management relate to the use of indicators like survey data trends, whistleblowers, and escalation protocols, as well as response mechanisms for misaligned behavior
Control Activities: Encompasses value-based hiring and onboarding, speak-up channels, training, leadership messaging, incentives and disincentives design, and remediation processes.
How to Implement the Organizational Behavior Requirement
Organizations should document all components of the Organizational Behavior Topical Requirement in a single template, such as the one provided in Appendix C of the IIA’s Organizational Behavior Topical Requirement User Guide. Doing so ensures that no component is missed and that those in need of remediation are identified. During applicable internal audit engagements, the components can likewise be documented (and those in need of remediation) within the engagement workpapers.
Remember: Not all requirements may be applicable for each engagement. For full coverage, it may be best to first assess the entire Topical Requirement before selecting the relevant components for individual engagements.
For individual engagements, consider the following approach:
Need Help Navigating the Requirement?
Rehmann’s Risk Advisory team can help organizations translate the IIA’s Organizational Behavior Topical Requirement into a practical, scalable internal audit approach. Whether your organization needs support with gap assessments, audit methodology updates, engagement scoping, documentation templates, or internal audit execution, we can help you evaluate organizational behavior risk with clarity and confidence. Learn more or reach out here.
Frequently Asked Questions
Q: How should audit teams prepare for the implementation before December 2026?
A: Audit teams can review the IIA’s Operational Behavior Topical Requirement User Guide and map existing processes to the baseline criteria with supporting documentation.
Q: What if processes are not currently in place to meet the 15 requirements?
A: Audit teams should create a remediation plan to establish those requirements including who will take ownership of the implementation, the timing to complete the task, and who will review if the process is effective, one established.
Q: Why are controls around organizational behavior needed?
A: Behavior is a component in most organizational failures and starts with leadership’s tone at the top. Employees may not understand why it is important to speak up if something does not seem right and incentives may push employees to make decisions that are unethical. It is important to define how behavior is observed and that unacceptable behavior has consequences.
Q: Where can I find examples of how to implement the 15 requirements?
A: The IIA published examples of how to address reach of the 15 requirements in the Considerations section of the User Guide for the Organizational Behavior Topical Requirement.