Technology risk trends: Your key priorities for 2026

Almost every aspect of business is being disrupted by AI, and cyber security is no exception. As the integration of AI into security tooling is accelerating the assessments of threats, this fast-track capability is also being used by threat actors. Many businesses aren’t only seeing an increasing pace and quantity of cyber-attacks, but a greatly increased sophistication as the barrier to entry for more advanced techniques is reduced by AI.  

The increasingly complex combination of on-premise solutions, Cloud services, and software-as-a-service (SaaS) products makes controls over user identity difficult to manage. This often includes access by third parties who are typically outside the direct influence of other mitigating controls, increasing the associated risk.  

In 2025, the IIA published it's Topical requirements for cyber security, defining the mandatory requirements that must be considered as part of the annual audit planning process and when scoping any cyber security assurance activities. These take effect from February 2026.

Internal audit and risk functions have a growing range of cyber security threats to address to protect data, avoid business disruption, and protect against ransomware. 

The key actions to consider for 2026 include:  

• receiving regular assurance from internal audits on cyber transformation plans and focus from risk functions to ensure benefits are delivered, while also managing risks of tooling misalignment, rising costs, and stifling the agility of the wider business with prohibitive controls. The very public nature of recent cyber-attacks has led to many organisations accelerating their cyber transformation plans to enhance their defences
• focussing on Identity access management (IAM) as a key area, with cases of SIM-swapping attacks undermining traditional two factor authentication controls, and social engineering of IT helpdesks giving attackers highly privileged access. These are topics internal audit and risk/control functions can add real value to if the right approach is taken 
• focussing on the assessments and assurance management undertaken for attackers compromising organisations via third parties, And identifying those third parties with high levels of IT access and gaining adequate assurance over their control environment is no longer a luxury and is becoming a necessary step to manage this risk
• Where internal audit functions subscribe to the IIA Global Standards, they must demonstrate that they have fully considered the topical requirements for cyber security in defining their audit universe and 2026 audit plan. This will impact audit planning over several years, as it covers a broad range of cyber risk areas, from governance and risk management to talent management and more typical technical controls over networks and endpoints.

In October 2025, the Bank of England, PRA and FCA jointly published 'Effective practices: Cyber response and recovery capabilities' outlining observed practices across systemic firms and market infrastructures. This outlined the need for defining impact tolerances beyond outage duration (for example, transaction values /volumes and numbers of end-users); implementing alternative solutions and immutable backups; ensuring robust crisis communication plans; and preparing for tertiary site recovery. It also stresses managing third-party resilience to equivalent standards and promoting collective industry collaboration to enhance sector-wide cyber resilience. 

Regulators also expect firms to demonstrate board-level engagement and scenario testing for severe but plausible cyber events. The FCA has indicated that failure to meet these expectations could lead to enforcement action or supervisory intervention from 2026.

The landscape became significantly more complex throughout 2025. With most organisations now deploying a mix of AWS, Azure, and GCP, we’re seeing a proliferation of multi-cloud environments. This created a number of governance ‘seams’ which in turn are leading to organisations developing a number of security blind spots when it comes to the cloud environments. Identity management, data protection, and security controls are often inconsistently deployed, configured, and managed across multiple cloud platforms. 

Over the last year, there has also been a rush to deploy Generative AI solutions – many of which are hosted on cloud platforms – introducing significant new data governance challenges and unpredictable cost risks. 

• In the Financial Services sector, new regulations (like the UK's SS6/24 and the EU's DORA) are now in force. These make firms legally accountable for the operational resilience of their Critical Third Parties (CTPs) – primarily their cloud providers. 

Against the backdrop of challenging economic conditions, the need to deliver value for money has never been higher. This has elevated FinOps from a simple IT task to a C-suite priority.

Internal audit and risk teams must shift their focus from simply reviewing a cloud provider’s SOC 2 report to result auditing their organisation's own responsibilities within the ‘shared responsibility model’. 

Key areas of focus should include: 

• assessing the consistency of security, identity management, and data protection controls across all CSPs they work with, with particular attention being given to points where platforms intersect (‘the seams’). 
• moving beyond traditional assessments of IT disaster recovery capabilities, rather focusing the operational resilience measures in place to mitigate “severe but plausible” scenarios – such as the failure of an entire Cloud service, CSP, or cloud region – to ensure the business keeps running when it matters most. 
• assessing the data governance and cost-containment controls specifically for new Gen AI projects to ensure proprietary data is protected, and usage is monitored
• integrating FinOps into audit plans, e.g., evaluate the effectiveness of cost governance, such as resource tagging, budgeting, and controls for de-provisioning unused assets, to ensure the cloud spend delivers actual business value. 

UK regulators have made cloud a supervisory priority. The PRA and FCA have designated major cloud providers as critical third parties (CTPs) under a new regime, meaning CSPs like AWS, Microsoft, and Google may face direct resilience testing when serving UK banks. Firms must notify regulators of material cloud arrangements and maintain exit plans. 

Under EU DORA, financial entities must ensure cloud outsourcers meet strict security and continuity standards. Institutions should treat cloud services with the same rigour as in-house IT – conducting robust risk assessments, ongoing monitoring, and securing contractual rights for audit and assurance. 

Organisations can exercise their ‘right to audit’ clause for improved oversight for CSPs.  However, these reviews can be complex, costly, and many organisations may not have the necessary capacity or specialist cloud assurance capabilities to undertake this work. As a result, many financial services organisations are considering a pooled assurance approach. This allows multiple organisations to gain assurance over a CSP, drawing on specialist resources to reduce costs and gain a high degree of comfort.

Digital regulation and compliance risks expanded rapidly across the UK and EU in 2025, affecting sectors beyond traditional financial services. The EU AI Act and the UK’s Data (Use and Access) Act introduce stricter obligations around AI governance, personal data use, and automated decision-making, with many provisions already in force and arriving in 2026. However, proposals to soften and delay the EU AI Act requirements are currently being debated by the EU Parliament.  

This marks a shift: organisations in retail, manufacturing, healthcare, and energy now face compliance demands previously reserved for financial service-regulated industries. These include risk assessments, transparency requirements, and human oversight for AI systems, especially those using personal data.  

The pace of change is accelerating, and many businesses are unprepared. Compliance is no longer optional – it’s becoming a market access requirement, with penalties for non-compliance reaching Euro 35 million or 7% of global turnover. Organisations must act now to embed AI risk frameworks and align with evolving UK and EU standards. 

Internal audit and risk teams should strengthen compliance monitoring, update controls, and align frameworks with evolving digital regulations. 

Areas of focus should include: 

• reviewing how the organisation is taking proactive steps to comply with proposed legal and regulatory requirements for the countries that it operates in
• assessing readiness for upcoming regulatory requirements, and compliance with existing obligations of the EU AI Act or similar
• auditing data flows to confirm lawful collection, processing, and retention of personal data
• monitoring regulatory developments to stay ahead of upcoming compliance deadlines
• updating risk frameworks to reflect digital-specific risks and regulatory expectations
• investing in digital skills and tools to audit and assess complex technologies like AI and cloud platforms
• engaging with legal and compliance teams to interpret and operationalise new digital regulations
• collaborating with IT and data teams to ensure alignment on controls and compliance. 

Financial services firms must navigate overlapping tech regulations. UK banks comply with GDPR/data protection rules and PRA/FCA operational resilience rules, including senior management systems and controls (SYSC) for IT risk management. Regulators increasingly use enforcement tools for digital failings - such as Section 166 reviews for poor data governance and fines for weak cyber security under Principle 2. Global institutions also face cross-border challenges, eg, ensuring trading apps meet the EU Digital Services Act and FCA conduct standards.

During 2025, we observed a growing trend in the expansion of the PMO remit, which has significant implications for internal audit and risk functions. 

Traditionally, internal audit teams have focused on assuring the achievement of timelines/milestones, risk management, and the integrity of functional and non-functional delivery. However, with PMOs now overseeing the delivery and measurement of value from major technology investments, internal auditors must broaden their scope to include the assessment of value realisation processes. This means understanding how benefits are defined, translated into functional and non-functional requirements, tracked, and reported, and ensuring that these processes are robust, transparent, and aligned with organisational objectives.  

Internal audit functions will need to develop new expertise to evaluate whether the PMO is effectively bridging the gap between technology delivery and business outcomes, and whether the methodologies used for benefits tracking are sound and resistant to manipulation or oversight.

To effectively assess the impact of the PMO in driving value, risk and internal audit functions should adapt their methodologies and frameworks. This includes: 

• aligning evaluation criteria with organisational objectives, which ensures that assessments are directly connected to the strategic goals and priorities of the business
• assessing PMO-specific performance indicators, such as benefits realisation, project delivery effectiveness, stakeholder satisfaction, and process improvements
• regularly review and update risk assessment techniques to capture emerging risks related to project and programme management. 
  This multifaceted approach empowers risk and internal audit teams to provide meaningful assurance and advisory support, ultimately enhancing the value delivered by the PMO.

There’s also the need to consider the governance structures, such as:

• the clarity of roles and responsibilities
• data quality in value tracking
• the regularity and accuracy of value reporting  
• oversight in delivering functionality and security by design.  

Furthermore, risk and internal audit should move towards a more consultative approach, offering insights and recommendations to strengthen the PMO’s processes while maintaining independence. By doing so, internal audit can provide assurance that the organisation’s technology investments are delivering the intended value, and identify areas for improvement in value realisation practices.

The FCA requires firms to show transformations deliver fair value under Consumer Duty, tracking benefits and outcomes throughout.

In 2025, firms submitted detailed value realisation reports during reviews, with VROs central to digital, pricing, and customer experience programmes. Regulators also scrutinise resilience after failures - nine UK banks logged 800+ hours of outages, Barclays paid £7.5 million, and Vocalink was fined £11.9 million for infrastructure weaknesses.  

Banks must notify the PRA/FCA of core system changes, and regulators may demand safeguards. The senior manager for technology (SMF24) is personally accountable for disruptions.

In the last year, zero trust security has transitioned from a strategic initiative to a baseline architecture for enterprise security. The rise in AI-driven ransomware, phishing-as-a-service, and insider threats has accelerated the adoption of zero trust as a key defensive measure, with organisations now treating it as the default security model.  

Recent developments include the widespread replacement of VPNs with Zero Trust Network Access (ZTNA) – which provides secure, identity-based access to applications without exposing the entire network – for remote and hybrid workforces, the integration of AI into real-time threat detection and adaptive access controls, and the expanded use of micro-segmentation to prevent lateral movements within networks.  

Organisations are also extending zero trust principles to cloud platforms, third-party ecosystems, and operational technology environments. As more organisations embrace the continuous adaptive trust model (a security model that continuously evaluates and adapts access based on real-time risk signals), the focus has shifted to dynamic, risk-based access decisions that strengthen security and reduce the impact of breaches in today’s evolving threat landscape. 

As zero trust security matures across organisations, risk and internal audit functions should play a critical role in ensuring its effectiveness, alignment with business objectives, and compliance requirements.  

Key actions include: 

• assessing zero trust maturity using frameworks such as NIST 800-207 or the Cybersecurity and Infrastructure Security Agency’s (CISA’s) zero trust maturity model, and mapping controls to compliance requirements (eg, GDPR, HIPAA, ISO 27001)
• ensuring senior management and the board embed zero trust principles into enterprise risk management strategies
• evaluating identity and access controls across users, devices, networks, applications, and data
• considering using real-time behavioural analytics to assess and strengthen privileged access management arrangements
• reviewing network segmentation, including micro-segmentation and ZTNA for remote users
• verifying continuous monitoring and logging across endpoints, cloud services, applications and user workarounds (eg, legacy network segments left open
• assessing third-party and supply chain access for alignment with zero trust principles.  

Although, zero trust is not mandated by name, frameworks such as the European Central Bank’s (ECB’s) cyber resilience expectations and US Federal Financial Institutions Examination Council (FFIEC) guidelines implicitly require these principles.

In 2025, large banks reported that regulators examined controls around insider access and network segmentation which are core zero trust elements. SWIFT’s customer security programme now includes controls aligned with zero trust, such as isolating payment systems 

The trend is for zero trust by design to protect critical assets like payment systems and customer data, supporting regulators’ push for continuous monitoring and strong access governance to prevent breaches that could threaten financial stability.