Embedding the IIA Topical Requirement on cyber security
ArticleWhat the IIA topical requirement covers, when it applies, and the practical steps internal audit functions need to take to meet the requirements.
By: Jacky Griffiths
06 Apr 20264 min read

We believe there are two key points to consider when looking at culture and its role in supporting your organisation deliver against the Code's requirements:
1 assessing whether your culture is an enable to good governance as outlined in the Code and if not, building a culture so that it supports your organisation in understanding and enables compliance with the new requirements
2 ensuring the culture is fully embedded across your organisation, with no unhelpful sub-cultures to ensure consistency and alignment, reducing risk
So, what's the difference between just implementing requirements of the Code and building compliance into your culture?
Building a culture is challenging and needs focus and energy, but it can make all the difference to both governance and to the achievement of the organisation strategy. Building and maintaining and active and embedded culture is a longer lasting and more robust method of ensuring compliance.
Both tasks require a clear plan, an understanding of what's needed, the goal your organisation wants to achieve, and how you measure success. But building a culture also needs to be clearly linked to your organisation's strategy itself, where good governance that aligns to your organisation’s goals and values is key.
Once this is done, there are then five key elements to consider:
1 Leadership and accountability
Leadership needs to take both demonstrable and personal accountability for your desired culture. This involves communicating regularly and - crucially - as an ongoing part of how leaders engage with employees.
Leaders should act as role models with the required behaviours, recognise these in others and ensure consistent messaging across the organisation.
2 Setting objectives
Organisational key objectives should be agreed, communicated and measurement should be considered in performance reviews and linked into remuneration and total pay, including both fixed and variable.
3 Talent and retention
Talent identification and management across the organisation and succession planning, should be completed as a minimum for executive management roles and business critical roles.
The requirements need to be incorporated into learning programmes, including induction. And promotion decisions need to assess the understanding and role modelling of the requirements.
4 Embedding into core business activity
Consider how all this reaches across your organisation. For example:
5 Communication
Finally, both internal and external communications should be aligned and individual teams need to incorporate culture and values into your corporate website, intranet, and other communications.
If you have a fully embedded culture, you'll be familiar with the need for the routes outlined above and will understand the consistency and alignment that it brings.
For those that still have some of this journey to go, using the need to embed the requirements into your overall desired culture more fully can have benefits that go significantly wider than the Code requirements.
For support with embedding the Code compliance into your culture, get in touch with our experts.
![]()
Get the latest insights, events and guidance, straight to your inbox.
What the IIA topical requirement covers, when it applies, and the practical steps internal audit functions need to take to meet the requirements.
Assurance mapping gives firms a consolidated view of control activities, helping boards meet Provision 29 requirements in the UK Corporate Governance Code.
Emma Young provides a summary on what organisations need to consider in 2026 to meet provision 29 requirements for the first year reporting.