IIA topical requirements assessed row by row, with the workpaper behind every “covered”, before fieldwork starts
Each requirement assessed before fieldwork, each gap closed before the assessor finds it.
See one case, screen by screen ↓The IIA’s Topical Requirements are mandatory baselines for auditing specific risks: Cybersecurity from 5 Feb 2026 and Third-Party from 15 Sep 2026, with Organizational Behavior following on 15 Dec 2026. IIA Topical Requirements, the solution, maps each audit engagement to the requirement it falls under with cited proof: seven agents scope the plan, read the workpapers behind every “covered”, draft test steps or cited exclusions, and sample the file like the assessor, while the engagement lead decides and the CAE signs.
How to choose AI solutions for back-office and enterprise work →
Updated
Since 5 February 2026 for cybersecurity and 15 September 2026 for third parties, every assurance engagement on those topics has to show that each IIA Topical Requirement was assessed for applicability, and justify every exclusion. The external quality assessment checks that file through Standards 13.2 and 13.3. Today the mapping is a spreadsheet copied from last year’s audit program: an auditor ticks requirements against program steps, and nobody re-reads the workpaper behind each tick.
The risk sits in the ticks. A step mapped to offboarding last cycle turns out to test changes to supplier bank details, with no supplier exits in the sample. A cyber audit done in April, before anyone kept a structured record, has no applicability decision for five requirements. A contractor with standing remote access turns up in the middle of a plant audit nobody scoped for the requirement. Found before fieldwork, each of these costs a few hours of testing; found by the assessor, it can count toward a finding of nonconformance with the Standards.
Estimated split for one engagement against the 21 rows of the Third-Party requirement, by hand (about 20 minutes a row, plus rationales and review) and with the solution, where the lead reviews the agents’ proposals.
Seven agents scope the plan, map and read the workpapers, draft the missing tests and sample like the assessor; the lead decides, the CAE signs.
Kestrel & Vane Group’s vendor management audit — 41 critical suppliers, €612M of annual spend, a 220-hour budget — starts fieldwork on 2 November, after the Third-Party requirement took effect. Here is how Tomás Ferreira works through it with the agents, screen by screen, in the working solution.
Tomás opens to what the agents found overnight, each line cited. The coverage verifier says the vendor audit is ready for him: 17 of 21 requirements covered, 2 justified as not applicable, one claim that does not hold and exit plans only partly tested. His “Needs you” list holds 7 decisions, those on the vendor audit due 26 Oct, and the external quality assessment is 147 days away.
“Your agents — every statement cited · nothing changes without you.”
The scoping agent read the 26 engagements in the 2026–27 plan: 9 fall under a requirement — 7 required, 1 found in fieldwork, 1 advisory. The vendor audit triggers Third-Party at 97% confidence. In the plant maintenance audit, a fieldwork note shows an outside contractor with standing remote access to plant systems at Brno and Lyon, so both requirements may now apply; Arjun Mehta, the IT audit manager, decides. The privacy review is advisory, where the requirement is recommended, not required.
The scoping agent never closes a scope on its own and never treats an advisory engagement as mandatory.
The engagement opens as a checklist: 21 requirements grouped under governance, risk management and control processes, each with its coverage state, the steps and workpapers that prove it, and the verifier’s reading and confidence. Tomás accepts the scope with the reason code “Agree with the scoping agent”. The screen also says plainly that the workpapers are as at 14 Oct 18:00 because the 05:10 sync failed, with a Retry beside it.
“Workpapers as at 14 Oct 18:00 · sync failed 05:10 · Retry”
The mapper links 34 program steps to 21 requirements; last cycle’s table claimed 19 covered and 2 not applicable. The verifier reads the 12 workpapers: 17 claims hold, TP-C7 is overturned and TP-R5 is only partial. TP-R3, subcontractors inspected for 5 of 41 suppliers, sits at 78%, below the 80% threshold, so the verifier asks Tomás. The gap agent drafts 3 steps and 2 rationales, and the run ends waiting for Tomás: nothing changes in the program until the lead accepts.
Coverage verifier: “TP-R3: subcontractors checked for 5 of 41 — I am at 78%, so you decide.”
Tomás asks in plain words beside the checklist. The verifier answers with its sources: step 4.3 was mapped to offboarding in the 2024 program, but WP 4.3 tests 40 changes to supplier bank details and says “no supplier exits were in the sample”. Nothing tests removing a departed supplier’s access or getting Group data back, which the contract requires within 5 business days and 30 days.
Every answer carries numbered citations that open the passage it came from.
The requirement page shows the two passages the verifier read, highlighted: the step’s wording, “Review vendor master changes”, and the workpaper’s result — 40 bank-detail changes tested, 39 compliant, 1 approved late. Where the mapper and the verifier disagree, both positions sit side by side, the mapper saying covered and the verifier not covered at 91%, and a person rules.
The verifier never marks a row “covered” without a quoted passage.
For offboarding: step 6.4 takes the 26 critical-supplier contracts ended since 1 Oct 2025 and confirms all 214 linked supplier accounts were disabled in the identity system within 5 business days (4 h); step 6.5 obtains the return or destruction certificate for the 9 contracts that held Group personal data (2 h). For exit plans, step 3.5 inspects the plans of the 8 suppliers rated “hard to replace” (4 h). TP-G3 and TP-C6 get cited rationales: both were tested in issued engagements.
The gap agent never adds a step to the program, and never cites an engagement that is not issued.
Tomás accepts steps 6.4 and 6.5 — 6 hours, owner Nadia Kowalczyk — with the reason code “Gap closed before fieldwork”, and the conformance clerk writes them back to the audit program. He then decides the remaining four in one recorded decision: TP-R3 confirmed, step 3.5 added, both rationales accepted. All 21 requirements are assessed — 19 covered, 2 justified — and the budget moves from 220 to 230 hours.
“Each item goes on the record separately, with this reason.”
The conformance clerk assembles the record: applicability and scope, each requirement with its proof or rationale, the added procedures and the exclusions. Sofie Lindgren, the QAIP lead, reviews: “Both exclusions cite issued reports; the new steps close C7 and R5.” Catherine Oduya, the chief audit executive, signs with the reason code “Conforms: every requirement assessed”, and the record is filed with its passages and trail for the assessor.
Signature meaning: “IA-26-031 conforms with the Third-Party Topical Requirement.”
The assessor’s-eye agent samples five engagements the way the external assessor would — newest, largest and one from each requirement — against Standards 13.2 and 13.3. With the vendor audit signed, 3 of 5 would pass today. Email security, completed in April 2026, has 5 rows undecided; the agent drafts a retrospective file note for Catherine to sign, and the engagement itself stays closed.
The assessor’s-eye agent advises only; it never edits a closed engagement.
The same engagement, seen by five of the people who carry it — what the weeks before fieldwork looked like, and what they look like now.
Seven agents scope the plan, map and read the workpapers, draft the missing tests and sample like the assessor; the lead decides, the CAE signs.
Reads the audit plan, planning memos and fieldwork notes and decides which requirement each engagement triggers — mandatory for assurance after the effective date, recommended for advisory work — with the reason and its sources.
Links every audit step and workpaper to each requirement it may address, using the program, the workpaper index, last cycle’s mapping and the NIST CSF 2.0 crosswalk for cyber rows.
Reads each linked step and workpaper and decides covered, partial or not covered, quoting the passage it relied on.
Drafts test steps for each gap with population, sample, source system, owner and hours, and a cited rationale for each exclusion.
Assembles the conformance record and the audit committee paragraph, and writes accepted steps back to the audit program.
Samples engagements the way the external assessor would, through Standards 13.2 and 13.3, asks each file the assessor’s question and drafts the fix.
Keeps the Topical Requirements and their guidance current as loaded, breaks each into plain-words rows for the QAIP lead to approve, and reports which engagements a new or revised requirement touches.
Lead accepts scope, gaps and reasons; QAIP lead reviews; CAE signs. The agents propose; a named person decides.
The conversation sits beside the checklist. Answers cite the passage; instructions come back as proposals the lead accepts.
Why isn’t offboarding covered?
Step 4.3 was mapped to offboarding in the 2024 program, but WP 4.3 tests 40 changes to supplier bank details and says “no supplier exits were in the sample”. Nothing tests removing a departed supplier’s access or getting Group data back — which the contract requires within 5 business days and 30 days. So I marked TP-C7 not covered. The gap agent drafted steps 6.4 and 6.5 (+6 hours).
Make step 6.4 a sample of 15
I can cut step 6.4 to a sample of 15 of the 26 ended contracts, chosen to include all 9 with personal data. It saves 1 hour (4 → 3). Note: the contract clause applies to every exit, so the full population is stronger evidence for the assessor. Apply the change?
Which requirements are excluded, and why?
Two, each with a cited rationale for you to accept: TP-G3 board oversight — tested in IA-26-002 Enterprise risk governance, Satisfactory; TP-C6 payments against contract terms — tested in IA-26-024 Accounts payable, step 5.2. The IIA expects a documented reason for every exclusion.
Why does plant maintenance trigger it now?
Rhys Pemberton’s fieldwork note of 13 Oct: an outside contractor, Quillmont Engineering Services, has standing remote access to plant systems at Brno and Lyon. A requirement applies when its topic is “identified while performing an engagement”. I propose applying TP-C3, TP-C5, TP-C7, CY-C4 and CY-C5, and documenting the other 32 as outside this engagement’s scope. Arjun decides.
13 screens from the working solution, on its sample data. Pick one to see it large.
The rules the agents work to are settings the QAIP lead owns, and every change is on the history.
| Setting | Default | Choose from |
|---|---|---|
| Verifier confidence threshold | 80% | Step up or down; below it the verifier asks the lead instead of concluding |
| Decide before fieldwork | 5 working days | Step up or down; scope, gaps and rationales are due this many working days before fieldwork |
| Readiness sample | 5 engagements | Step up or down; how many engagements the assessor’s-eye agent samples |
| Hours a lead may add | 24 h | Step up or down; above it the CAE approves the added hours |
| Run the agents again when a workpaper changes | On | On · Off — the verifier re-reads only the rows that cite it |
| Advisory engagements | Recommended, not required | Per the IIA; the CAE decides |
| Who may sign conformance records | Chief Audit Executive | Permissions by role: engagement lead, CAE, IT audit manager, QAIP lead, senior auditor, administrator |
| Notifications | Decisions, SLAs, sign-off, new requirements, failed syncs | Each on or off · a weekly digest, Mondays 08:00, off by default |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample audit plan · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (Gartner, 2026 Audit Plan Hot Spots — 96% of chief audit executives plan cybersecurity assurance, 48% highly confident they can provide it). Effective dates, applicability and documentation rules from the IIA’s Topical Requirements pages and its Cybersecurity Topical Requirement questions and answers; the 21 Third-Party and 16 Cybersecurity rows are the working solution’s plain-words breakdown, not the IIA’s own numbering. People, the company, engagements and suppliers named on this page are fictional — characters and sample data in the working solution.
The IIA’s Topical Requirements are mandatory baselines for auditing specific risks: Cybersecurity from 5 Feb 2026 and Third-Party from 15 Sep 2026, with Organizational Behavior following on 15 Dec 2026. IIA Topical Requirements, the solution, maps each audit engagement to the requirement it falls under with cited proof: seven agents scope the plan, read the workpapers behind every “covered”, draft test steps or cited exclusions, and sample the file like the assessor, while the engagement lead decides and the CAE signs.
When an assurance engagement covers the topic — in the plan, found during fieldwork or on request — after the requirement’s effective date; for advisory work it is recommended, not required. The scoping agent reads the plan, planning memos and fieldwork notes, marks each engagement required, found in fieldwork, advisory or not required, and cites why. A person accepts every scoping decision.
The coverage mapper links each program step and workpaper to the requirements it may address. The coverage verifier then reads each workpaper and quotes the passage it relied on, overturning claims that do not hold — in the sample engagement, 2 of 19 “covered” claims. Below the confidence threshold it asks the lead instead of concluding.
The gap agent drafts ready-to-run test steps with population, sample, source system, owner and hours, or a cited rationale when the requirement is covered elsewhere or does not apply. The lead accepts, edits or rejects each one with a reason, and accepted steps are written back to the audit program.
Yes. The library holds the Third-Party and Cybersecurity requirements in plain-words rows, with the next requirements, such as Organizational Behavior, loaded ahead of their effective dates. Cyber rows carry a NIST CSF 2.0 reference, and an engagement such as cloud hosting provider oversight is checked against both.
Yes. The assessor’s-eye agent samples engagements as the assessor would and checks each against Standards 13.2 and 13.3, months before the visit. Where an older file lacks applicability decisions it drafts a retrospective file note for the CAE to sign, and the evidence pack — records, rationales, source passages and the history — exports for the assessor.
Yes. The agents propose and never add a step, exclude a requirement, edit a closed engagement, sign or send to the audit committee. The engagement lead accepts scope, gaps and rationales, the IT audit manager rules on topics found in fieldwork, the QAIP lead reviews and only the CAE signs, each with a reason on the history.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your audit plan, programs, workpapers and the IIA texts you use — and it goes live once every quality gate has passed. We will walk you through it on one of your own engagements first.
Every sample cited, re-performed and signed before your auditor asks.
1-min demoAudit Evidence CollectionEvidence checked before the auditor sees it, and the request list closed before fieldwork.
1-min demoContinuous Controls MonitoringControl failures found in a day, not at year-end, and every fix proved by a re-test.
1-min demoWe’ll run IIA Topical Requirements on one of your own engagements, its program and its workpapers.