IIA Organizational Behaviour Topical Requirements

When Good Controls Meet Human Behaviour

Strong governance, effective controls, and well-designed policies do not always produce the desired outcomes. Ultimately, organizational success depends on how people make decisions, respond to pressure, raise concerns, and hold one another accountable.

The IIA's Organizational Behaviour Topical Requirement represents a significant shift in how organizations think about governance, risk, and assurance. It moves organizational behaviour from a largely qualitative discussion to an area that may require formal oversight, risk management, and internal audit attention. The focus is not on attitudes or intentions, but on observable behaviours and whether organizational systems are effectively reinforcing the outcomes they are designed to achieve.

For directors, this raises important questions about oversight, accountability, risk culture, and the behavioural drivers that can influence organizational performance and control effectiveness. For internal auditors, it presents new expectations around assessing behavioural risk, gathering defensible evidence, and evaluating whether governance, risk management, and control processes are influencing behaviour as intended.

Join Heiky Au and Jaylene Cousins as they explore:

· What the Organizational Behaviour Topical Requirement is and why it matters

· How organizational behaviour is becoming an increasingly important governance and risk consideration

· Where behavioural risk commonly emerges, including incentives, accountability, decision-making, and speak-up environments

· How boards, management, and internal audit each contribute to the governance of organizational

· Practical examples of how behaviour can strengthen or undermine organizational objectives, risk management practices, and control effectiveness

Drawing on practical examples and emerging industry practices, this session will provide directors and internal auditors with a common understanding of organizational behaviour, why it matters, and how the new requirements may begin to surface within governance discussions, audit plans, and assurance activities.

Because understanding how people actually behave is just as important as understanding the controls designed to govern them.