Cyber security and data security are the top risks facing organisations, with more than eight in 10 respondents identifying it as a leading threat, according to a survey of nearly 900 Chief Internal Auditors across the UK and Europe conducted by the Chartered Institute of Internal Auditors (Chartered IIA). It is also the risk area that internal audit teams are spending the most time and effort auditing.

Human capital, diversity and talent management retained its position as the second largest threat to organisations in 2026 – with almost half (48%) ranking it a top five risk. Fears of deskilling because of AI, and an inability to attract and retain the right skills to combat evolving threats, were major concerns.

Digital disruption, new technology and AI continue to be one of the fastest-growing risks, moving from fourth place last year to third place this year, with 47% of respondents ranking it a top risk.

High profile cyber attacks

A recent wave of high-profile cyber attacks targeting major UK businesses – including a cyber breach that affected systems at Heathrow Airport this weekend and attacks at retailers including M&S, the Co-Op and Harrods – has underscored the urgent need for stronger cyber resilience. 

M&S has estimated losses of £300m in operating profits, while a cyber attack at the UK’s biggest carmaker Jaguar Land Rover forced it to shut its factories for weeks, triggering a ripple effect that had a devastating impact on smaller businesses throughout its supply chain. The automotive company, which has plants in Solihull, Wolverhampton and Merseyside, had been unable to make any cars this month.

Attacks powered by advances in AI

The Chartered IIA says the recent attacks raise serious questions about whether organisations are taking the threat as seriously as they should. Notably, the research also reveals that organisations are not only facing more frequent attacks, but these incidents are becoming increasingly severe, sophisticated and often powered by advances in artificial intelligence (AI).

Macroeconomic and geopolitical uncertainty ranked in joint fourth place for 2026, together with changes in laws and regulations. Chief internal auditors who took part in the research agreed that the threat permeated every other risk category, underscoring the interconnected and complex risk landscape organisations now face.

With geopolitical tensions on the rise, the UK’s National Cyber Security Centre (NCSC) has issued stark warnings about the “enduring and significant” threat to the UK’s critical infrastructure from hostile states such as China, Iran, North Korea and Russia.

This year’s Risk in Focus 2026 report was produced by the Chartered IIA in partnership with 13 other European Institutes of Internal Auditors and the European Confederation of Institutes of Internal Auditing (ECIIA).

The role of internal audit

The Chartered IIA is urging boards and senior management to harness the power, experience and expertise of their internal audit teams to independently assess and strengthen the effectiveness of their cyber controls and risk management. Where weaknesses are identified, internal audit can play a vital role in recommending improvements to protect businesses from these fast-evolving threats. 

Anne Kiem OBE, Chief Executive of the Chartered IIA, says: “The recent wave of cyber attacks on major UK businesses is a stark reminder that cyber security must remain at the top of every board’s agenda. 

“Internal audit is uniquely positioned to provide independent assurance for boards that cyber and digital controls are robust and effective, helping organisations to build resilience and protect their bottom lines.”

Ian Pay, ICAEW’s Head of Data Analytics and Tech, says: “That cyber security continues to top CIIA's risk rankings should be no surprise given the spate of headline-grabbing, highly disruptive incidents in recent months.” 

Investment in cyber resilience

ICAEW's Evolution of Mid Tier Accountancy Firms research published earlier this year highlighted the value being placed on investment in cyber resilience and in accountants and internal auditors being aligned on the issue. 

As attacks increasingly have far-reaching implications across entire supply chains everyone must play their part in reducing the risk, Pay adds. “Individuals should take personal responsibility for their own cyber hygiene, and it is incumbent on organisations to provide regular training for their staff to spot potential incidents and have the systems and processes in place to minimise the impact of any cyber attack.”