Analysis from the Central Bank of Cyprus links stronger internal audit to public trust

The Central Bank of Cyprus (CBC) has published a piece of analysis by its internal audit director Constantinos Trikoupis, arguing that new international requirements for internal audit can strengthen public trust in central banks and financial authorities, while also creating new demands for auditors.

Trikoupis said public trust is one of the most valuable assets of central banks and financial supervisory authorities, which operate under increased accountability and scrutiny from governing bodies, national and European institutions, financial markets and society.

“Trust is the operational currency of public institutions,” Trikoupis said, highlighting the importance of independent, thorough and comparable assurance across Europe’s interconnected financial system.

The analysis, published on the CBC Blog under the title ‘Strengthening Trust Through Topical Requirements: The Evolving Role of Internal Audit in European Financial Authorities‘, examined the growing role of internal audit in governance, transparency and risk management.

Trikoupis argued that internal audit helps maintain institutional trust by providing independent assurance over governance processes, risk management and control systems.

Where institutional weaknesses emerge, he said, scrutiny increasingly extends beyond management decisions to the effectiveness and credibility of the assurance provided by internal auditors.

He pointed to the Topical Requirements introduced by the Institute of Internal Auditors (IIA) as one response to the question of how internal audit can demonstrate that its assurance remains robust, consistent and professionally supported.

The issue was also discussed at a recent London forum attended by heads of internal audit functions from European central banks and financial supervisory authorities, where participants considered the implications of the IIA’s new requirements and their wider contribution to institutional credibility.

The Topical Requirements form a mandatory component of the IIA’s International Professional Practices Framework, applying when a particular subject is included within an audit engagement.

They establish minimum expectations for the issues that auditors should assess, while leaving professional judgement intact.

The wider framework consists of the Global Internal Audit Standards, the Topical Requirements and Global Guidance, with the standards setting out principles and expectations while the requirements specify minimum areas to be examined when auditing critical areas of risk.

Trikoupis said the requirements were introduced partly in response to concerns over differences in the scope and depth of internal audit work, as well as growing scrutiny from regulators, courts and external assessors.

Their importance is particularly pronounced in Europe, where assurance practices are frequently compared across different jurisdictions and institutions.

The first requirement, covering cybersecurity, came into force in February 2026.

Requirements covering third-party risk, organisational behaviour and organisational resilience have also been issued and are due to take effect on September 15, 2026, December 15, 2026, and April 30, 2027, respectively.

Trikoupis said the subjects reflected an increasingly complex risk environment facing public institutions and rising demand for specialised assurance.

Future requirements could potentially address anti-corruption and bribery, quantum computing, artificial intelligence and digital disruption, he added.

The changes could significantly affect internal audit functions, potentially resulting in fewer but more detailed audits focused on systemic risks.

Resource requirements could also rise, particularly where specialist expertise is needed or where audit functions work with external providers through co-sourcing arrangements.

At the same time, expectations surrounding the reporting of audit findings are changing, with greater emphasis being placed on preparedness, the maturity of governance systems and resilience rather than straightforward compliance assessments.

Trikoupis also stressed the importance of adequate documentation, particularly when auditors decide whether specific elements of a Topical Requirement should be applied.

For chief audit executives, the requirements provide an internationally recognised benchmark that can strengthen discussions with boards and audit committees.

They can help clarify expectations over audit scope, risk coverage and the quality of assurance, while also giving auditors stronger grounds for defending their conclusions.

However, Trikoupis warned that the growing number of requirements could itself become a challenge.

If two or three new requirements are introduced each year, internal audit functions could face a substantial volume of mandatory guidance over the coming decade.

This could lead to pressure on annual audit programmes, shortages of specialised resources and a risk that auditors adopt a checklist mentality rather than exercising professional judgement.

“The profession will have to achieve the right balance between consistency and professional judgement,” Trikoupis said.

He also highlighted the linguistic origins of the term “topical”, which derives from the Greek word “topos”, meaning place, and the related adjective “topikos”.

Beyond its geographical meaning, he said, the term is also associated with subjects that are current and under discussion, making the dual meaning particularly relevant to Topical Requirements.

This raises a broader question over whether the requirements are simply a response to the priorities of the present or whether they will become a permanent feature of the internal audit profession, he said.

Trikoupis argued that the requirements represent more than a technical improvement to audit methodology, reflecting a wider move towards stronger governance, greater transparency and more consistent assurance.

For central banks and financial authorities operating within an integrated European environment, he said, a common framework could strengthen confidence both in individual institutions and in the wider financial system.

“Public trust cannot be taken for granted,” Trikoupis said, arguing that it is earned through good governance, effective supervision and credible assurance.

He concluded that the Topical Requirements should not be viewed simply as bureaucracy but as a mechanism for protecting the credibility of internal audit and strengthening confidence in institutions serving the public interest.