Digital disruption and climate change are the two fastest-growing risk areas for organizations across various industries, according to a new report.

The report, issued last week by the Institute of Internal Auditors’ Internal Audit Foundation’s the latest in its Risk in Focus research series. The report was based on feedback from over 3,500 internal audit leaders around the world, global risk levels for digital disruption and climate change are projected to increase 20 percentage points and 16 percentage points, respectively, over the next three years — far outpacing other risk areas. 

The risks from climate change can be seen from the devastating impact of Hurricane Helene on the Southeast in recent days.

The IIA noted that despite the growing intensity of these risks, most audit plans don’t currently prioritize them. Neither digital disruption nor climate change were named among the top five areas where internal audit functions allocate the most time and effort, with both ranked in the lower half of audit priorities. Globally, internal audit functions focus predominantly on cybersecurity, governance/corporate reporting, and business continuity, indicating a perceived gap between evolving threats and current areas of attention.

“Our latest research tells us cybersecurity, business continuity and human capital continue to hold the top three spots in risk ratings,” said IIA president and CEO Anthony Pugliese in a statement last week. “However, respondents anticipate significant changes as risks related to climate change and digital disruption accelerate in the coming years. To ensure both short-term success and long-term sustainability, organizations and their internal audit functions must adapt risk management practices to keep pace with the changing risk landscape.”

Approximately 39% of the survey respondents worldwide ranked digital disruption as a top five risk, with that number expected to jump to 59% in three years. For North America, these figures were higher at 48% and 70%, respectively. Survey respondents worldwide anticipate digital disruption to rise from the fourth to the second highest ranked risk area in three years.

Artificial intelligence introduced new risks to watch, especially related to cybersecurity, according to 75% of the survey respondents. AI has also affected many other risk areas, including human capital, fraud, communications, reputation, and more. AI challenges for internal auditors include upskilling and adopting new tools, as well as global disparities in access to and knowledge of emerging technology.

Climate-related risks are currently ranked relatively low, but they are expected to rise substantially soon. About one in four (23%) of global respondents view climate change as a top five risk today. However, nearly 40% of respondents anticipate it will reach the top five in the next three years, climbing from 13th place to 5th.

 Globally, roundtable participants agree that sustainability reporting and compliance requirements are the main drivers for boards, management and internal audit functions to allocate resources to climate change. The report revealed significant regional differences in climate-related risk perceptions. For instance, 33% of European audit leaders and 30% of Canadian audit leaders rate climate change as a top five risk, compared to 9% for the U.S. Despite the U.S. position, North American respondents expect ratings for climate change as a top 5 risk will double from 13% to 27% in three years.

 “While climate change has long been recognized as a growing risk for organizations, these findings reveal the extent to which climate-related risks are expected to surge in the near term,” said Pugliese. “It is imperative for organizations, stakeholders, and internal audit leaders to objectively assess the short-term and longer-term risks to their organizations beyond basic compliance with regulations.”

Extreme weather can cause supply chain disruptions, higher operational costs, flooding, famine and more. While some consumers and investors are calling on organizations to implement more sustainability initiatives, these initiatives need to be reported accurately to avoid greenwashing and reputational damage.