The 27-point gap: Why internal audit is underweight on human capital risk

Human capital ranked as the fourth-highest organizational risk globally in 2026. In Europe, it was the second-highest risk, behind only cybersecurity. Yet across North America, there is a 27-percentage point gap between how highly Chief Audit Executives rate human capital risk and how much audit time and effort they devote to it.

That is the widest gap of any risk category in the Risk in Focus 2026 research. And it represents one of the clearest opportunities for internal audit to add advisory value right now.

Why human capital risk is climbing board agendas

The drivers are converging from multiple directions. Risk in Focus 2026, which surveyed more than 4,000 CAEs globally, identifies several forces pushing human capital up the risk register:

• AI-driven deskilling. As organizations accelerate AI adoption, existing roles are being reshaped or eliminated. The European research found that some organizations risk losing key organizational knowledge and skills in the transition to greater digitalization.
• Talent retention and competition. Flexibility is now a baseline expectation for many employees. Organizations that fail to offer competitive hybrid or remote arrangements risk losing hard-to-find talent. Those that get a firm grip on this issue could gain a strategic hiring advantage.
• Short-term workforce planning. According to a survey of HR professionals by the analyst Gartner, cited in the European Risk in Focus report, 66% of organizations' HR planning focused mainly on headcount needs and 61% covered only a one-year period. These organizations were stuck in tactical and reactive cycles with processes often misaligned with business-critical initiatives.
• Lack of strategic ownership. Several CAEs at European roundtables reported that their organizations lacked top-level ownership, involvement and oversight of strategic human capital risks. Responsibility was often fragmented and split ineffectively between HR and business leaders.

This is not a niche operational concern. It is a strategic risk with direct implications for organizational performance, resilience and competitive positioning.

Why the audit effort gap is so wide

There are practical reasons why internal audit has historically underweighted human capital. It is not a traditional audit area. Many organizations lack formal processes around strategic workforce planning, which makes conventional assurance work difficult. If there is no documented control framework, there is nothing to test.

But that reasoning reinforces the problem rather than solving it. The absence of formal processes is itself a risk finding and it is exactly the kind of insight boards need to hear.

The Risk in Focus 2026 data illustrates the scale of the disconnect:

Region	Human capital risk rating	Audit effort ranking	Gap
Global	4th (43%)	9th	Significant underweight
Europe	2nd	Below top five for effort	Widest gap in Europe
North America	Top five risk	27 percentage points below risk rating	Widest gap in any category

When internal audit does not cover an area that the board considers a top risk, it creates a credibility gap. It signals that the audit function is not aligned with strategic priorities.

Where internal audit can add immediate value on human capital risk

The European Risk in Focus 2026 report provides a specific framework for how internal auditors can help organizations manage human capital risk. The advisory opportunities fall into several areas:

• AI and HR strategy alignment. Provide assurance that emerging AI strategies and HR strategies are aligned with each other and with the organization's objectives and that processes exist to keep them synchronized.
• Governance of strategic workforce planning. Provide advisory services on whether governance systems for strategic HR planning are appropriate and that responsible individuals are clearly identified. Where formal plans and procedures are lacking, advisory services are the most effective way to add value.
• Deskilling and knowledge loss. Assess whether the organization understands the impact of AI systems on existing roles and how far it risks losing key organizational knowledge in the transition to greater digitalization.
• Career progression and communication. Provide assurance that career planning and progression routes take account of the impacts of digital disruption and that opportunities are clearly communicated to staff.
• Psychological safety. Assess the level of psychological safety and, where behavioral and formal procedures are lacking, recommend improvements.
• Pay transparency compliance. For organizations operating in Europe, assess readiness for the EU Pay Transparency Directive, including data accuracy, reporting capabilities and gap analysis.

A CAE from a financial institution in the Netherlands framed the strategic opportunity directly: internal audit should be able to judge how well the talent strategy of the board matches the organizational vision and act as a sparring partner to provide constructive challenge.

How to start the conversation with your board

The 27-point gap is not just a data point. It is a conversation starter. If your organization's board has identified human capital as a top risk but your audit plan devotes minimal time to it, that misalignment is worth raising directly.

Three practical steps to open the dialogue:

1. Map the gap. Compare your organization's enterprise risk register against your current audit plan. If human capital appears in the top five risks but is absent from the audit plan, document the disconnect.
2. Lead with advisory, not assurance. Where formal processes around workforce planning are immature, offer to provide advisory input on governance design rather than waiting for something to test.
3. Connect the dots. Human capital risk does not exist in isolation. It intersects with AI adoption, cybersecurity skills gaps, operational resilience and organizational culture. Frame your advisory work in terms of these interconnections and the board will see its relevance immediately.

The risk internal audit cannot afford to ignore

Human capital is one of the few risk areas where the gap between board concern and audit effort is widening rather than narrowing. In a year where AI is reshaping workforces, geopolitical instability is disrupting labor markets and talent competition is intensifying, this is not a gap that will close on its own.

Internal audit functions that move into this space now will demonstrate the advisory value their boards are looking for. Those that wait risk reinforcing the perception that audit only covers what it has always covered.

For the full framework on closing the gap between board priorities and audit effort, Ideagen's guide, Bridging the gap: How Internal Audit teams can have more productive conversations with the board, covers the complete picture.

Sources: Risk in Focus 2026, North America (IIA/Internal Audit Foundation, 2025); Risk in Focus 2026, Europe (ECIIA, 2025).