Top Risk Areas for Internal Audit Planning: TMT

Explore five areas of risk for TMT companies in 2027 and learn how internal audit planning can help teams stay ahead in a shifting risk landscape.

5 areas to consider in internal audit planning

Technology, media, and telecommunications (TMT) organizations are entering 2027 with a risk environment shaped by rapidly advancing AI, interconnected technology ecosystems, growing regulatory expectations, and deeper reliance on third parties. Five areas of risk for internal audit teams include cybersecurity and digital resilience, AI governance and intellectual property risks, platform and operational resilience, data privacy and sovereignty, and third-party concentration risk. Across these areas, organizations must understand how interconnected dependencies can contribute to disruptions and assess their ability to respond, recover, and maintain critical operations when failures occur.

Internal audit can play a critical role by moving beyond policy-based reviews toward practical, risk-based assurance. Doing so includes testing controls under realistic scenarios, validating recovery capabilities, assessing the full life cycle of AI use, mapping sensitive data and critical dependencies, and identifying hidden concentration risks across third and fourth parties. By connecting control weaknesses to business impacts – including downtime, financial loss, customer harm, regulatory exposure, and reputational damage – internal audit can help management prioritize investments and strengthen organizational resilience.

Cybersecurity and digital resilience

The cyberthreat environment is evolving, and cybersecurity and digital resilience will be a major concern for TMT organizations in 2027. One critical risk is AI, which makes attacks more scalable, faster, and more convincing. Threat actors can use AI to identify vulnerabilities, steal credentials, develop malware, and create highly personalized phishing campaigns, and deepfake videos, cloned voices, and synthetic identities make impersonation difficult to detect. Recent developments demonstrate the growing threat. Verizon’s “2026 Data Breach Investigations Report” found that software vulnerabilities were the starting point for 31% of breaches, and ransomware was involved in 48%.

Building resilience across an interconnected ecosystem 

TMT organizations experience heightened exposure because critical services depend on interconnected cloud platforms, communications networks, software, connected devices, and third parties. A successful cyberattack can disrupt essential services, compromise customer data or intellectual property, enable fraud, and damage public trust. At the same time, regulatory expectations are increasing. The European Union’s (EU) Cyber Resilience Act’s main requirements, which take effect in December 2027, reinforce expectations that cybersecurity be addressed throughout the life cycle of products with digital elements. For organizations, resilience means preventing attacks, maintaining critical services, and recovering effectively when incidents occur.

Testing controls against real-world threats

Internal audit can provide valuable assurance by evaluating whether cybersecurity and resilience controls operate effectively under realistic conditions. Reviews should consider critical assets and identities, internet-facing systems, cloud environments, software development, vulnerabilities, and third-party dependencies as well as whether controls can withstand emerging threats such as AI-enabled impersonation. Testing should go beyond reviewing policies to assess whether organizations can restore backups, switch to backup systems, meet recovery objectives, and execute incident escalation and communication procedures as intended. Internal audit can help management prioritize cybersecurity and resilience investments by assessing how identified weaknesses might lead to downtime, financial loss, customer harm, regulatory exposure, or reputational damage.

Next steps for internal auditors 

• Map critical assets and attack paths. Identify essential services, sensitive data, privileged and nonhuman identities, internet-facing systems, legacy infrastructure, cloud dependencies, and critical third parties to understand where attacks could originate and how they could spread. 
• Test identity and approval controls. Assess phishing-resistant multifactor authentication, privileged access, access reviews, and independent verification for sensitive payment, system access, and content-release requests. Incorporate deepfake and executive-impersonation scenarios to determine whether existing controls are effective against social engineering techniques. 
• Validate vulnerability management and resilience. Evaluate risk-based patching and secure product development. Test whether the organization can restore backups, switch to backup systems, and meet recovery-time and recovery-point objectives in practice. 
• Exercise incident response and reporting. Use realistic scenarios – including ransomware, nation-state attacks, third-party outages, and executive impersonation – to test escalation, materiality assessments, regulatory notifications, board reporting, and crisis communications. 

AI governance, model risk, and intellectual property

Organizations across industries are moving from AI experimentation to autonomous action. In 2027, AI risk for TMT organizations will shift from experimentation with generative AI to systems capable of independently creating content, generating code, interacting with customers, and executing multistep actions. As autonomy increases, organizations will need to demonstrate that AI use is authorized, fit for purpose, appropriately validated, and subject to accountable human oversight. Agentic AI raises the stakes because inaccurate or inappropriate outputs might no longer be advisory. Connected tools and permissions can allow AI systems to act before a human intervenes.

Identifying governance and intellectual property risks

AI risk also extends beyond the models themselves. Shadow AI and embedded third-party capabilities can bypass established inventory and approval processes, and poor data quality, inadequate testing, or uncontrolled changes to models and configurations can produce unreliable, biased, or harmful outcomes. For TMT organizations, these failures could result in defective software releases, inappropriate or infringing content, erroneous customer interactions, service disruptions, or exposure of proprietary code and customer information. The use of protected content, voice, likeness, and other intellectual property introduces additional legal and contractual considerations that organizations must address as AI adoption expands.

Governing the full AI-enabled use case 

Internal audit can provide assurance by evaluating the complete AI-enabled use case, not simply the underlying models. The evaluation should cover the data and retrieval sources, prompts, connected tools, permissions, human decision points, third parties, and actions an AI system is authorized to perform. Reviews should consider whether higher-risk applications have appropriate ownership, risk classification, validation, monitoring, and human oversight and whether changes or incidents trigger revalidation, rollback, suspension, or retirement. Third-party AI arrangements should also address confidentiality, data reuse, intellectual property rights, auditability, continuity, and exit considerations.

Next steps for internal auditors

• Identify AI use and understand the organization’s exposure. Reconcile AI inventories against procurement, cloud, software, and vendor records to identify shadow and embedded AI. Confirm that material use cases have defined owners, approved purposes, appropriate risk tiers and autonomy levels, and clear escalation thresholds. 
• Test controls across the full AI-enabled use case. Evaluate data and retrieval sources, prompts, tools, permissions, performance, bias, security, privacy, and harmful output controls. For higher-risk or agentic applications, determine whether human reviewers have sufficient information, authority, and technical capability to challenge, stop, or override system actions. 
• Assess ongoing monitoring and life cycle governance. Determine whether management can identify data leakage, unexpected behavior, performance deterioration, unauthorized actions, and significant changes to models, prompts, tools, data sources, or vendors. Evaluate whether established criteria trigger appropriate revalidation, rollback, suspension, or retirement. 
• Evaluate third-party and intellectual property protections. Assess vendor provisions addressing confidentiality, data reuse, intellectual property ownership and usage rights, auditability, change notification, continuity, and exit arrangements. Consider whether the organization’s governance and assurance approach aligns with applicable regulatory and industry frameworks as AI requirements continue to evolve. 

Platform, network, and operational resilience

A complex operating environment makes platform, network, and operational resilience a significant risk for TMT organizations in 2027. Cloud migrations, 5G and edge technologies, acquired platforms, faster software releases, AI-enabled services, and aging infrastructure are creating more interconnected environments and more opportunities for outages, capacity failures, configuration errors, and security gaps. The consequences can extend beyond lost revenue and customer dissatisfaction to disruptions of emergency communications, healthcare connectivity, and other critical services. Recent large-scale outages, along with evolving regulatory expectations, such as the EU’s Directive 2022/2555 (also known as the NIS 2 Directive), underscore the importance of strengthening operational resilience. 

Assessing critical services and recovery capabilities

Internal audit should assess whether management understands the platforms, networks, applications, data, third parties, and shared services supporting critical business services, including concentration risks, legacy constraints, and single points of failure. Internal auditors should also evaluate whether disaster recovery and business continuity capabilities work in practice by observing exercises involving realistic scenarios such as cloud-region failures, network disruptions, software deployment failures, capacity surges, or major supplier outages. Testing should demonstrate that organizations can restore backups, failover environments can operate at the required scale, recovery objectives are achievable, and crisis communications are effective.

Strengthening controls across the technology ecosystem

As technology environments become more complex, internal audit should evaluate whether change management, capacity planning, monitoring, and third-party resilience controls are keeping pace. Reviews should assess whether organizations adequately test high-risk changes and can reverse them quickly. They should also evaluate whether capacity and monitoring processes can detect emerging service degradation and whether critical suppliers maintain appropriate service commitments, testing practices, and contingency plans. Reporting resilience issues in terms of potential downtime, customer impact, financial loss, regulatory exposure, and reputational damage can help management prioritize investments and strengthen the organization’s ability to continue delivering critical services when disruptions occur.

Next steps for internal auditors

• Map critical services and dependencies. Identify the platforms, networks, applications, data, third parties, and shared services required to deliver each critical business service, including single points of failure.  
• Validate recovery capabilities. Observe disaster recovery and business continuity exercises and confirm that backups, failover environments, staffing, and communications can meet approved recovery-time and recovery-point objectives.  
• Review change and release controls. Test whether high-risk changes receive appropriate approval, testing, phased deployment, automated validation, and documented rollback procedures.  
• Assess capacity and monitoring. Determine whether capacity planning reflects peak demand, AI workloads, and failure scenarios, and whether monitoring can detect service degradation across cloud, network, application, and third-party environments.  
• Evaluate third-party resilience. Review service-level commitments, outage notifications, concentration risks, subcontractor dependencies, testing rights, and practical exit or substitution plans.  

Data privacy, governance, and sovereignty

In 2027, TMT organizations will have to contend with growing data complexity and heightened risks related to privacy, governance, and data sovereignty. Expanding AI adoption, global data flows, cloud platforms, and third-party technologies will make it harder to track where sensitive data resides, how organizations use it, and who can access it. Such challenges heighten the risk of inappropriate use, transfer, or retention of personal, proprietary, or regulated information.

The rapid expansion of AI is increasing the volume of data that organizations process and the ways they can combine, infer, generate, replicate, retain, and transfer information across systems and jurisdictions. As demand for AI grows, continued investment in data center, cloud, and computing infrastructure supporting these capabilities will further expand the number of environments and parties handling information. Organizations must account for the resulting privacy risks by governing the personal or proprietary information they collect, along with the sensitive attributes, profiles, outputs, logs, embeddings, and other information AI systems might derive or create from it. At the same time, legal and regulatory requirements might not develop consistently across jurisdictions or keep pace with the technologies and use cases they govern. Organizations should therefore avoid relying on regulatory clarity alone. Incorporating data lineage, purpose and access controls, inference-risk assessments, residency and cross-border considerations, third-party oversight, retention, deletion, and auditability into AI-enabled privacy programs can help organizations scale AI adoption responsibly while reducing potential regulatory, litigation, contractual, and reputational exposure.

Managing global data and AI risks

Organizations must manage differing privacy, residency, consent, and cross-border transfer requirements while maintaining appropriate governance throughout the data life cycle. AI adds complexity as sensitive information might be used for model training, retrieval, or prompts and potentially create unintended disclosure or reuse. Internal audit can assess whether organizations are maintaining appropriate data ownership, classification, lineage, access, retention, and third-party controls and can demonstrate compliance with applicable requirements.

Next steps for internal auditors

• Map sensitive data and its movement. Identify where personal, proprietary, and regulated information is collected, stored, processed, and transferred across internal systems, cloud platforms, AI applications, and third parties. 
• Test privacy and governance controls. Evaluate data ownership, classification, consent, access, retention, and disposal controls, including whether data is being reused for purposes beyond its original intent. 
• Assess sovereignty and AI-related data use. Review cross-border data flows, cloud and third-party processing locations, and how sensitive information is used in AI models and applications to identify potential privacy, regulatory, and data leakage risks. 

Third-party concentration risk

Because of the growing dependence on a concentrated third-party ecosystem, third-party concentration risk will be a vital consideration for TMT organizations in 2027. As organizations rely on a smaller group of cloud-hosting providers, managed service providers, AI platforms, network technologies, and other critical vendors, a disruption or compromise at one provider can have significant downstream consequences. These dependencies can affect business operations, customer services, revenue, and organizational resilience, particularly when viable alternatives are limited.

Understanding concentration risk beyond direct vendors

Organizations should consider concentration risk across the broader third- and fourth-party ecosystem. Multiple vendors that appear independent might rely on the same cloud provider, hosting environment, network infrastructure, or other fourth party and create hidden single points of failure. Geographic concentration can introduce similar vulnerabilities when critical vendors or infrastructure are located in the same region and exposed to a common natural disaster, infrastructure failure, or other location-specific event.

Strengthening resilience

Having multiple vendors does not necessarily provide resilience if those vendors share the same underlying fourth-party technology or infrastructure. Internal audit can challenge whether management understands these interconnected dependencies and whether practical alternatives exist for critical services. Evaluating concentration through a business-impact lens can also help management determine where redundancy, contingency planning, or diversification would provide the greatest value. 

Next steps for internal auditors

• Understand the organization’s impact radius. Document material fourth parties and identify sole providers of critical third-party services to determine where a single disruption could affect multiple parts of the organization. Consider using heat-map analysis to identify geographic concentrations and areas where a location-specific event could create widespread disruption. 
• Connect third-party dependencies to business impact. Recommend mapping key customer services, cost centers, and profit centers to the third-party engagements that support them. Such mapping can help the organization quantify potential downstream financial and operational impacts, prioritize its most significant concentration risks, and focus mitigation efforts where disruption would have the greatest effect.