Financial Services Internal Audit Planning Priorities 2026 (Deloitte Switzerland)

Summary

• Geopolitical risk acts as a key driver of traditional and emerging risks, featuring in over 50% of the topics discussed in the report.p.7
• In Deloitte's survey on GenAI adoption, 30% of respondents cited difficulty in managing AI risk as a barrier to adoption.p.9
• Approximately 79% of internal audit functions are now utilizing tools like Co-pilot, while 38% are exploring custom-built GenAI solutions.p.21
• Alignment of data analytics strategy with functional goals correlates with success, as 90% of functions with aligned strategies reported successful analytics implementation.p.22
• Data quality remains a major challenge for internal audit, with 52% of functions citing poor data quality as a barrier despite 79% evaluating data quality prior to analysis.p.22
• FINMA guidance sets mortgage affordability limits for owner-occupied residential properties at a maximum of 33% of gross income or 38% of net income for exceptions to policy (ETP).p.27
• FINMA recommends a loan-to-value ceiling of 75% for income-producing real estate and caps ETP transactions at 100% of net rental income.p.27

Key insights

1. FINMA's circular on nature-related financial risks takes effect on 1 January 2026, establishing expectations for climate- and environmental-related risk management.p.3
2. Under FINMA Guidance 08/2024, Swiss institutions are expected to maintain a centralized AI inventory with clear risk classifications and assigned responsibilities.p.9
3. The revised Swiss Insurance Supervision Act (ISA) and Ordinance (ISO) modernized regulatory oversight to align with international standards like Solvency II.p.30
4. The FINMA Circular 'Liquidity – Insurers' (RS 25/3) requires formal annual reporting submitted via FINMA's EHP platform by 30 April following a 31 December cut-off date.p.31
5. A data literacy gap exists in internal audit functions, where 62% provide basic analytics training but only 3% offer advanced training to comparable staff counts.p.22
6. Mandatory IIA topical requirements for cyber security take effect starting February 2026, requiring internal audit teams to update methodologies.p.24
7. The Federal Council will re-evaluate greenwashing regulation by 31 December 2027 based on international developments and self-regulation effectiveness.p.3