Where do topical requirements fit in an internal audit program?

They fit into engagement planning as an applicability gate. When the risk assessment or engagement request includes a covered topic for assurance work, the team should document whether the topical requirement applies, which requirements are addressed, what criteria are used, and whether any exclusions have a documented rationale.

This should not be buried at the end of fieldwork. If applicability is assessed during planning, the work program can include the right procedures, evidence, and supervision points from the start. For CIA candidates, the best answer is risk-based application with documented judgment.