The Institute of Internal Auditors published the Global Internal Audit Standards on January 9, 2024, and, as the IIA's press release confirms, they became effective on January 9, 2025. They replaced the earlier Standards inside the International Professional Practices Framework (IPPF), which now consists of three layers: the Global Internal Audit Standards, Topical Requirements and Global Guidance. For a CPA firm that provides internal audit services, co-sources an internal audit function or reviews one as part of a SOX or ICFR engagement, the structure matters more than any single standard, because the structure tells you what a conformance review will ask to see.
How the Standards are built
The Standards are organized into five domains.
| Domain | Subject |
|---|---|
| I | Purpose of Internal Auditing |
| II | Ethics and Professionalism |
| III | Governing the Internal Audit Function |
| IV | Managing the Internal Audit Function |
| V | Performing Internal Audit Services |
Fifteen principles sit under the domains. Domain II holds Principles 1 to 5 (Demonstrate Integrity, Maintain Objectivity, Demonstrate Competency, Exercise Due Professional Care, Maintain Confidentiality). Domain III holds Principles 6 to 8 (Authorized by the Board, Positioned Independently, Overseen by the Board). Domain IV holds Principles 9 to 12 (Plan Strategically, Manage Resources, Communicate Effectively, Enhance Quality). Domain V holds Principles 13 to 15 (Plan Engagements Effectively, Conduct Engagement Work, Communicate Engagement Results and Monitor Action Plans).
Every principle is supported by standards, and every standard has three parts: requirements, considerations for implementation, and examples of evidence of conformance. The requirements are mandatory. The other two parts are not: considerations for implementation describe common practice, and examples of evidence of conformance describe artifacts that can show a requirement was met. Do not cite either as if it were a requirement.
Topical Requirements are a separate layer. The Standards state that internal auditors must conform with the relevant requirements when an engagement's scope includes one of the identified topics. Global Guidance is nonmandatory.
What changed in emphasis
The IIA's effective-date press release describes the Standards as updated with a focus on internal audit strategy, stakeholder relationships, and internal audit performance measurement and accountability. You can see each of those in the text:
- Standard 9.2 requires the chief audit executive to develop and implement an internal audit strategy that includes a vision, strategic objectives and supporting initiatives, and to review it periodically with the board and senior management.
- Standard 11.1 deals with building relationships and communicating with stakeholders.
- Standard 12.2 requires the chief audit executive to set performance objectives and a measurement methodology, and to solicit feedback from the board and senior management.
- Standard 6.2 requires the charter to state a commitment to adhering to the Global Internal Audit Standards.
For a small function, the strategy requirement is easy to overlook. A function that has a plan for the year but no vision, strategic objectives or supporting initiatives has an audit plan and no strategy.
Worked example: a three-person function
Take a hypothetical manufacturer with a three-person internal audit team and a part-time chief audit executive who also runs the controllership. Standard 7.1 applies immediately. A chief audit executive with ongoing roles beyond internal auditing must document the responsibilities, nature of work and safeguards in the charter, and where those areas are subject to internal auditing, must set up an alternative source of assurance, such as an objective external provider reporting independently to the board. A CPA firm asked to supply that outside assurance for the controllership scope should document the engagement, including its independence from the area, as an assurance service reporting to the board.
Next, build the conformance binder. One folder per domain, one sheet per standard, three columns taken straight from the Standards: the requirement, how the function meets it, and the evidence. Examples of evidence the Standards themselves list include:
- Standard 9.4: the approved internal audit plan, the documented risk assessment, and board minutes in which the plan was discussed.
- Standard 14.6: workpapers that document the analyses performed, with supervisory review.
- Standard 15.1: the final engagement communication, reviewed and approved by the chief audit executive before issue.
- Standard 12.1: documented internal assessments.
A binder built this way is also the input to the external quality assessment described in Standard 8.4, which requires an independent assessment at least once every five years. See /us/blog/external-quality-assessment-every-five-years-standard-8-4.
Scoping the work without overbuilding
The Standards allow flexibility in several places. Where an engagement is advisory, parts of Standard 13.2 (formal documented risk assessment) and 13.4 (evaluation criteria) may not be necessary depending on the agreement with stakeholders. Standard 14.2 requires the work program to be adjusted and approved by the chief audit executive when additional analyses are needed. The common error is to read that flexibility as a waiver for assurance work. It is not. For assurance engagements, the documentation requirements apply in full.
Public sector functions apply the same Standards with additional guidance in a dedicated section of the document, which covers matters such as laws and regulations that affect conformance, funding, and the use of assessors who know public sector governance for external assessments.
Where the Standards meet ICFR work
Internal audit conclusions often feed management's assessment of internal control over financial reporting. The SEC's interpretive guidance for management says evidence of operating effectiveness can come from direct tests of controls, ongoing monitoring or a combination, and that direct tests are ordinarily performed by individuals with a high degree of objectivity relative to the controls tested. An internal audit function that conforms to Principle 2 (Maintain Objectivity) and Standard 7.1 can supply that objectivity. One that does not conform weakens the evidence it produces. See /us/blog/control-testing-guide for how that evidence is used in testing.
Questions practitioners ask
Do the Standards apply to a company that is not an SEC registrant?
The Standards are professional standards for the practice of internal auditing and are not a securities law requirement. A board, lender or regulator can require conformance, and many internal audit charters commit to it under Standard 6.2.
Are Topical Requirements optional?
No. Conformance is required when an engagement scope includes the topic. See /us/blog/internal-audit-topical-requirements-cybersecurity-third-party-and-organizational-behavior.
Is there a short checklist for a first review?
Start with the charter (6.2), annual independence confirmation to the board (7.1), the board-approved plan (9.4), a sample of final communications (15.1) and the quality program (12.1 and 8.4). Those artifacts make up the first sample.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- The IIA, Global Internal Audit Standards (published January 9, 2024; effective January 9, 2025), including Standards 6.2, 7.1, 8.4, 9.2, 9.4, 11.1, 12.1, 12.2, 13.2, 14.2, 14.6, 15.1: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
- The IIA, press release on the effective date of the Global Internal Audit Standards (January 16, 2025): https://www.theiia.org/en/content/communications/press-releases/2025/january/the-iia-celebrates-the-effective-date-of-the-global-internal-audit-standards/
- SEC, Release No. 33-8810, Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting (June 20, 2007), Section II.A.2.b: https://www.sec.gov/rules/interp/2007/33-8810.pdf
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error