The IIA Global Internal Audit Standards (2024): domains, principles and how to read them

In this lesson you will

Identify the five domains and 15 principles of the Global Internal Audit Standards
Explain the parts of a standard and which parts are mandatory
Apply the conformance rules in Standard 4.1 to an internal audit report
Locate the board-facing essential conditions in Domain III

What the Standards are and when they apply

The Institute of Internal Auditors (IIA) issued the Global Internal Audit Standards on January 9, 2024, as part of its International Professional Practices Framework (IPPF). They became effective January 9, 2025, and replaced the 2017 IPPF. The IPPF now has three parts: the Global Internal Audit Standards, Topical Requirements, and Global Guidance.

The Standards apply to every internal audit function that claims conformance, in the public or private sector, whatever its size. They are not law. An SEC registrant has no federal requirement to follow them, but audit committees, exchanges and external auditors read an internal audit function’s claim of conformance as a quality signal, and AS 2605 asks the external auditor to look at the function’s policies, programs and supervision when assessing competence.

Five domains and 15 principles

The Standards are organized into five domains. Domains II to V hold 15 principles, and each principle is supported by one or more of the 52 standards.

Domain	Principles
I. Purpose of Internal Auditing	Purpose statement (no numbered principles)
II. Ethics and Professionalism	1 Demonstrate Integrity, 2 Maintain Objectivity, 3 Demonstrate Competency, 4 Exercise Due Professional Care, 5 Maintain Confidentiality
III. Governing the Internal Audit Function	6 Authorized by the Board, 7 Positioned Independently, 8 Overseen by the Board
IV. Managing the Internal Audit Function	9 Plan Strategically, 10 Manage Resources, 11 Communicate Effectively, 12 Enhance Quality
V. Performing Internal Audit Services	13 Plan Engagements Effectively, 14 Conduct Engagement Work, 15 Communicate Engagement Results and Monitor Action Plans

Domain II replaces The IIA’s former Code of Ethics. The purpose statement in Domain I says internal auditing strengthens the organization’s ability to create, protect and sustain value by providing the board and management with independent, risk-based and objective assurance, advice, insight and foresight.

Reading a standard

Each standard has requirements, written with "must", and considerations for implementation and examples of evidence of conformance, which are guidance. Read the requirements first: they are what a quality assessor tests. The considerations show common ways to meet them, and the evidence examples tell you what to keep in the file.

Domain III adds "essential conditions" for the board and senior management. These are actions the board takes, such as approving the internal audit charter (Standard 6.2) and discussing the plan for an external quality assessment (Standard 8.4). The chief audit executive cannot perform them, but Standard 8.1 requires the CAE to give the board the information it needs for its oversight.

Conformance and the quality program

Standard 4.1 requires internal auditors to plan and perform internal audit services in accordance with the Standards and to follow the function’s documented methodologies. If laws or regulations prohibit conformance with part of the Standards, conformance with all other parts is required, with appropriate disclosure.

Quality sits in two places. Standard 8.3 (under Principle 8) requires a quality assurance and improvement program with internal and external assessments, and Principle 12 (Enhance Quality) covers internal assessments and performance measurement. Standard 8.4 requires an external quality assessment at least once every five years by a qualified, independent assessor or team, and the assessment team must include at least one person with an active Certified Internal Auditor designation. A self-assessment with independent validation also meets the requirement.

Standard 15.1 ties conformance to reporting: if an engagement was not conducted in conformance with the Standards, the final communication must disclose the standard not met, the reason and the impact on the findings and conclusions.

Topical Requirements

Topical Requirements are mandatory when the topic is in scope of an engagement. The IIA lists, for example, an Organizational Behavior Topical Requirement issued December 15, 2025 and effective December 15, 2026. Cybersecurity and Organizational Resilience Topical Requirements are also published. Check the documents page for the current list and dates when you build the annual plan.

Moving a manual onto the 2024 Standards

Areas that need explicit attention in a manual review include the board’s essential conditions in Domain III, the internal audit strategy (Standard 9.2), the documented risk assessment behind the annual plan (Standard 9.4), and the method for confirming that action plans are implemented (Standard 15.2). Functions that carried over 2017 manuals should map each manual section to a 2024 standard, record where the requirement is met, and close the gaps before claiming conformance.

Worked example

Gap analysis for a four-person internal audit function

Ridgeway Mutual Holdings, a calendar-year issuer, runs a four-person internal audit function. In late 2024 the chief audit executive (CAE) mapped the 2017-era manual to the 52 standards.

Gaps found:

The charter did not state the function’s commitment to the Global Internal Audit Standards or describe the board’s expectations of management support, both required content under Standard 6.2. Fix: revise the charter and take it to the audit committee for approval in December 2024.
The annual plan was a list of audits carried over from the prior year. Standard 9.4 requires the plan to rest on a documented assessment of strategies, objectives and risks, performed at least annually with input from the board and senior management. Fix: build a documented risk assessment before the 2025 plan.
Follow-up relied on management self-reporting. Standard 15.2 requires inquiry, risk-based follow-up assessments and a tracking system. Fix: add a tracker and follow-up testing for high-rated findings.
The last external quality assessment was in 2020, so the next one must be complete by 2025 to stay within five years (Standard 8.4).

Conclusion: the CAE reported the four gaps and the remediation dates to the audit committee, and the function claimed conformance in its 2025 reports only after items 1 to 3 were closed.

Self-check

Answer each question before you open the answer.

How many domains, principles and standards make up the Global Internal Audit Standards?
Show answer
Five domains, 15 principles and 52 standards. Domain I holds the purpose statement; the 15 principles sit in Domains II to V.
Which parts of a standard are mandatory?
Show answer
The requirements. Considerations for implementation and examples of evidence of conformance are guidance on how to meet and show conformance with the requirements.
How often must an external quality assessment be performed?
Show answer
At least once every five years, by a qualified, independent assessor or team that includes at least one person with an active Certified Internal Auditor designation (Standard 8.4). A self-assessment with independent validation also meets it.
What must the final communication say if an engagement did not conform with the Standards?
Show answer
Under Standard 15.1 it must disclose the standards not met, the reasons for nonconformance and the impact on the engagement findings and conclusions.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error