IIA Global Internal Audit Standards (2024 Edition, Effective January 9, 2025)

Why it Matters

Boards, regulators, and audit committees rely on internal audit for independent assurance over governance, risk management, and control, and the 2024 Standards set the expectation for how that assurance is organized and delivered. Because they consolidate the previous Standards, Code of Ethics, Core Principles, and Definition into one principles-based document and add mandatory Topical Requirements, they change both how functions are governed and what their engagements must cover.

Key benefits include:

• One mandatory framework

The Standards bring the profession's mandatory guidance into a single document organized by domain and principle, replacing separate elements of the earlier IPPF.

• Governance built in

The Governing the Internal Audit Function domain sets out the board's role in authorizing, positioning, and overseeing internal audit, making the function's independence a board responsibility.

• Strategy and performance expectations

Requirements to plan strategically, manage resources, communicate effectively, and enhance quality raise the management of the function to the same level as its engagements.

• Consistent coverage of key risks

Topical Requirements set minimum baselines for assessing areas such as cybersecurity and third-party management, so assurance on those risks is comparable across organizations.

• Guidance for every context

The Standards include considerations for the public sector and for small internal audit functions and are available in more than 40 languages.

How it Works

The Standards are organized in five domains. Domain I, Purpose of Internal Auditing, explains internal audit's value to stakeholders. Domain II, Ethics and Professionalism, sets the principles of integrity, objectivity, competency, due professional care, and confidentiality. Domain III, Governing the Internal Audit Function, requires that the function be authorized by the board, positioned independently, and overseen by the board, and sets the board's and chief audit executive's responsibilities. Domain IV, Managing the Internal Audit Function, requires the chief audit executive to plan strategically, manage resources, communicate effectively, and enhance quality. Domain V, Performing Internal Audit Services, requires engagements to be planned effectively, conducted with appropriate work, and communicated with results and monitoring of action plans. Each principle is supported by standards containing requirements, considerations for implementation, and examples of evidence of conformance.

A function implements the Standards by working through the domains: agreeing the mandate and charter with the board, establishing the chief audit executive's reporting lines, documenting the internal audit strategy and methodologies, developing a risk-based plan, and running engagements with documented planning, workpapers, supervision, findings, and follow-up. Topical Requirements are applied when the function provides assurance on the topic concerned, using the topic's baseline of governance, risk management, and control criteria. The quality assurance and improvement program, including external assessment, tests conformance, and the chief audit executive reports the results and any nonconformance to the board.

Within SmartSuite, internal audit teams manage the Standards as a working system: the charter, strategy, and risk-based plan are records the board approves, each engagement carries its objectives, scope, program, workpapers, and reviewer sign-off, Topical Requirement criteria are applied as reusable assessment sets, findings and management action plans are tracked to closure, and quality program results and board reporting are drawn from the same data.

Key Elements

• Five domains

Purpose of Internal Auditing, Ethics and Professionalism, Governing the Internal Audit Function, Managing the Internal Audit Function, and Performing Internal Audit Services.

• Fifteen principles

From Demonstrate Integrity and Maintain Objectivity through Plan Strategically and Enhance Quality to Communicate Engagement Results and Monitor Action Plans.

• Standards with requirements, considerations, and evidence

Each standard states mandatory requirements, offers considerations for implementation, and gives examples of evidence of conformance.

• Board governance of internal audit

The board authorizes the mandate and charter, positions the function independently, and oversees its performance and the chief audit executive.

• Management of the function

Requirements for strategy, resources, communication, and a quality assurance and improvement program with external assessment.

• Performing engagements

Requirements for engagement planning, work performance, evidence and documentation, communicating results, and monitoring action plans.

• Topical Requirements

Mandatory minimum baselines for assurance on particular risk areas, including cybersecurity, third-party management, organizational behavior, and organizational resilience.

Framework Scope

The Global Internal Audit Standards apply to every internal audit function and internal auditor worldwide, in organizations of all sizes and sectors, and all internal audit functions are expected to conform with them. Topical Requirements must be applied when the function provides assurance services on the topic and are recommended for advisory services. The Standards govern the internal audit function and its work; they do not define the control frameworks that engagements assess against, which come from sources such as COSO, ISO/IEC 27001, and the NIST Cybersecurity Framework.

Framework Objectives

The Standards exist to guide the professional practice of internal auditing and to give organizations a basis for evaluating and improving their internal audit function.

Define the purpose of internal auditing and the ethics and professionalism expected of internal auditors.

Establish the board's responsibility for authorizing, positioning, and overseeing the internal audit function.

Require the chief audit executive to manage the function strategically, resource it, communicate, and enhance its quality.

Set requirements for planning, performing, and communicating internal audit engagements and monitoring action plans.

Provide a consistent minimum baseline for assurance on particular risk areas through Topical Requirements.

Serve as the basis for quality assessment and conformance reporting to the board.

Framework in Context

The Standards are the mandatory core of the IPPF and sit alongside The IIA's Topical Requirements and global guidance. Internal audit engagements under them commonly assess governance and control against the COSO Internal Control and Enterprise Risk Management frameworks, ISO 31000, ISO/IEC 27001, and the NIST Cybersecurity Framework, and IT audit work within internal audit draws on ISACA's ITAF and COBIT. Where internal audit supports the Sarbanes-Oxley program, its work is used by the external auditor under PCAOB AS 2201 and AS 2605. The Third-Party Topical Requirement, effective September 15, 2026, connects internal audit coverage to the EBA and U.S. interagency third-party risk frameworks.

Common Framework Mappings

The Standards are commonly mapped to the governance and control frameworks internal audit assesses against and to the audit and assurance standards it operates alongside.

Mapped frameworks include:

COSO IC 2013

COSO ERM 2017

ISO 31000:2018

ISO 27001:2022

NIST CSF 2.0

ISACA ITAF

COBIT 2019

SOX

PCAOB AS 2201

ISAE 3000