Global Internal Audit Standards: what changed and what to update

The Institute of Internal Auditors’ Global Internal Audit Standards became effective on 9 January 2025, and internal audit functions are now expected to conform with them.¹ For most heads of internal audit the transition year is over and the question is practical: which documents, processes and board conversations need to change, and in what order. This article explains why the global internal audit standards changed, how they are structured, and what to update in your charter, methodology, quality programme and board reporting. It also sets out the UK position, which differs between the private and third sectors and the public sector.

Why the global internal audit standards changed

The IIA released the new Standards on 9 January 2024, with a 12-month lead time before they took effect. The release followed a global public comment period that generated nearly 19,000 comments from 1,600 survey responses. The IIA’s stated aims included elevating the quality of internal auditing, strengthening governance frameworks and enhancing internal audit’s role as a partner to boards and senior management, with specific guidance for the public sector and for small internal audit functions.²

The most visible change is consolidation. Under the 2017 International Professional Practices Framework (IPPF), the mandatory material was spread across the Mission of Internal Audit, the Definition of Internal Auditing, the Core Principles, the Code of Ethics and the Standards themselves. The 2024 Standards incorporate content from all of these into one document, and the old split between attribute and performance standards has gone.³ In practice, that means one reference point for requirements, implementation guidance and evidence, rather than several documents read side by side.

The second change is one of emphasis. The new Standards say much more about what the board and senior management must do for internal audit to work, and they introduce the public interest as part of the case for internal auditing. The IIA’s own mapping of the 2017 and 2024 frameworks identifies a set of requirements with no direct 2017 equivalent, including professional courage, professional scepticism, the chief audit executive’s duty to discuss the governance domain with the board, and new content requirements for final engagement communications.³

The structure of the new Standards

The Standards are organised into five domains. Domains II to V contain 15 principles, and each principle is supported by standards made up of requirements, considerations for implementation and examples of evidence of conformance. Requirements use “must”; the considerations use “should” and “may” to describe common and preferred practice.⁴

Domain	Principles	What it covers
I. Purpose of Internal Auditing	None (a purpose statement)	Why internal auditing exists and when it is most effective
II. Ethics and Professionalism	1 Demonstrate Integrity; 2 Maintain Objectivity; 3 Demonstrate Competency; 4 Exercise Due Professional Care; 5 Maintain Confidentiality	Behavioural expectations of every internal auditor, replacing the former Code of Ethics
III. Governing the Internal Audit Function	6 Authorized by the Board; 7 Positioned Independently; 8 Overseen by the Board	Mandate, charter, independence, resources and quality, with “essential conditions” for the board and senior management
IV. Managing the Internal Audit Function	9 Plan Strategically; 10 Manage Resources; 11 Communicate Effectively; 12 Enhance Quality	Strategy, methodologies, the audit plan, resourcing, communication and quality assurance
V. Performing Internal Audit Services	13 Plan Engagements Effectively; 14 Conduct Engagement Work; 15 Communicate Engagement Results and Monitor Action Plans	Engagement planning, fieldwork, reporting and follow-up

Domain I replaces the old mission and definition with a single purpose statement:⁴

Internal auditing strengthens the organization’s ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight.

The IIA, Global Internal Audit Standards, Domain I

The Standards apply to any individual or function that provides internal audit services, whether the organisation employs internal auditors directly, contracts them through an external service provider, or both. In every case the board keeps responsibility for supporting and overseeing the function.⁴ If you use an outsourced, co-sourced or interim internal audit arrangement, the provider’s chief audit executive is accountable for conformance, but the board’s essential conditions still sit with you.

Topical Requirements and Global Guidance

The new IPPF has three components: the Standards, Topical Requirements and Global Guidance. Topical Requirements set baseline expectations for specific audit subjects, and internal auditors must conform with them when the scope of an engagement includes one of the identified topics. Global Guidance remains non-mandatory.⁴ At the time of writing no Topical Requirement has yet been issued: the IIA has said the first, on cybersecurity, will be available in February 2025, followed by third-party risk, culture and business resiliency.¹ It is worth building a step into your planning methodology now to check whether a Topical Requirement applies to each engagement.

The UK position in January 2025

For the financial services, private and third sectors, the Chartered IIA published a unified Internal Audit Code of Practice in September 2024, effective from January 2025. It is to be applied in conjunction with the IPPF and the Global Internal Audit Standards and builds on them. Among other things, it says the internal audit charter should be publicly available, the chief audit executive’s primary reporting line should be to the chair of the board audit committee, and the function as a whole should have an external quality assessment at least every five years that explicitly covers conformance with both the Code and the Standards.⁵

The UK public sector runs to a different timetable. The Relevant Internal Audit Standard Setters (HM Treasury, the Scottish Government, the Department of Finance Northern Ireland, the Welsh Government, the Department of Health and Social Care and CIPFA) issued an Application Note in December 2024. From 1 April 2025, the Application Note and the Global Internal Audit Standards apply to internal audit engagements commenced on or after that date.⁶ Until then, the Chartered IIA’s Code notes that public sector functions should continue to follow the Public Sector Internal Audit Standards.⁵

The Application Note matters for anyone working in public sector and local government internal audit. It requires conformance to be described as conformance with “Global Internal Audit Standards in the UK Public Sector”, requires an overall annual conclusion covering governance, risk management and control, sets qualification expectations for chief audit executives (CMIIA, a CCAB qualification or an equivalent that includes internal audit training, plus suitable experience), and replaces the Certified Internal Auditor requirement for external assessors with that same qualification profile. Where public sector governance structures prevent the Domain III essential conditions being met, alternatives must be agreed with the board or audit committee and, if permanent, explained in the audit charter. For local government, it points to CIPFA’s Code of Practice for the Governance of Internal Audit.⁶

What to update in your charter

Standard 6.2 sets a minimum content for the internal audit charter. It must specify the Purpose of Internal Auditing; a commitment to adhering to the Global Internal Audit Standards; the mandate, including the scope and types of services and the board’s responsibilities and expectations regarding management’s support; and the function’s organisational position and reporting relationships. The chief audit executive must discuss the proposed charter with the board and senior management, and the board approves it.⁴

Most 2017-era charters need at least the following changes:

• Replace references to the mission, definition, Core Principles and Code of Ethics with the Purpose of Internal Auditing and a commitment to the Global Internal Audit Standards (and, where relevant, the Chartered IIA Code or the UK public sector Application Note).
• Set out the mandate explicitly: authority, role and responsibilities. Where the mandate is prescribed wholly or partly in law or regulation, the charter must include those legal requirements (Standard 6.1).
• State the board’s responsibilities and what it expects of management in supporting internal audit.
• Document any ongoing roles the chief audit executive holds beyond internal auditing, with the nature of the work and the safeguards in place (Standard 7.1).
• Consider adding the topics the Standards suggest: administrative reporting, independence safeguards, unrestricted access, communication with the board, handling disagreements with management, and expectations for internal and external quality assessments.⁴

What to update in your methodology

Standard 9.3 requires the chief audit executive to establish methodologies that guide the function in a systematic and disciplined manner, to evaluate and update them, and to train internal auditors on them. Footnotes in the internal audit manual citing the standard each section addresses are listed as one example of evidence of conformance, and that is a practical way to run your gap analysis.⁴ The areas that most often need new or rewritten content are:

• Internal audit strategy (Standard 9.2). A documented strategy with a vision, strategic objectives and supporting initiatives, aligned with the organisation’s strategy and reviewed periodically with the board and senior management.
• The audit plan (Standard 9.4). The plan must rest on a documented assessment of the organisation’s strategies, objectives and risks, performed at least annually and informed by the board and senior management. It must consider coverage of information technology governance, fraud risk, the effectiveness of compliance and ethics programmes, and other high-risk areas. The board approves the plan and significant changes to it.
• Professional scepticism (Standard 4.3). Internal auditors must exercise it when planning and performing their work, so supervision and file review checklists should test for it.
• Themes and wider conclusions (Standard 11.3). Themes across engagements must be communicated to the board and senior management. Where a conclusion is given at business unit or organisation level, it must state the criteria, scope and limitations, supporting information and any reliance on other assurance providers.
• Final engagement reports (Standard 15.1). Reports must name the individuals responsible for addressing findings and the planned completion dates, acknowledge actions management has already taken, and be approved by the chief audit executive before issue.⁴

Quality assurance and improvement programmes

Standard 8.3 requires a quality assurance and improvement programme covering all aspects of the function, with internal and external assessments. At least annually, the chief audit executive must report the results of internal assessment to the board and senior management, and external assessment results must be reported when completed. Those reports cover conformance with the Standards, achievement of performance objectives, compliance with relevant laws and regulations, and plans to address deficiencies. The board must approve the function’s performance objectives at least annually.⁴

Internally, Standard 12.1 requires ongoing monitoring and periodic self-assessments, documented and available to the external assessor, while Standard 12.2 requires a performance measurement methodology and feedback from the board and senior management. Externally, Standard 8.4 keeps the five-year cycle and the option of a self-assessment with independent validation. The 2024 version adds that at least one member of the assessment team must hold an active Certified Internal Auditor designation, and the board must approve the assessment plan, including the assessors’ competence and independence and the reasons for choosing a self-assessment with validation where that route is used.³⁴

If your last external assessment was carried out against the 2017 Standards, your next one will be against the new Standards. A self-assessment now, mapped standard by standard, is the most efficient way to find gaps before an assessor does. Our internal audit quality reviews and external quality assessments are built around that approach.

Reporting to the board

Domain III is where boards and audit committees will notice the difference. The chief audit executive must discuss the domain with the board and senior management, focusing on the Purpose of Internal Auditing, the essential conditions under each standard, and the effect on internal audit if they are not met. If the board or senior management disagrees with an essential condition, the chief audit executive must explain the consequences with examples. Where alternatives are agreed, the reasons and compensating conditions must be documented.⁴

Standard 8.1 lists what the chief audit executive must report to the board and senior management. Other standards add timing expectations. A simple reporting calendar helps an audit committee check that it is receiving what it should:

Board receives or does	Timing	Standard
Discussion of Domain III and the essential conditions	When the Standards change significantly, a new chief audit executive is appointed, or board or reporting relationships change	Domain III
Approval of the charter, including mandate and scope	On adoption and on change; review frequency agreed with the board	6.1, 6.2
Confirmation of the function’s organisational independence	At least annually	7.1
Discussion of the sufficiency of internal audit resources	At least annually	8.2
Approval of performance objectives	At least annually	8.3
Results of internal quality assessment	At least annually	8.3
Approval of the audit plan, budget and resource plan, and significant changes	When proposed	6.3, 8.1, 9.4
Results of internal audit services, including conclusions, themes and follow-up	Periodically, as agreed with the board	8.1, 11.3
Meeting with the chief audit executive without senior management present	At least annually; quarterly is described as leading practice	6.3

The board is also expected to set criteria for which issues are escalated to it and how, and the chief audit executive must give the board the facts when there is a disagreement with senior management that affects internal audit’s ability to do its job.⁴ Many audit committee members were appointed under the old framework, so a short briefing on their new responsibilities is often the quickest win. Our audit committee and internal audit training covers exactly this.

Where to start

1. Run a gap analysis of your charter, manual and templates against each standard, recording evidence as you go.
2. Hold the Domain III conversation with the audit committee chair and senior management, and minute it.
3. Redraft and re-approve the charter.
4. Document an internal audit strategy and agree performance objectives with the board.
5. Update the risk assessment and planning methodology, report templates and supervision checklists, then train the team on them.
6. Agree a reporting calendar with the audit committee and plan your next external quality assessment.

Public sector functions move to the new Standards for engagements starting on or after 1 April 2025, so the sensible aim is to complete these steps before then, reading each one alongside the Application Note.

How we can help

We help internal audit functions and audit committees move to the Global Internal Audit Standards with confidence. That includes gap analyses, readiness reviews and internal audit external quality assessments (EQA), outsourced, co-sourced and interim internal audit delivered in conformance with the Standards, and training for audit committees and internal audit teams. We also support public sector and local government bodies preparing for the April 2025 changes. To discuss where your function stands, book a free 20-minute call.

Frequently asked questions

When did the Global Internal Audit Standards come into effect?

The IIA published the Global Internal Audit Standards on 9 January 2024 and they became effective on 9 January 2025. Internal audit functions are expected to conform with them from that date. In the UK public sector, the Standards apply together with an Application Note to engagements commenced on or after 1 April 2025.

Do the Global Internal Audit Standards apply to outsourced internal audit?

Yes. The Standards apply whether internal auditors are employed directly, contracted through an external service provider, or both. The provider's chief audit executive is responsible for conformance, but the board keeps its own responsibilities for supporting and overseeing the function.

What is the difference between the Global Internal Audit Standards and the 2017 IPPF?

The 2024 Standards bring the former Mission, Definition, Core Principles, Code of Ethics and Standards into one document organised into five domains and 15 principles. They add explicit essential conditions for boards and senior management, new requirements such as professional scepticism, and an explicit requirement for a documented internal audit strategy. Topical Requirements are also a new mandatory component of the framework.

References

1. The Institute of Internal Auditors, 16 January 2025. The IIA Celebrates the Effective Date of the Global Internal Audit Standards
2. The Institute of Internal Auditors, 9 January 2024. The IIA Releases New Global Internal Audit Standards to Lead Profession into the Future
3. The Institute of Internal Auditors, 6 February 2024. Two-way Mapping: 2017 IPPF Mandatory Elements to 2024 Global Internal Audit Standards (and Back)
4. The Institute of Internal Auditors, 9 January 2024. Global Internal Audit Standards
5. Chartered Institute of Internal Auditors, September 2024 (effective from January 2025). Internal Audit Code of Practice: Principles on effective internal audit in the financial services, private and third sectors
6. Relevant Internal Audit Standard Setters (published by CIPFA), December 2024. Application Note: Global Internal Audit Standards in the UK Public Sector