IIA's Proposed Standards

In March 2023, the Institute of Internal Auditors (IIA) released the Proposed Standards for public comment until May 30, 2023. The IIA has long communicated its overall goal to refresh the Global Internal Audit Standards (Standards) to provide enhanced guidance to ensure value, quality, and effectiveness of the profession’s services. The Standards apply to internal audit departments globally, regardless of purpose, size, complexity or structure, and are designed to provide guidance to internal audit functions operating at all levels of maturity.

While there are many structural improvements in the Proposed Standards, including the provision of implementation guidance for each Standard and the consolidation of the various Standard supporting documents into a single document, they also represent a shift for the internal audit (IA) profession. They are organized into five domains: Purpose of Internal Auditing; Ethics and Professionalism; Governing the Internal Audit Function; Managing the Internal Audit Function; and Performing Internal Audit Services. We have summarized the three foundational themes and key changes that would impact various IA functions should the Proposed Standards be implemented.

Although many of the changes within the Proposed Standards focus on foundational elements of the profession, IA departments may find themselves equally impacted by other key changes if the Proposed Standards are implemented:

Focus on formal development of methodologies to guide the IA function:

Although many IA departments have charters and high-level methodologies for their function, the Proposed Standards are more prescriptive and outline specific methodologies and policies to be documented. In addition, the Proposed Standards require appropriate training on all policies and evidence of compliance with the policies.

Engagement findings and conclusions:

The Proposed Standards require IA departments to issue a rating or ranking, or other indication of priority/significance, for individual findings as well as the overall audit. Current Standards require IA to communicate the findings and results of the audit, but do not require a rating, ranking, or other indication of priority/significance.

Recommended CEO reporting alignment:

Although not mandated, the Proposed Standards recommend IA departments report administratively to the CEO to reach a level of authority appropriate to challenge management on assumptions and operations. The Proposed Standards further state IA functions can achieve the same objective by implementing appropriate safeguards.

Enhanced requirements for external quality assessments:

The Proposed Standards allow a self-assessment with independent validation once every ten years, alternating with a full external assessment. A full external assessment is always permitted to satisfy this requirement. Further, the Proposed Standards require that at least one member of the assessment team be an active Certified Internal Auditor and all team members be trained through the IIA’s external quality assessment training.

Conformance with information protection procedures:

Evidence of conformance with the organization’s information protection policies is required by the Proposed Standards, including acknowledgment from internal auditors of their understanding. Depending on the maturity of a CAE’s organization’s information protection policies, the CAE may need to create supplemental material to educate and inform the IA department of all appropriate requirements.

Requirement for 20 hours of professional development:

While current Standards require internal auditors to have the requisite knowledge needed to conduct an audit, the Proposed Standards require 20 hours of continuing professional development training. CAEs would need to consider this new requirement when planning departmental training budgets for the year.

Read our paper for more information about the foundational themes and important changes outlined in the Proposed Standards: