The International Standards for the Professional Practice of Internal Auditing (Standards)  are the result of careful study, consultation, and deliberation about the basic principles for providing internal audit services. All internal auditors should perform their work in accordance with the Standards . Members of The Institute of Internal Auditors (IIA) and Certified Internal Auditors (CIA) vow that they will comply with The IIA's Code of Ethics, which requires adherence with the Standards .

Standards are a part of the Professional Practices Framework . The purpose of the Standards is to:

1. Delineate basic principles that represent the practice of internal auditing as it should be.
2. Provide a framework for performing and promoting a broad range of value-added internal audit activities.
3. Establish the basis for the evaluation of internal audit performance.
4. Foster improved organizational processes and operations.

Effective January 2004, The Institute of Internal Auditors' (IIA) Internal Auditing Standards Board has significantly revised its International Standards for the Professional Practice of Internal Auditing ( Standards ). The  Standards  have been updated to reflect current risk management and governance requirements and also address consulting opportunities, as well as releasing engagement results to parties outside the organization. Incorporating numerous comments on issues received through the worldwide solicitation exposure process, the Board approved the Standards for implementation. Changes are highlighted in bold italics to allow readers to easily identify modifications and to also assist in the translation process. Currently, the English and Spanish versions of the revised Standards are posted on the web and the French translation will be posted when available.

Changes in Language and Content

Although specific guidance is expected to clarify many issues — including use of the word "should" which is introduced throughout the Standards to represent a mandatory obligation — the Standards are intended to have global application. This includes a basic assumption that internal auditor practitioners will exercise good judgment in application of concepts such as references to "appropriate parties," "acceptable level," and "as appropriate." 

Key changes and clarifications are:

• During the exposure process, The IIA received many comments surrounding the applicability of the Standard s to government auditors and to those who may be impacted by legal or regulatory issues. The Board has changed the introduction to address these concerns: "If internal auditors are prohibited by laws or regulations from complying with certain parts of the Standards , they should comply with all other parts of the Standards and make appropriate disclosures." 
• Consulting is not mandatory for internal auditors. The Standards provides guidance should an internal auditor choose to perform consulting services.
• Assurance and consulting services are further defined in the introduction to offer an understanding of the distinctive activities of each.
• Internal auditors should have knowledge of key information technology risks, controls, and available technology-based audit techniques to perform their assigned work. However, not all internal auditors are expected to have the expertise of an internal auditor whose primary responsibility is information technology auditing.
• Internal auditors should consider the use of computer-assisted audit tools and other data analysis techniques.
• Periodic internal and external quality assessments and ongoing internal monitoring should be part of a quality assurance and improvement program, designed to help the internal auditing activity add value and improve the organization's operations.  
• Final communication of engagement results should be issued, and where appropriate, include the internal auditor's overall opinion and/or conclusions.

Standards  provide guidance for the conduct of internal auditing at both the organizational and individual auditor levels. The Standards describe the nature of internal audit activities, key components of a charter and an annual plan of activities, ways of conducting an engagements and communicating results, and criteria for evaluating the performance of the services. 

Standards  comprise Attribute, Performance, and Implementation Standards. Attribute Standards  and Performance Standards  apply to all internal audit services. Implementation Standards apply to specific types of engagements, such as, assurance and consulting activities. These are contained within the Attribute and Performance Standards and are identified by either (assurance engagements) or (consulting engagements). Attribute and Performance Standards are cross referenced to related guidance material such as the Practice Advisories and the Development and Practice Aids.

In addition, the Standards are translated by many of IIA's global affiliates. Other languages are also available by request but may not reflect recent revisions.

Periodically, new or amended Standards are approved by The IIA's Internal Auditing Standards Board. Before making changes, the board releases an exposure draft of the proposed amendments, additions, and deletions for public comment. This exposure process is a critical step in the formulation and testing of concepts and the approval of new and amended Standards .

 

 

 

 

 

International Standards for the Professional Practice of Internal Auditing