Domain I: Purpose of Internal Auditing — Why Internal Audit Must Create, Protect, and Sustain Organizational Value
Understanding Domain I of the IIA Global Internal Audit Standards
The Institute of Internal Auditors (IIA) fundamentally strengthened the way the profession explains its role with the introduction of the 2024 Global Internal Audit Standards, effective January 9, 2025.
At the beginning of these Standards is Domain I: Purpose of Internal Auditing.
This domain addresses a question that every Chief Audit Executive (CAE), internal auditor, Audit Committee member, and senior executive should understand:
Why does an organization need an internal audit function, and what value should that function deliver?
The answer extends well beyond evaluating compliance with policies, reviewing financial transactions, and reporting internal control deficiencies.
Domain I positions internal auditing as an independent, risk-based activity that strengthens an organization's ability to achieve its objectives, make better decisions, and protect its long-term interests.
For internal auditors, this represents an important professional expectation: the objective is not merely to complete the annual audit plan.
The objective is to help the organization succeed.
1. What Is Domain I: Purpose of Internal Auditing?
Domain I is the first of five domains in the IIA Global Internal Audit Standards.
Its purpose statement explains the value that internal auditing should provide to the Board, management, and other stakeholders.
The domain emphasizes that internal auditing strengthens an organization's ability to create, protect, and sustain value through independent and objective work.
It identifies five areas in which internal auditing enhances organizational performance:
Achievement of organizational objectives.
Governance, risk management, and control processes.
Decision-making and oversight.
Reputation and stakeholder credibility.
The organization's ability to serve the public interest.
The domain also identifies conditions that make internal auditing most effective, including professional competence, conformance with the Standards, organizational independence, and freedom from undue influence.
An important technical distinction is that Domain I contains the overarching purpose statement, not a separately numbered principle or set of detailed requirements. The 15 principles and supporting standards are organized within Domains II through V.
2. Creating Value: Internal Audit Should Help the Organization Succeed
Creating value means contributing to better organizational performance.
Internal auditors should understand the organization's strategic objectives and identify the risks that could prevent management from achieving them.
For example, consider a company planning to expand into a new geographic market.
The expansion may involve risks associated with:
Regulatory compliance.
Financial reporting.
Cybersecurity.
Third-party relationships.
Operational capacity.
Staffing and organizational competence.
Capital allocation.
An internal audit engagement that evaluates these risks before the expansion may provide more value than an audit performed only after problems emerge.
Internal auditors can identify control gaps, challenge assumptions, and provide recommendations that help management make better-informed decisions.
However, internal auditors must avoid assuming management responsibilities.
They may evaluate and advise on a proposed control framework, but management remains responsible for selecting and implementing the controls.
Creating value does not mean managing the business. It means providing independent assurance and insight that improve management's ability to manage the business.
3. Protecting Value: Internal Audit as an Independent Line of Assurance
Organizations create value through their people, processes, assets, products, and relationships.
They protect that value through effective governance, risk management, and internal controls.
Internal audit contributes by independently evaluating whether those arrangements are appropriately designed and operating effectively.
Examples include:
Risk area | How internal audit protects value |
Financial reporting | Evaluates controls supporting reliable financial information |
Fraud | Assesses fraud risks and preventive and detective controls |
Cybersecurity | Evaluates governance and controls over information security |
Procurement | Reviews vendor onboarding, approvals, and payment controls |
Compliance | Evaluates controls supporting legal and regulatory obligations |
Business continuity | Assesses organizational resilience and recovery arrangements |
Data governance | Reviews data quality, access, retention, and integrity |
Consider a procurement department that processes $200 million annually.
Internal audit identifies weaknesses in vendor banking-information changes.
Management implements stronger authentication and independent approval controls.
The organization has improved its ability to prevent payment diversion and business email compromise.
The value of the audit is not simply the number of findings reported.
It is the improved protection of organizational assets.
4. Sustaining Value: Looking Beyond Today's Control Environment
Sustaining value requires a longer-term perspective.
An organization may have adequate controls today but face emerging risks that threaten its future.
Internal audit should consider whether governance and risk management processes are capable of responding to changes in the business environment.
Examples include artificial intelligence, changing regulatory requirements, workforce transitions, technology modernization, demographic shifts, and new business models.
A company that successfully manages current operations may still be exposed to substantial future risks.
Internal audit adds value by helping the Board and management understand whether the organization is prepared.
This is where the concept of foresight becomes especially important.
The auditor should not merely identify what went wrong.
The auditor should also recognize emerging conditions that could cause future failures.
5. The Five Areas of Organizational Improvement
Domain I identifies five ways internal auditing enhances an organization.
Achievement of objectives
Internal auditing should understand what the organization is trying to accomplish.
Audit planning should connect significant risks and audit engagements to organizational objectives.
A risk-based audit plan should therefore be more than a list of departments scheduled for review.
Governance, risk management, and control
Internal auditing evaluates the processes through which the organization is directed, risks are managed, and controls are established.
This includes examining whether the Board receives reliable information, management appropriately identifies risks, and control deficiencies are addressed.
Decision-making and oversight
Boards and executives need credible information to make decisions.
Internal audit can challenge assumptions, identify information gaps, and communicate significant risks that management may have underestimated.
Reputation and stakeholder credibility
Internal control failures can damage an organization's reputation even when the immediate financial losses are relatively small.
Independent internal auditing can strengthen stakeholder confidence by providing credible assurance.
Serving the public interest
Internal auditing also has consequences beyond the organization itself.
Reliable financial reporting, ethical conduct, regulatory compliance, and responsible stewardship can protect customers, employees, investors, taxpayers, and other stakeholders.
This is especially important in banking, insurance, healthcare, government, and public education.
6. Assurance, Advice, Insight, and Foresight
Domain I emphasizes four complementary contributions that internal audit can provide.
Contribution | Meaning | Example |
Assurance | Independent evaluation supported by evidence | Determine whether access controls operate effectively |
Advice | Recommendations and professional guidance | Recommend stronger segregation of duties |
Insight | Understanding the causes and implications of risks | Identify why vendor payment errors are increasing |
Foresight | Perspective on emerging risks and future consequences | Evaluate governance risks associated with AI adoption |
These contributions should work together.
An auditor may provide assurance that a control is ineffective, insight into why it failed, advice on possible improvements, and foresight concerning the consequences if the issue remains unresolved.
The auditor must maintain objectivity throughout the engagement.
Providing advice does not authorize the auditor to make management decisions.
7. Why Organizational Independence Is Essential
Domain I identifies organizational independence as a condition for effective internal auditing.
The internal audit function should be positioned so that it can evaluate significant risks without inappropriate interference.
The Chief Audit Executive should have direct accountability to the Board, consistent with the governance arrangements established under the Standards.
In practice, the Board or Audit Committee should have appropriate involvement in the internal audit mandate, charter, planning, resources, and performance.
This is especially important when internal audit identifies problems involving senior management.
For example, suppose the CFO is responsible for financial reporting controls and internal audit identifies significant deficiencies in those controls.
If the CFO can suppress the findings, restrict audit scope, or prevent communication with the Audit Committee, the internal audit function's independence is compromised.
Internal audit must be able to report significant matters through an appropriate governance channel.
The Board must support that independence.
8. Management Owns the Internal Control Framework
One of the most important distinctions in internal auditing is the separation between management responsibility and internal audit responsibility.
Management owns and operates the organization's internal control framework.
Management establishes policies, assigns responsibilities, identifies risks, implements controls, monitors performance, and corrects deficiencies.
Internal audit evaluates those processes.
This distinction is consistent with the IIA Three Lines Model.
The governing body is accountable for organizational oversight.
Management's first- and second-line roles manage risks and maintain controls.
Internal audit provides independent assurance and advice.
A common governance mistake is treating internal audit as the department responsible for making the organization compliant.
That is incorrect.
Internal audit may identify a compliance weakness and recommend corrective action.
Management must own the corrective action.
The Audit Committee should oversee the effectiveness of the resulting process.
Internal audit cannot substitute for management accountability.
9. Domain I and the Audit Committee
The Audit Committee plays an important role in ensuring that internal auditing can fulfill its purpose.
An effective Audit Committee should understand the organization's significant risks and determine whether internal audit is positioned to provide credible assurance.
The Committee should regularly consider questions such as:
Does internal audit have unrestricted access to relevant records and personnel?
Can the CAE communicate directly with the Committee?
Is the risk-based audit plan aligned with the organization's significant objectives and risks?
Does internal audit have sufficient resources and competence?
Are significant findings communicated without inappropriate filtering?
Does management respond to audit recommendations?
Are unresolved high-risk matters escalated?
Does internal audit provide meaningful insight into emerging risks?
An Audit Committee that merely receives completed audit reports may not be exercising sufficiently effective oversight.
The Committee should also evaluate whether the internal audit function is addressing the risks that matter most.
10. Moving Beyond a Checklist Audit Culture
Many internal audit departments historically measured productivity through activity-based indicators.
Examples include the number of audits completed, number of findings issued, hours charged, and percentage of the audit plan completed.
These measures may be useful for managing the function.
However, they do not necessarily demonstrate organizational value.
An internal audit department can complete every scheduled engagement and still fail to identify an emerging risk that threatens the organization's future.
Conversely, one well-timed audit of a critical risk may create more value than several routine compliance reviews.
Domain I encourages a broader view.
Internal audit should consider whether its work contributes to stronger governance, better risk decisions, more effective controls, and achievement of organizational objectives.
This does not eliminate the need for disciplined audit execution.
It places that execution within a larger professional purpose.
11. Practical Example: Auditing an Accounts Payable Function
Consider a company processing 250,000 vendor invoices annually.
A traditional audit might test whether invoices were approved and properly recorded.
Those procedures remain important.
However, a Domain I-oriented engagement would begin by understanding the organization's objectives and significant risks.
The auditor might examine:
Operational objectives: Are invoices processed accurately and on time?
Financial objectives: Are duplicate payments, incorrect prices, and unauthorized expenditures prevented or detected?
Compliance objectives: Are tax reporting and record retention requirements satisfied?
Technology risks: Are vendor master data changes appropriately controlled?
Fraud risks: Could a fraudulent request redirect payments to an unauthorized bank account?
Emerging risks: Could AI-generated invoices, impersonation, or deepfake communications defeat existing verification procedures?
The resulting engagement provides assurance while also delivering insight into the causes of weaknesses and potential future risks.
That is a practical application of Domain I.
12. Integrating Domain I Into Risk-Based Audit Planning
The Chief Audit Executive should ensure that the internal audit strategy and risk-based plan support the purpose of internal auditing.
A practical approach includes six steps.
Step 1: Understand organizational objectives
Review strategic plans, budgets, operating priorities, and governance expectations.
Step 2: Identify significant risks
Evaluate risks that could materially affect the achievement of objectives.
Step 3: Develop the audit universe
Identify auditable entities, processes, systems, programs, and risk areas.
Step 4: Prioritize engagements
Consider risk significance, management controls, prior audit results, changes, and available assurance.
Step 5: Align resources
Ensure the audit function has the competence and capacity to address significant risks.
Step 6: Communicate the value of the plan
Explain how planned engagements support organizational objectives, governance, risk management, and control.
This approach links the purpose of internal auditing to the management of the function under Domain IV.
13. Domain I and the Other Four Domains
The Global Internal Audit Standards are organized into five domains.
Domain | Focus |
I — Purpose of Internal Auditing | Why internal auditing exists and the value it provides |
II — Ethics and Professionalism | Professional behavior, integrity, objectivity, competence, due care, and confidentiality |
III — Governing the Internal Audit Function | Board authorization, independence, and oversight |
IV — Managing the Internal Audit Function | Strategy, planning, resources, communication, and quality |
V — Performing Internal Audit Services | Engagement planning, execution, reporting, and monitoring |
Domain I establishes the overarching purpose.
The remaining domains establish the principles and requirements that enable the function to fulfill that purpose.
For example, an auditor cannot provide credible assurance without the objectivity emphasized in Domain II.
The function cannot operate independently without appropriate governance under Domain III.
It cannot consistently address important risks without effective planning under Domain IV.
And it cannot provide defensible conclusions without the engagement practices established in Domain V.
14. How to Evaluate Whether Internal Audit Is Delivering Value
The Board and CAE should use both quantitative and qualitative measures.
Potential measures include:
Measurement | What it helps evaluate |
Coverage of significant organizational risks | Alignment with strategic and operational priorities |
Timely communication of critical risks | Responsiveness to emerging issues |
Management action plan completion | Progress in addressing identified deficiencies |
Repeat findings | Persistence of unresolved control problems |
Stakeholder feedback | Usefulness and clarity of audit communications |
Quality assessment results | Conformance and effectiveness of the function |
Advisory engagement outcomes | Contribution to improved decisions and controls |
No single measure fully captures internal audit value.
For example, a low number of findings does not necessarily indicate poor performance, and a high number does not necessarily indicate strong performance.
The appropriate question is whether internal audit is providing reliable, relevant information that strengthens the organization's ability to achieve its objectives.
15. Common Mistakes in Applying Domain I
Mistake 1: Treating internal audit as a compliance department
Compliance is important, but the internal audit purpose extends to governance, risk management, operations, and strategic objectives.
Mistake 2: Confusing assurance with management responsibility
Internal audit evaluates controls; management establishes and operates them.
Mistake 3: Focusing exclusively on historical transactions
Internal audit should also consider emerging risks and future consequences.
Mistake 4: Measuring value only by completed audits
Audit activity is not the same as organizational impact.
Mistake 5: Allowing management to control audit conclusions
The internal audit function must preserve objectivity and appropriate access to the Board.
Mistake 6: Ignoring the public interest
In organizations that affect customers, investors, taxpayers, or communities, internal audit work can have consequences beyond internal operations.
Mistake 7: Treating Domain I as a standalone compliance checklist
Domain I is a purpose statement. Its implementation is demonstrated through the governance, management, and engagement practices addressed in the other domains.
16. A Domain I Self-Assessment for Internal Audit Departments
Chief Audit Executives can use the following questions to evaluate whether their functions are fulfilling the purpose of internal auditing.
Question | Evidence to consider |
Does the audit plan address significant organizational risks? | Risk assessment and approved plan |
Does the function provide independent assurance? | Reporting structure and audit communications |
Does internal audit contribute to better decision-making? | Board reporting and advisory results |
Are emerging risks considered? | Audit strategy and planning records |
Does the CAE have appropriate access to the Board? | Charter, minutes, and communications |
Are auditors sufficiently competent? | Skills assessments and training plans |
Are management responsibilities clearly separated from internal audit? | Charter and engagement responsibilities |
Does the function communicate significant deficiencies? | Audit reports and escalation records |
Are corrective actions monitored? | Follow-up and issue tracking |
Is the function evaluated for quality and effectiveness? | Quality assurance and improvement program |
These questions are suggested management and governance tools, not additional requirements created by Domain I.
17. What Domain I Means for the Future of Internal Auditing
Internal auditing is operating in an environment of increasingly complex risks.
Artificial intelligence, cybersecurity, regulatory change, economic uncertainty, and rapidly evolving business models require auditors to understand more than traditional accounting and compliance processes.
Auditors must combine technical competence with organizational understanding.
They must be capable of challenging assumptions, recognizing emerging risks, and communicating difficult findings to senior leadership.
They must also understand the limits of their role.
Internal auditors should provide objective assurance and advice without becoming responsible for the decisions they evaluate.
The profession's credibility depends on maintaining that distinction.
Domain I gives internal auditors a clear statement of their purpose and a basis for explaining why their work matters.
Conclusion: Internal Audit Exists to Strengthen the Organization
Domain I of the Global Internal Audit Standards establishes an important expectation for the profession.
Internal auditing should strengthen an organization's ability to create, protect, and sustain value.
That requires more than completing audit programs or reporting deficiencies.
It requires understanding organizational objectives, evaluating significant risks, challenging management assumptions, providing credible assurance, and communicating useful insight.
The Board must support internal audit independence.
Management must remain accountable for governance, risk management, and internal controls.
The Chief Audit Executive must ensure that the function is appropriately positioned, competently managed, and focused on the organization's most significant risks.
The ultimate measure of internal audit effectiveness is not the number of audits completed. It is whether the function provides independent assurance and insight that help the organization make better decisions, manage risks, and achieve its objectives.
That is the purpose of internal auditing.
Strengthen Your Understanding of the Global Internal Audit Standards
Corporate Compliance Seminars (CCS) provides continuing professional education for internal auditors, Chief Audit Executives, Audit Committee members, and other governance professionals.
Our programs address the Global Internal Audit Standards, risk-based audit planning, internal control evaluation, audit evidence, audit reporting, and the professional skills needed to perform effective internal audits.
Explore our training programs at www.compliance-seminars.com.
Comments