Domain II: Ethics and Professionalism — The Five Principles Every Internal Auditor Must Follow
A Practical Guide to Integrity, Objectivity, Competency, Due Professional Care, and Confidentiality Under the Global Internal Audit Standards
John C. Blackshire, Jr. Corporate Compliance Seminars (CCS) | Internal Auditing Professional Development Series
In our previous article, Domain I: Purpose of Internal Auditing, we examined why internal auditing exists and how the profession helps organizations create, protect, and sustain value.
But understanding the purpose of internal auditing is only the beginning.
To fulfill that purpose, internal auditors must demonstrate ethical behavior, independent judgment, professional competence, appropriate care, and responsible treatment of information.
These expectations are established in Domain II: Ethics and Professionalism of The Institute of Internal Auditors' (IIA) Global Internal Audit Standards.
The Standards were issued January 9, 2024, and became effective January 9, 2025.
Domain II establishes the professional behavior expected of internal auditors, Chief Audit Executives (CAEs), and other individuals or organizations providing internal audit services.
It replaces the IIA's former standalone Code of Ethics and incorporates ethical expectations directly into the Global Internal Audit Standards.
The central message is straightforward: Internal auditors cannot provide credible assurance unless stakeholders can trust their integrity, objectivity, competence, professional judgment, and handling of confidential information.
1. Understanding Domain II: Ethics and Professionalism
Domain II contains five principles supported by 13 standards.
Principle | Professional expectation |
1. Demonstrate Integrity | Act honestly, ethically, and with professional courage |
2. Maintain Objectivity | Make impartial judgments free from inappropriate influence |
3. Demonstrate Competency | Possess and continually develop the knowledge and skills needed |
4. Exercise Due Professional Care | Perform audit work with appropriate diligence, judgment, and skepticism |
5. Maintain Confidentiality | Use and protect information appropriately |
These principles apply throughout the internal audit process.
They influence risk assessment, engagement planning, interviews, evidence gathering, testing, reporting, and communication with management and the Audit Committee.
They also establish expectations for how auditors behave when facing difficult professional situations.
An internal auditor may encounter pressure to change an audit finding, overlook a significant deficiency, avoid a sensitive investigation, or disclose confidential information.
Domain II provides the ethical foundation for responding appropriately.
2. Principle 1: Demonstrate Integrity
Integrity is the foundation of professional credibility.
Internal auditors must demonstrate honesty and professional courage, meet legitimate ethical expectations, and comply with applicable laws and regulations.
Integrity requires more than avoiding dishonest conduct.
It requires auditors to communicate truthfully and address difficult matters even when doing so may be uncomfortable.
Standard 1.1 — Honesty and Professional Courage
Internal auditors must perform their work honestly and demonstrate professional courage.
Professional courage becomes particularly important when audit findings involve senior management or influential individuals.
Consider an internal auditor who discovers that management has knowingly overstated revenue.
The CFO argues that the adjustment is temporary and asks the auditor to delay reporting the matter until the next quarter.
The auditor faces a professional challenge.
Maintaining integrity requires appropriate investigation, accurate documentation, and communication through established reporting channels.
The auditor should not suppress a finding merely because the issue is politically sensitive or because management disagrees with the conclusion.
Professional courage means communicating important facts and conclusions even when doing so creates personal or organizational discomfort.
Standard 1.2 — Organization's Ethical Expectations
Internal auditors must understand, respect, and contribute to the legitimate and ethical expectations of the organization.
They should also be able to recognize conduct inconsistent with those expectations.
For example, an organization may establish a code of conduct requiring employees to disclose conflicts of interest.
Internal auditors should follow those requirements and evaluate related risks when appropriate.
If an auditor discovers that senior executives are routinely circumventing conflict-of-interest disclosures, the matter may warrant escalation.
An organization's culture cannot justify conduct that conflicts with professional ethical requirements.
Standard 1.3 — Legal and Ethical Behavior
Internal auditors must comply with applicable laws and regulations and avoid conduct that could discredit the profession or organization.
For example, an auditor cannot improperly access employee records, falsify audit evidence, or conceal a known legal violation.
The auditor must also understand applicable obligations concerning reporting misconduct.
The appropriate reporting process depends on the facts, the law, organizational policies, and the Standards.
3. Principle 2: Maintain Objectivity
Objectivity is essential to credible internal auditing.
An internal auditor must be able to evaluate evidence and reach conclusions without bias, conflicts of interest, or inappropriate influence.
Objectivity is closely related to independence, but the concepts are not identical.
Organizational independence concerns how the internal audit function is positioned and governed.
Individual objectivity concerns the impartiality of an auditor's judgments and decisions.
Both are necessary.
Standard 2.1 — Individual Objectivity
Internal auditors must maintain an impartial and unbiased mindset when performing internal audit services.
Suppose an auditor is assigned to review a department managed by a close personal friend.
Even if the auditor believes they can remain impartial, the relationship may create an actual, potential, or perceived impairment.
The situation should be disclosed and appropriately evaluated.
Objectivity requires more than an auditor's personal belief that they can be fair.
Standard 2.2 — Safeguarding Objectivity
Internal auditors must recognize and avoid or mitigate impairments to objectivity.
Examples include:
Auditing work for which the auditor was recently responsible.
Accepting gifts that could influence professional judgment.
Having financial interests in an audited activity.
Maintaining relationships that create conflicts of interest.
Allowing management to influence audit scope or conclusions.
A common problem arises when internal auditors are asked to design or operate controls and later audit those same controls.
Providing advisory services can be appropriate.
However, the auditor must not assume management responsibility or create circumstances in which subsequent assurance work lacks objectivity.
Standard 2.3 — Disclosing Impairments to Objectivity
Internal auditors must disclose impairments to objectivity to appropriate parties.
For example, an auditor previously served as the Accounts Payable Manager and is now assigned to audit the same function.
The prior responsibility should be disclosed and the engagement assignment evaluated.
Depending on the circumstances, safeguards may include assigning another auditor or obtaining independent oversight.
The objective is to protect the credibility of the audit conclusion.
4. Principle 3: Demonstrate Competency
Internal auditors must possess or obtain the knowledge, skills, and abilities necessary to perform their responsibilities.
The profession has become increasingly technical.
Today's internal auditors may need to understand financial reporting, cybersecurity, artificial intelligence, data analytics, fraud risks, regulatory compliance, and complex business operations.
Competency is therefore not a one-time achievement.
It requires continuous professional development.
Standard 3.1 — Competency
Internal auditors must possess or obtain the competencies necessary to fulfill their responsibilities successfully.
Consider an auditor assigned to evaluate cybersecurity controls.
If the auditor does not understand network architecture, identity management, or cybersecurity risk assessment, the engagement may not produce reliable conclusions.
The Chief Audit Executive should determine whether the function has the necessary skills.
When specialized knowledge is unavailable internally, the function may need training, external expertise, or other appropriate resources.
Auditors should not represent themselves as competent in areas where they lack the knowledge necessary to perform reliable work.
Standard 3.2 — Continuing Professional Development
Internal auditors must maintain and continually develop their professional competencies.
Professional development may include:
Continuing professional education.
Professional certifications.
Technical training.
Industry conferences.
Professional research.
Mentoring and supervised experience.
Training in emerging technologies and risks.
The objective is not merely to accumulate CPE hours.
The objective is to maintain the competence necessary to perform effective internal auditing.
For example, an internal auditor who has not updated their understanding of artificial intelligence may be poorly prepared to evaluate an organization's AI governance framework.
Similarly, auditors working in banking, insurance, or government must remain informed about relevant regulatory and professional developments.
5. Principle 4: Exercise Due Professional Care
Due professional care requires auditors to apply appropriate diligence, judgment, and professional skepticism.
It does not mean that every audit must examine every transaction or identify every possible error.
It means the auditor must perform work appropriate to the engagement's objectives, risks, and circumstances.
Standard 4.1 — Conformance With the Global Internal Audit Standards
Internal auditors must plan and perform internal audit services in accordance with the
Global Internal Audit Standards, subject to the Standards' provisions addressing circumstances in which conformance is not possible.
This expectation applies throughout the audit process.
For example, an auditor should not issue a conclusion without sufficient relevant, reliable evidence merely because management wants the engagement completed quickly.
The Standards establish a professional framework for the quality and credibility of internal audit services.
Standard 4.2 — Due Professional Care
Internal auditors must exercise due professional care when performing their responsibilities.
This includes considering the organization's strategy and objectives, the significance of risks, the adequacy and effectiveness of governance and controls, the cost of assurance relative to potential benefits, and the likelihood of significant errors, fraud, or noncompliance.
Suppose an auditor is examining vendor payments.
The population contains 100,000 transactions.
A poorly planned engagement might select a few transactions without evaluating the population, risk characteristics, or sampling methodology.
A properly planned engagement would consider the audit objective, relevant risks, materiality or significance, data reliability, and procedures needed to support the conclusion.
Due professional care requires a disciplined approach.
Standard 4.3 — Professional Skepticism
Professional skepticism requires auditors to maintain a questioning mindset and critically assess information.
This is especially important when management provides explanations that are not supported by independent evidence.
For example, management explains that a large year-end journal entry was necessary to correct a system problem.
The auditor should evaluate the explanation, examine supporting documentation, and consider whether the entry is consistent with other available evidence.
Professional skepticism does not mean assuming management is dishonest.
It means avoiding unsupported assumptions about the reliability of management's representations.
Auditors must be willing to challenge explanations, evaluate contradictory evidence, and reconsider conclusions when the facts warrant it.
6. Principle 5: Maintain Confidentiality
Internal auditors routinely receive access to sensitive information.
That information may include financial results, personnel records, customer information, cybersecurity vulnerabilities, legal matters, and confidential business strategies.
Access to information creates professional responsibilities.
Auditors must use information appropriately and protect it from unauthorized disclosure.
Standard 5.1 — Use of Information
Internal auditors must use information only for legitimate professional purposes.
They should not use confidential information for personal benefit or in a manner contrary to applicable requirements.
For example, an auditor reviewing a confidential acquisition should not use that information to trade securities or disclose the proposed transaction to others.
Similarly, information obtained during an employee investigation should not be used for personal or unrelated purposes.
Standard 5.2 — Protection of Information
Internal auditors must protect information acquired or produced during their work.
Appropriate safeguards may include secure storage, access restrictions, encryption, retention procedures, and secure communication methods.
Consider an internal audit engagement involving employee payroll information.
The audit team may have access to Social Security numbers, compensation details, banking information, and personnel records.
That information should be handled according to applicable legal requirements and organizational policies.
Confidentiality responsibilities also apply when auditors use external technology platforms, including AI systems.
Uploading confidential audit workpapers or customer records into an unapproved AI application can create significant data security and confidentiality risks.
7. The Five Principles and Their Supporting Standards
The following table provides a practical reference.
Principle | Standard | Primary focus |
1. Integrity | 1.1 Honesty and Professional Courage | Truthful conduct and willingness to address difficult matters |
1.2 Organization's Ethical Expectations | Respecting and supporting legitimate ethical expectations | |
1.3 Legal and Ethical Behavior | Compliance with laws and ethical requirements | |
2. Objectivity | 2.1 Individual Objectivity | Impartial professional judgment |
2.2 Safeguarding Objectivity | Avoiding or mitigating impairments | |
2.3 Disclosing Impairments to Objectivity | Appropriate disclosure of impairments | |
3. Competency | 3.1 Competency | Necessary knowledge, skills, and abilities |
3.2 Continuing Professional Development | Ongoing professional learning | |
4. Due Professional Care | 4.1 Conformance With the Global Internal Audit Standards | Performing work in accordance with professional requirements |
4.2 Due Professional Care | Appropriate diligence and professional judgment | |
4.3 Professional Skepticism | Questioning and critically evaluating evidence | |
5. Confidentiality | 5.1 Use of Information | Appropriate professional use of information |
5.2 Protection of Information | Safeguarding sensitive information |
Together, these 13 standards establish the behavioral and professional foundation of effective internal auditing.
8. Practical Case Study: Management Pressures Internal Audit to Change a Finding
Consider the following situation.
An internal audit department identifies significant weaknesses in the organization's vendor master file controls.
The audit team discovers that several employees can change vendor banking information without independent verification.
The weaknesses expose the organization to payment diversion and fraud.
The Chief Financial Officer reviews the draft audit report and asks the Chief Audit Executive to remove the finding because it could embarrass management.
The CFO also suggests that the audit team has misunderstood the process.
How should the internal audit function respond?
Integrity
The auditors must communicate findings honestly and demonstrate professional courage.
They should not remove a supported finding merely to avoid embarrassing management.
Objectivity
The auditors must evaluate management's response fairly.
If management provides new evidence demonstrating that the finding is incorrect, the conclusion should be revised.
If the evidence continues to support the finding, the auditors should not change the conclusion because of pressure.
Competency
The audit team must understand vendor master file controls, banking-information changes, fraud risks, and relevant information systems.
Due Professional Care
The auditors must evaluate whether the evidence is sufficient, relevant, and reliable.
They should also assess the significance of the exposure and whether the finding is properly supported.
Confidentiality
The audit team must protect sensitive vendor information and details about the control vulnerabilities.
Appropriate escalation
If management attempts to interfere with audit conclusions, the CAE should follow the applicable governance and communication requirements, including communication with the Board or Audit Committee when appropriate.
This case demonstrates why Domain II is essential.
The quality of an audit depends not only on technical procedures but also on the professional behavior of the people performing them.
9. Domain II and the Chief Audit Executive
The Chief Audit Executive has an important leadership role in establishing an ethical and professional internal audit culture.
The CAE should demonstrate the behaviors expected of the audit team.
This includes maintaining objectivity, supporting professional development, establishing safeguards for confidential information, and ensuring that audit conclusions are supported by evidence.
The CAE should also establish practical processes for identifying conflicts of interest and addressing potential impairments.
For example, an internal audit department may maintain annual conflict-of-interest declarations and require engagement-specific independence confirmations.
These processes provide evidence that objectivity is being actively considered.
The CAE should also ensure that auditors receive appropriate supervision and review.
Ethical expectations should be reinforced through everyday decisions, not merely through annual policy acknowledgments.
10. Domain II and Audit Committee Oversight
The Audit Committee should understand whether the internal audit function operates in accordance with professional ethical expectations.
The Committee should consider questions such as:
Does the CAE demonstrate integrity and professional courage?
Can internal auditors report significant findings without management interference?
Are conflicts of interest appropriately disclosed?
Does the audit team possess the necessary competencies?
Is continuing professional development supported?
Are significant audit conclusions supported by reliable evidence?
Does the function maintain appropriate confidentiality safeguards?
Are ethical concerns and objectivity impairments escalated when necessary?
The Committee should also recognize that management owns the organization's internal control framework.
Internal audit evaluates governance, risk management, and control processes.
It should not become responsible for operating the controls it subsequently audits.
That separation is important to maintaining objectivity.
11. Professional Skepticism: One of the Most Important Audit Skills
Professional skepticism deserves particular attention because it affects nearly every internal audit engagement.
Auditors routinely receive explanations from management and employees.
Those explanations may be accurate, incomplete, mistaken, or occasionally intentionally misleading.
A professional auditor must evaluate the evidence rather than simply accept the explanation.
For example, consider a manager who explains that an unusual payment was an emergency transaction approved verbally by the CEO.
The auditor should consider whether the approval can be corroborated, whether the transaction was legitimate, and whether the process complied with applicable requirements.
The auditor should also consider contradictory evidence.
A verbal explanation alone may not provide sufficient support.
Professional skepticism is not hostility toward management.
It is a disciplined approach to evaluating information.
12. How Artificial Intelligence Creates New Domain II Challenges
AI is creating new ethical and professional considerations for internal auditors.
The technology can assist with risk assessment, data analysis, audit planning, documentation, and reporting.
However, AI also introduces risks involving accuracy, confidentiality, bias, and overreliance on automated outputs.
Integrity
Auditors should not present AI-generated information as verified audit evidence when it has not been validated.
Objectivity
Auditors should evaluate whether AI outputs contain biases that could affect conclusions.
Competency
Auditors must understand the capabilities and limitations of AI tools they use.
Due Professional Care
AI-generated calculations, citations, summaries, and conclusions require appropriate review and validation.
Confidentiality
Sensitive audit information should not be uploaded into unauthorized systems.
The fundamental principle is that AI does not replace the auditor's professional responsibilities.
The auditor remains accountable for the work performed and the conclusions communicated.
13. Common Ethical and Professional Failures in Internal Auditing
Several recurring practices can undermine the credibility of an internal audit function.
Suppressing significant findings: Removing or weakening conclusions because management objects.
Accepting management explanations without verification: Failing to obtain sufficient supporting evidence.
Auditing one's own work: Performing assurance over activities for which the auditor previously had management responsibility without appropriate safeguards.
Performing work without adequate competence: Accepting assignments that exceed available expertise without obtaining necessary assistance.
Inadequate supervision: Issuing conclusions without appropriate review of audit work.
Misusing confidential information: Sharing sensitive information beyond legitimate professional needs.
Failing to challenge contradictory evidence: Ignoring information that conflicts with an initial conclusion.
Inappropriate use of AI: Relying on unverified AI outputs or disclosing confidential information through unauthorized tools.
These failures can undermine confidence in internal audit even when the department has technically completed its assigned engagements.
14. How to Evaluate Conformance With Domain II
Chief Audit Executives can evaluate their functions using a practical self-assessment.
Evaluation area | Suggested evidence |
Integrity | Ethics policies, reporting protocols, and documented escalation of significant issues |
Objectivity | Conflict-of-interest declarations and engagement assignment reviews |
Competency | Skills assessments, certifications, and training records |
Due professional care | Audit methodology, workpaper reviews, and quality assessments |
Professional skepticism | Evidence evaluation, corroboration, and resolution of contradictory information |
Confidentiality | Information security procedures, access controls, and retention requirements |
A self-assessment should not be limited to confirming that policies exist.
The CAE should evaluate whether those policies are actually followed.
For example, an internal audit department may have a conflict-of-interest policy but fail to require disclosures before assigning engagements.
Similarly, a department may have detailed audit procedures but routinely issue reports without sufficient supervisory review.
Conformance requires appropriate professional behavior in practice.
15. Connecting Domain II Back to Domain I
Domain I establishes the purpose of internal auditing.
Domain II establishes the ethical and professional foundation necessary to fulfill that purpose.
The connection can be summarized as follows.
Domain I objective | Domain II contribution |
Create organizational value | Competent, objective advice and insight |
Protect organizational value | Integrity, skepticism, and reliable assurance |
Sustain organizational value | Professional development and due professional care |
Strengthen governance | Honest communication and professional courage |
Support stakeholder confidence | Objectivity and confidentiality |
An internal audit function cannot strengthen organizational governance if its auditors are unwilling to report significant weaknesses.
It cannot provide reliable assurance if auditors lack the necessary competence.
It cannot support informed decisions if its conclusions are biased or unsupported.
And it cannot maintain stakeholder confidence if confidential information is mishandled.
Domain II converts the purpose of internal auditing into expectations for how auditors must behave.
16. What Internal Audit Departments Should Do Now
Organizations should evaluate whether their internal audit policies and practices adequately address the Domain II requirements.
Recommended actions include:
Review the internal audit code of conduct and professional expectations.
Establish clear conflict-of-interest disclosure procedures.
Evaluate safeguards for individual auditor objectivity.
Conduct a competency assessment of the audit team.
Develop continuing professional development plans.
Review audit methodologies for due professional care and skepticism.
Establish clear protocols for escalating significant ethical concerns.
Evaluate confidentiality and information security practices.
Address the use of AI in internal audit policies and procedures.
Include Domain II conformance in the internal audit quality assurance and improvement program.
These actions can help strengthen both professional conduct and audit quality.
They should be adapted to the size, complexity, and risk profile of the internal audit function.
Conclusion: Ethics and Professionalism Are the Foundation of Credible Internal Auditing
Domain II of the Global Internal Audit Standards establishes the ethical and professional expectations that make internal auditing credible.
Its five principles—integrity, objectivity, competency, due professional care, and confidentiality—are not merely statements of professional ideals.
They influence how auditors perform their work, evaluate evidence, communicate findings, and respond to pressure.
An internal auditor must be willing to challenge management when the evidence supports a difficult conclusion.
The auditor must also remain objective, recognize personal limitations, exercise professional skepticism, and protect confidential information.
The Chief Audit Executive must establish a culture in which these behaviors are expected and supported.
The Audit Committee must provide governance oversight that allows the internal audit function to fulfill its responsibilities without inappropriate interference.
Domain I explains why internal auditing exists. Domain II explains the professional conduct required for internal auditing to deserve the trust placed in it.
Without ethics and professionalism, internal auditing becomes an activity.
With ethics and professionalism, it becomes a credible source of independent assurance, advice, insight, and foresight.
Continue Your Professional Development With Corporate Compliance Seminars
Corporate Compliance Seminars (CCS) offers continuing professional education covering the Global Internal Audit Standards, professional ethics, audit planning, audit evidence, internal controls, governance, risk management, and internal audit tradecraft.
Our training programs help internal auditors, Chief Audit Executives, and Audit Committee members understand professional requirements and apply them in real-world situations.
Explore upcoming CPE programs at https://www.compliance-seminars.com/.
Comments