Five Domains of the Global Internal Audit Standards Explained
Understanding the Framework for Modern Internal Auditing
The Institute of Internal Auditors (IIA) introduced its revised Global Internal Audit Standards in January 2024, with the standards becoming effective on January 9, 2025.
These standards establish a comprehensive framework for professional internal auditing and provide guidance for internal audit functions across industries, organizations, and jurisdictions.
One of the most important changes is the organization of the standards into five domains, supported by 15 principles and 52 standards.
For Chief Audit Executives, internal auditors, Audit Committees, and management, understanding these domains is essential to building an effective and independent internal audit function.
The five domains address the purpose of internal auditing, professional ethics, governance, management of the internal audit function, and performance of internal audit services.
The Five Domains at a Glance
Domain | Subject | Primary focus |
I | Purpose of Internal Auditing | Why internal auditing exists |
II | Ethics and Professionalism | How internal auditors must behave |
III | Governing the Internal Audit Function | Board oversight and organizational independence |
IV | Managing the Internal Audit Function | Strategy, resources, methodologies, and quality |
V | Performing Internal Audit Services | Planning, fieldwork, findings, and reporting |
Together, these domains provide an integrated approach to professional internal auditing.
Domain I — Purpose of Internal Auditing
Domain I establishes the fundamental purpose of internal auditing.
The Global Internal Audit Standards explain that internal auditing strengthens an organization's ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight.
This is a broader view of internal auditing than simply identifying control deficiencies.
Internal Audit should help organizations improve:
Governance
Risk management
Internal controls
Decision-making
Accountability
Organizational performance
An effective internal audit function does not merely report what went wrong.
It helps the organization understand risks, evaluate controls, and identify opportunities for improvement.
Domain I answers the question: Why does Internal Audit exist?
Domain II — Ethics and Professionalism
Domain II establishes the ethical and professional expectations for internal auditors.
It contains five principles:
Principle 1 — Demonstrate Integrity: Internal auditors must act honestly, courageously, and responsibly.
Principle 2 — Maintain Objectivity: Internal auditors must make impartial assessments and avoid conflicts of interest or inappropriate influence.
Principle 3 — Demonstrate Competency: Internal auditors must possess or obtain the knowledge, skills, and abilities necessary to perform their responsibilities.
Principle 4 — Exercise Due Professional Care: Internal auditors must apply appropriate diligence, judgment, and professional skepticism.
Principle 5 — Maintain Confidentiality: Internal auditors must appropriately protect and use information obtained through their work.
These principles are fundamental to the credibility of Internal Audit.
An auditor who lacks independence, competence, or objectivity cannot provide reliable assurance.
Domain II answers the question: How must internal auditors conduct themselves?
Domain III — Governing the Internal Audit Function
Domain III addresses the relationship between the internal audit function, the Board, and senior management.
It contains three principles:
Principle 6 — Authorized by the Board: The Board establishes and supports Internal Audit's mandate, authority, and responsibilities.
Principle 7 — Positioned Independently: The internal audit function must be positioned to operate independently and perform its responsibilities without inappropriate interference.
Principle 8 — Overseen by the Board: The Board provides oversight of the internal audit function, including its effectiveness and quality.
This domain is especially important for Audit Committees.
The Board should ensure that Internal Audit has an appropriate charter, organizational independence, adequate resources, and direct communication channels.
For example, a Chief Audit Executive who cannot communicate significant concerns directly to the Audit Committee may face a serious independence limitation.
Similarly, an internal audit function whose audit plan can be changed or restricted by management without appropriate Board oversight may not be positioned to provide effective assurance.
Domain III answers the question: Who authorizes, protects, and oversees Internal Audit?
Domain IV — Managing the Internal Audit Function
Domain IV establishes requirements for managing an effective internal audit function.
It contains three principles:
Principle 9 — Plan Strategically: The Chief Audit Executive develops an internal audit strategy and plans based on an understanding of organizational governance, risk management, and control processes.
Principle 10 — Manage Resources: The Chief Audit Executive manages financial, human, and technological resources to fulfill the internal audit mandate.
Principle 11 — Communicate Effectively: The Chief Audit Executive establishes effective communication with the Board, senior management, and other stakeholders.
Principle 12 — Enhance Quality: The Chief Audit Executive establishes and maintains processes to evaluate and improve the quality of the internal audit function.
Domain IV emphasizes that effective internal auditing requires more than technically competent auditors.
It requires an organized function with appropriate leadership, planning, methodologies, resources, communications, and quality management.
Domain IV answers the question: How should the internal audit function be managed?
Domain V — Performing Internal Audit Services
Domain V addresses the actual performance of internal audit engagements.
It contains three principles:
Principle 13 — Plan Engagements Effectively: Internal auditors establish engagement objectives, scope, criteria, and work programs based on relevant risks.
Principle 14 — Conduct Engagement Work: Internal auditors gather, analyze, and evaluate information to develop findings and conclusions.
Principle 15 — Communicate Engagement Conclusions and Monitor Action Plans: Internal auditors communicate results and monitor management's progress in addressing identified issues.
Domain V is particularly important for auditors responsible for fieldwork, testing, documentation, and reporting.
An effective internal audit engagement should demonstrate a clear relationship:
Risk → Objective → Scope → Procedures → Evidence → Findings → Conclusions → Corrective Actions
Audit findings should be supported by sufficient, reliable, relevant, and useful information.
Recommendations and action plans should address the underlying causes of identified problems.
Domain V answers the question: How should internal audit engagements be performed?
How the Five Domains Work Together
The five domains are not independent requirements.
They establish a connected professional framework.
For example:
An organization establishes the purpose of Internal Audit under Domain I.
Its auditors follow professional ethics under Domain II.
The Board authorizes and oversees the function under Domain III.
The Chief Audit Executive manages the function under Domain IV.
Internal auditors perform engagements under Domain V.
Weaknesses in one domain can undermine the others.
A technically strong audit department may still be ineffective if its independence is compromised.
Likewise, a properly authorized internal audit function may fail to provide meaningful assurance if its engagement planning, evidence, or reporting is inadequate.
What Audit Committees Should Understand
Audit Committees have a particularly important role under Domain III.
They should understand whether:
The Internal Audit Charter is appropriate.
The Chief Audit Executive has direct access to the Board.
Internal Audit is organizationally independent.
The audit plan addresses significant organizational risks.
Resources are sufficient to fulfill the audit mandate.
Significant findings are communicated without inappropriate interference.
Management's corrective actions are monitored.
Quality assessments are performed as required.
The Global Internal Audit Standards emphasize that effective governance of Internal Audit depends on the relationship among the Board, senior management, and the Chief Audit Executive.
An Audit Committee cannot provide meaningful oversight if it does not receive the information necessary to fulfill its responsibilities.
Common Implementation Challenges
Organizations transitioning to the revised standards may encounter several challenges:
Independence: Internal Audit may report administratively to management without sufficient functional oversight by the Board.
Charter deficiencies: The Internal Audit Charter may not adequately establish the function's mandate and authority.
Risk-based planning: Audit plans may focus on recurring compliance reviews rather than the organization's most significant risks.
Resource limitations: The department may lack necessary technology, expertise, or staffing.
Quality assurance: The organization may not have an effective quality assurance and improvement program.
Engagement documentation: Workpapers may not sufficiently support findings and conclusions.
Follow-up: Management's corrective actions may not be consistently monitored.
These issues should be addressed through a structured gap assessment against the standards.
A Practical Implementation Checklist
Chief Audit Executives and Audit Committees should consider the following questions:
Has the Internal Audit Charter been updated to reflect the Global Internal Audit Standards?
Does the Board formally authorize and oversee Internal Audit?
Is organizational independence adequately protected?
Have auditors received appropriate ethics and competency training?
Is there a documented internal audit strategy?
Is the annual audit plan based on organizational risks?
Are staffing, funding, and technology resources adequate?
Are engagement methodologies consistent with the standards?
Are findings and conclusions supported by appropriate evidence?
Does the department have a functioning quality assurance and improvement program?
These questions can serve as a starting point for evaluating readiness and ongoing conformance.
The Bottom Line
The Global Internal Audit Standards establish a comprehensive framework for professional internal auditing.
Their five domains address the complete internal audit function—from its purpose and professional ethics to governance, management, and engagement performance.
Domain I: Why Internal Audit exists.
Domain II: How internal auditors behave.
Domain III: How Internal Audit is governed.
Domain IV: How Internal Audit is managed.
Domain V: How internal audit services are performed.
Understanding these domains helps organizations establish internal audit functions that are independent, risk-based, professionally managed, and capable of providing meaningful assurance.
The value of Internal Audit depends not simply on completing audits, but on strengthening governance, risk management, and internal control.
Comments