Global Internal Audit Standards — Domain III: Governing the Internal Audit Function
For CCS, this topic should focus on a critical governance distinction: the board is accountable for overseeing the internal audit function, senior management supports its effectiveness, and the chief audit executive manages the function.
Domain III of the IIA's Global Internal Audit Standards, effective January 9, 2025, establishes the governance framework through three principles and nine standards.
Principle | Standards |
6. Authorized by the Board | 6.1 Internal Audit Mandate; 6.2 Internal Audit Charter; 6.3 Board and Senior Management Support |
7. Positioned Independently | 7.1 Organizational Independence; 7.2 Chief Audit Executive Qualifications |
8. Overseen by the Board | 8.1 Board Interaction; 8.2 Resources; 8.3 Quality; 8.4 External Quality Assessment |
The distinction between essential conditions, requirements, and considerations for implementation is particularly important. Domain III identifies conditions involving the board and senior management that are necessary for effective governance, rather than treating internal audit independence as something the chief audit executive can establish alone.
Global Internal Audit Standards — Domain III: Governing the Internal Audit Function
Why effective internal auditing begins with the board, not the internal audit department
An organization may employ experienced internal auditors, develop a comprehensive risk-based audit plan, and produce detailed audit reports—yet still have an ineffective internal audit function.
Why?
Because the internal audit function may lack sufficient independence, authority, resources, or support from the governing board.
The Institute of Internal Auditors (IIA) addresses these challenges through Domain III: Governing the Internal Audit Function, part of the Global Internal Audit Standards issued January 9, 2024, and effective January 9, 2025.
Domain III establishes a fundamental principle of internal audit governance:
The chief audit executive cannot independently create the governance conditions necessary for an effective internal audit function. The board and senior management must fulfill their respective responsibilities.
This distinction is especially important for audit committees, governing boards, chief audit executives (CAEs), and senior management.
1. What Is Domain III?
Domain III establishes the governance arrangements necessary for an internal audit function to fulfill its purpose.
It addresses three fundamental questions:
Has the board properly authorized the internal audit function?
Is the internal audit function positioned to operate independently?
Does the board provide effective oversight of internal audit performance?
The domain consists of three principles and nine standards.
Principle | Standard | Subject |
6. Authorized by the Board | 6.1 | Internal Audit Mandate |
6.2 | Internal Audit Charter | |
6.3 | Board and Senior Management Support | |
7. Positioned Independently | 7.1 | Organizational Independence |
7.2 | Chief Audit Executive Qualifications | |
8. Overseen by the Board | 8.1 | Board Interaction |
8.2 | Resources | |
8.3 | Quality | |
8.4 | External Quality Assessment |
These standards establish expectations for the CAE and identify essential conditions involving the board and senior management.
The objective is to create an internal audit function with sufficient authority, independence, resources, and accountability to provide objective assurance and advice.
2. The Most Important Change: Essential Conditions
One of the distinctive features of the 2024 Global Internal Audit Standards is the identification of essential conditions in Domain III.
These conditions describe actions by the board and senior management that enable the internal audit function to operate effectively.
Examples include:
Approving the internal audit mandate and charter.
Supporting the authority of the internal audit function.
Establishing appropriate reporting relationships.
Protecting internal audit independence.
Providing adequate resources.
Overseeing internal audit quality.
Supporting external quality assessments.
The CAE is responsible for discussing the essential conditions with the board and senior management.
However, the CAE does not control every condition.
For example, the CAE cannot independently approve the internal audit charter or guarantee that the board provides sufficient resources.
The IIA recognizes this distinction by establishing a process for discussing essential conditions and documenting circumstances when the board or senior management does not provide the expected support.
Essential conditions are not merely administrative suggestions. They establish the governance foundation necessary for internal audit effectiveness.
However, they should not be confused with requirements imposed directly on the CAE. The Standards distinguish the CAE's requirements from the supporting activities of the board and senior management.
3. Principle 6: Authorized by the Board
Principle 6 establishes that the board must authorize the internal audit function and support its authority, role, and responsibilities.
An internal audit department should not operate solely because management decided to create one.
Its mandate should be understood and approved by the governing body.
Standard 6.1: Internal Audit Mandate
The internal audit mandate establishes the authority, role, and responsibilities of the internal audit function.
It addresses the scope and types of internal audit services the function is authorized to provide.
The CAE must provide the board and senior management with information necessary to establish or update the mandate.
The mandate should support the organization's governance, risk management, and control objectives.
For example, an internal audit function may be authorized to evaluate:
Financial reporting controls.
Operational processes.
Regulatory compliance.
Information technology controls.
Cybersecurity governance.
Fraud risk management.
Procurement and vendor management.
Organizational risk management.
The mandate should be sufficiently broad to permit the function to evaluate significant organizational risks.
A mandate that excludes important operations without an appropriate justification may impair internal audit effectiveness.
Standard 6.2: Internal Audit Charter
The internal audit charter formally documents the function's purpose, mandate, organizational position, and reporting relationships.
Under Standard 6.2, the CAE must develop and maintain the charter.
The charter must address, at a minimum:
The Purpose of Internal Auditing.
Commitment to adhering to the Global Internal Audit Standards.
The internal audit mandate, including scope and types of services.
The board's responsibilities and expectations regarding management's support.
The organizational position and reporting relationships.
The CAE must discuss the proposed charter with the board and senior management.
The board approves the charter.
Why the Charter Matters
Consider an internal audit function that reports administratively to the chief financial officer.
The function is asked to audit the financial reporting process.
If the CFO can prevent the audit, restrict access to information, or suppress the resulting report, the function's independence may be compromised.
An appropriately designed charter should establish the function's authority and reporting relationships in a manner that supports independent assurance.
An internal audit charter should protect the internal audit function's ability to examine management—not place management in control of what internal audit may examine.
Standard 6.3: Board and Senior Management Support
The board and senior management should support the internal audit function throughout the organization.
Support includes recognizing internal audit's authority and promoting cooperation with the function.
For example, management should not withhold requested records, prevent access to personnel, or interfere with legitimate audit procedures.
The CAE must provide the board and senior management with information needed to support the function's mandate.
The board and senior management have distinct responsibilities, but both contribute to the conditions necessary for effective internal auditing.
4. Principle 7: Positioned Independently
Independence is fundamental to internal auditing.
An internal audit function cannot provide fully objective assurance if management controls its conclusions, restricts its work, or determines which findings may be communicated.
Principle 7 addresses the organizational arrangements necessary to protect independence.
Standard 7.1: Organizational Independence
The CAE must confirm organizational independence to the board at least annually.
The CAE must also communicate actual or potential impairments to independence and the safeguards used to address them.
The board should establish reporting relationships that allow the CAE to fulfill internal audit responsibilities without interference.
This generally involves a direct functional reporting relationship between the CAE and the board.
Administrative reporting may involve senior management, but it should not undermine functional independence.
Functional Versus Administrative Reporting
Functional reporting to the board | Administrative reporting to management |
Approval of internal audit charter | Routine administrative coordination |
Approval of risk-based audit plan | Facilities and logistical support |
Oversight of CAE appointment and removal | Routine personnel administration |
Oversight of CAE performance and remuneration | Administrative processing |
Receipt of significant audit results | Day-to-day operational coordination |
Protection of internal audit independence | Organizational support |
Actual arrangements depend on the organization's governance structure and applicable requirements.
The central concern is whether the board can exercise meaningful oversight without management interference.
Example: Management Restricts an Audit
Suppose the CAE identifies significant risks in the organization's procurement process.
Senior management instructs internal audit not to examine procurement because the department is undergoing restructuring.
A temporary adjustment to audit timing may be reasonable under some circumstances.
However, an unjustified restriction that prevents the function from addressing significant risks may constitute interference.
The CAE should evaluate the circumstances and communicate relevant impairments to the board.
Standard 7.2: Chief Audit Executive Qualifications
The board must be able to evaluate whether the CAE possesses the qualifications and competencies necessary to lead the internal audit function.
Relevant considerations include:
Internal audit experience.
Knowledge of the Global Internal Audit Standards.
Risk management and internal control expertise.
Governance experience.
Communication and leadership skills.
Industry-specific knowledge.
Professional certifications and continuing education.
A technically competent auditor may not necessarily possess the leadership capabilities required to manage an internal audit function.
The board should consider both professional expertise and the ability to communicate independently with senior management and governance personnel.
5. Principle 8: Overseen by the Board
Principle 8 establishes that the board must oversee the internal audit function.
Approving a charter and appointing a CAE are only the beginning.
Effective oversight requires ongoing communication, evaluation of resources, monitoring of performance, and assurance regarding quality.
Standard 8.1: Board Interaction
The CAE must provide the board with information necessary to fulfill its oversight responsibilities.
Communication should address significant matters such as:
Internal audit plans and performance.
Significant audit results.
Resource requirements.
Changes in organizational risks.
Impairments to independence.
Significant disagreements with management.
Quality assessment results.
The board should have opportunities to communicate directly with the CAE.
Private meetings without senior management present can be particularly valuable.
These discussions allow the CAE to raise sensitive matters without management influence.
Standard 8.2: Resources
The board must understand whether internal audit has sufficient resources to fulfill its mandate.
Resources include:
Qualified personnel.
Appropriate funding.
Technology and audit tools.
Specialized expertise.
Training and professional development.
Access to external specialists when necessary.
Consider an organization with significant cybersecurity risks but no internal audit personnel possessing relevant IT audit expertise.
The CAE should identify the resource gap and communicate its effect on the audit plan.
The board should evaluate whether additional resources are necessary.
An approved audit plan is not meaningful if the internal audit function lacks the resources required to execute it.
Standard 8.3: Quality
The board has an important role in overseeing the quality of the internal audit function.
The CAE must develop, implement, and maintain a quality assurance and improvement program.
The board should receive information about the function's conformance with the Standards, performance objectives, and opportunities for improvement.
Relevant performance indicators may include:
Completion of the approved audit plan.
Coverage of significant organizational risks.
Timeliness of audit engagements.
Quality of audit documentation.
Stakeholder feedback.
Follow-up on management action plans.
Results of internal quality assessments.
Performance should not be evaluated solely by the number of audit reports issued.
The quality and usefulness of the assurance provided are equally important.
Standard 8.4: External Quality Assessment
The Global Internal Audit Standards require an external quality assessment at least once every five years.
The assessment must be conducted by a qualified, independent assessor or assessment team.
The CAE must develop a plan for the external quality assessment and discuss it with the board.
The board should oversee the assessment process and receive the results.
External quality assessments help determine whether the internal audit function conforms with the Standards and identify opportunities for improvement.
A self-assessment with independent validation may be an acceptable approach when conducted in accordance with the Standards.
The assessment team must meet applicable qualification requirements, including the required CIA credential.
6. Board Responsibilities Versus CAE Responsibilities
A recurring governance problem occurs when organizations assign all responsibility for internal audit effectiveness to the CAE.
Domain III recognizes that this approach is incomplete.
Governance activity | Board's role | CAE's role |
Internal audit mandate | Establishes and approves authority | Provides information and facilitates discussion |
Internal audit charter | Approves charter | Develops and maintains charter |
Organizational independence | Establishes appropriate positioning | Confirms independence and reports impairments |
CAE qualifications | Evaluates qualifications | Demonstrates and maintains necessary competencies |
Board communication | Engages in oversight discussions | Provides timely, relevant information |
Resources | Evaluates and supports resource needs | Identifies and communicates requirements |
Quality | Oversees quality and performance | Establishes and maintains quality program |
External quality assessment | Oversees assessment and reviews results | Develops plan and coordinates assessment |
Senior management also has an important supporting role throughout these activities.
This allocation of responsibilities is one of the most significant governance concepts in Domain III.
7. The Relationship Between Internal Audit and Management
The IIA's Three Lines Model helps explain the relationship between management, internal audit, and the governing body.
Management is responsible for achieving organizational objectives and managing risks.
Internal audit provides independent assurance and advice regarding governance, risk management, and controls.
The governing body is accountable to stakeholders for organizational oversight.
Internal audit should not assume management's operational responsibilities.
For example, internal audit may evaluate the design and effectiveness of a vendor onboarding process.
Management remains responsible for establishing and operating the process.
Similarly, internal audit may identify deficiencies in financial reporting controls.
Management remains responsible for developing and implementing corrective actions.
This distinction helps protect internal audit objectivity.
Internal audit evaluates management's processes. It should not become responsible for operating the processes it later audits.
8. What Happens When the Board Does Not Fulfill Its Responsibilities?
Domain III explicitly recognizes that the board or senior management may not provide all the essential conditions.
The CAE must discuss the implications of missing essential conditions with the relevant parties.
When the board or senior management disagrees with an essential condition, the CAE should discuss alternative arrangements and how they would support the intended outcomes.
If the parties agree that an essential condition is unnecessary, the CAE must document the reasons.
If they disagree about whether the condition is necessary, the CAE must document the circumstances and communicate the potential impact on the internal audit function's effectiveness.
This is an important safeguard.
A CAE should not simply ignore an independence or resource problem because management considers it inconvenient.
Nor should every departure from an essential condition automatically be treated as proof that the internal audit function is ineffective.
The circumstances, alternative arrangements, and resulting implications must be evaluated.
9. Common Governance Weaknesses
Organizations may experience several recurring problems.
The Audit Committee Exists Only on Paper
The committee has a charter and scheduled meetings but does not meaningfully oversee internal audit.
Management Controls the Audit Plan
Senior management determines which activities may be audited without appropriate board oversight.
The CAE Lacks Direct Board Access
The CAE cannot communicate sensitive issues directly to those charged with governance.
Internal Audit Resources Are Inadequate
The function is expected to provide assurance over significant risks without sufficient personnel, expertise, or technology.
Significant Findings Are Suppressed
Management influences which findings are reported or delays their communication.
Quality Is Not Evaluated
The board receives audit reports but does not assess the internal audit function's conformance with professional standards or overall performance.
The Charter Is Outdated
The charter does not reflect the organization's current risks, governance arrangements, or the Global Internal Audit Standards.
These conditions should be evaluated individually because their significance depends on the organization's circumstances.
10. Practical Domain III Governance Assessment
Audit committees and CAEs can use the following questions to evaluate their governance arrangements.
Assessment question | Relevant standard |
Has the board approved an appropriate internal audit mandate? | 6.1 |
Does the charter accurately describe internal audit authority and responsibilities? | 6.2 |
Does senior management support internal audit access and cooperation? | 6.3 |
Does the CAE have direct access to the board? | 7.1 |
Is organizational independence confirmed at least annually? | 7.1 |
Has the board evaluated the CAE's qualifications? | 7.2 |
Does the board receive meaningful information about internal audit performance? | 8.1 |
Does the board periodically meet privately with the CAE? | 8.1 |
Are internal audit resources sufficient for the approved mandate? | 8.2 |
Does the board oversee the quality assurance and improvement program? | 8.3 |
Is an external quality assessment conducted at least every five years? | 8.4 |
Does the board receive and evaluate external quality assessment results? | 8.4 |
A negative response does not automatically establish nonconformance.
However, it may identify an area requiring additional investigation or governance improvement.
11. What Should an Audit Committee Do Differently?
Domain III should change how audit committees think about internal audit oversight.
The committee should not limit its activities to receiving completed audit reports.
It should understand the internal audit mandate, evaluate independence, monitor resource sufficiency, and assess the quality of the function.
A practical annual governance review could include:
Reviewing the internal audit charter and mandate.
Confirming the CAE's organizational independence.
Discussing significant changes in organizational risks.
Reviewing the audit plan and resource requirements.
Evaluating significant restrictions or disagreements with management.
Reviewing internal audit performance and quality assessment results.
Discussing the status of management action plans.
Meeting privately with the CAE.
Evaluating the need for changes in governance arrangements.
These activities help establish a substantive oversight relationship.
They also provide evidence that the board is actively supporting internal audit effectiveness.
12. Final Thoughts: The Board Cannot Delegate Away Internal Audit Governance
The Global Internal Audit Standards recognize that internal audit effectiveness depends on more than the professional competence of individual auditors.
The function must be appropriately authorized, independently positioned, adequately resourced, and effectively overseen.
Domain III establishes the framework for achieving these conditions.
Principle 6 addresses authorization.
Principle 7 addresses independence.
Principle 8 addresses oversight.
Together, these principles establish the relationship among the board, senior management, and the chief audit executive.
The CAE is responsible for managing the internal audit function and meeting applicable professional requirements.
Senior management supports the function and provides the cooperation necessary for its work.
The board establishes the governance arrangements that enable the function to operate effectively.
A board that approves an internal audit charter but fails to protect independence, evaluate resources, or oversee quality has not fully addressed the governance responsibilities described in Domain III.
The central question for every audit committee is straightforward:
Have we created the conditions necessary for internal audit to provide independent, objective, and effective assurance—or have we merely established an internal audit department?
That distinction determines whether internal audit can meaningfully contribute to organizational governance, risk management, and internal control.
Authoritative References
About Corporate Compliance Seminars
Corporate Compliance Seminars (CCS) provides Continuing Professional Education (CPE) programs for internal auditors, external auditors, audit committee members, compliance professionals, and information technology professionals.
Our programs address the Global Internal Audit Standards, audit committee governance, internal audit independence, risk-based audit planning, internal controls, COSO, and audit quality.
Explore upcoming training programs at www.compliance-seminars.com.
Comments