—IIA Global Internal Audit Standards
The IIA 2024 Standards, a practical guide for audit leaders.
The IIA's Global Internal Audit Standards took effect on 9 January 2025. This hub explains what they require of the plan, the engagement file and the quality programme — and what an assessor will expect your function to show.
- Domains
- 5
- Principles
- 15
- Standards
- 52
- Effective
- 9 Jan 2025
The Global Internal Audit Standards were released by The Institute of Internal Auditors on 9 January 2024 and became effective a year later. They bring the mandatory elements of the 2017 framework — the Mission, Definition, Core Principles, Code of Ethics and Standards — into a single document of five Domains, fifteen Principles and fifty-two Standards.
Each Standard sets out its Requirements, Considerations for Implementation and Examples of Evidence of Conformance. That last element changes the practical question for a chief audit executive: not only "do we do this?" but "can we show it?" The guides below take the Standards topic by topic — the plan, the engagement file, conformance and external assessment — and describe what good evidence looks like, and where audit management software helps produce it as a by-product of the work.
—The Structure
Five Domains, fifteen Principles.
Domain I
Purpose of Internal Auditing
Domain II
Ethics and Professionalism
- 1 · Demonstrate Integrity
- 2 · Maintain Objectivity
- 3 · Demonstrate Competency
- 4 · Exercise Due Professional Care
- 5 · Maintain Confidentiality
Domain III
Governing the Internal Audit Function
- 6 · Authorized by the Board
- 7 · Positioned Independently
- 8 · Overseen by the Board
Domain IV
Managing the Internal Audit Function
- 9 · Plan Strategically
- 10 · Manage Resources
- 11 · Communicate Effectively
- 12 · Enhance Quality
Domain V
Performing Internal Audit Services
- 13 · Plan Engagements Effectively
- 14 · Conduct Engagement Work
- 15 · Communicate Engagement Results and Monitor Action Plans
—What Changed
What the 2024 Standards ask that 2017 didn't.
One document instead of five
The Mission, Definition, Core Principles, Code of Ethics and Standards of the 2017 framework's mandatory guidance now live in a single set of Standards.
The board's role is written in
Domain III (Standards 6.1–8.4) adds Essential Conditions — what the board and senior management are expected to do for internal audit to be effective.
Evidence of conformance is spelled out
Every Standard now lists examples of the evidence that demonstrates conformance, which is what internal and external assessors test against.
An internal audit strategy
Standard 9.2 asks the chief audit executive for a strategy — a vision, strategic objectives and initiatives — reviewed periodically with the board and senior management.
Topical Requirements
Mandatory when a topic is in scope of an assurance engagement, effective twelve months after issue: Cybersecurity (from 5 February 2026), Third-Party (15 September 2026) and Organizational Behavior (15 December 2026).
—Guides
The Standards, topic by topic.
Audit software for IIA 2024
What audit management software has to do for a function that conforms with the 2024 Standards.
Standards 9.1 · 9.4The audit universe
What the Standards actually say about the audit universe — and how to keep it living.
Standards 9.1 · 9.4 · 13.2Risk assessment
The two risk assessments the Standards expect — for the plan, and for each engagement.
Standards 8.2 · 9.2 · 9.4 · 9.5 · 13.6Risk-based audit planning
Strategy, the risk-based plan, coordination with other assurance providers and the work program.
Standards 5.2 · 12.3 · 14.6Working papers & documentation
Re-performable documentation, supervision on the file, and protecting engagement records.
Standards 4.1 · 8.3 · 12.1 · 15.1Evidence of conformance
How to show conformance — and what to do when a requirement can't be met.
Standards 8.3 · 8.4 · 12.1External quality assessment
The five-yearly EQA: who can perform it, the board's role, and how to prepare continuously.
—Further Reading
Standards articles.
- Internal audit in Saudi Arabia: the rules that actually govern the function
- Writing an internal audit charter that satisfies both the IIA 2024 Standards and SAMA
- IIA External Quality Assessment (EQA) Every 5 Years: A Saudi Guide
- SAMA's Principles of Internal Auditing: what Saudi banks' audit functions must get right
- What internal auditors in Saudi need to know about the new IIA Standards
- IIA Standard 9.4 and the Audit Universe: Annual Risk Assessment
—Frequently Asked
The IIA 2024 Standards, answered.
When did the IIA 2024 Standards take effect?
The Global Internal Audit Standards were released on 9 January 2024 and became effective on 9 January 2025.
Do the Standards require an audit universe?
Not as such. Standard 9.4 requires the internal audit plan to rest on a documented assessment of the organization's strategies, objectives and risks, performed at least annually. The Considerations for Implementation describe an audit universe as one way to approach that assessment.
How often is an external quality assessment required?
At least once every five years, under Standard 8.4, by a qualified and independent assessor or team that includes at least one person holding an active CIA designation.
Are the Topical Requirements mandatory?
Yes, when the topic is in scope of an assurance engagement; for advisory work they are recommended rather than required. Each becomes effective twelve months after it is issued.
Last reviewed October 2026. Standards references paraphrase The IIA's Global Internal Audit Standards (2024); they are not a substitute for the official text.
—Request a demo
See ControlVista run your audit lifecycle, end to end.
A 30-minute walkthrough with the team that built it — from the audit universe to the board-ready committee pack, in English and Arabic.
A product of Vantage Technologies.