Internal audit is a discipline built on judgment, but judgment alone cannot be the entire basis for a profession that boards, regulators, and organizations rely on for independent assurance. The IIA Global Internal Audit Standards exist to give that judgment a consistent, defensible structure, and since January 2025, they are the mandatory framework every internal audit function is expected to conform to.
What Are the IIA Global Internal Audit Standards?
The Global Internal Audit Standards, sometimes referred to informally as the Redbook, are the authoritative framework issued by the Institute of Internal Auditors that guides the worldwide professional practice of internal auditing. They serve as the basis for evaluating and elevating the quality of an internal audit function, setting out the principles and requirements internal auditors and internal audit functions are expected to follow, regardless of industry, jurisdiction, or organizational size.
Why the Standards Matter
The Global Internal Audit Standards matter because they give internal audit’s conclusions credibility beyond the walls of a single organization. Without a recognized external standard, there would be no consistent basis for a board, regulator, or external stakeholder to know whether a given internal audit function’s work meets a genuine professional benchmark. Conformance with the Standards instills trust in the profession, supports an ethical culture within the internal audit function, and provides the basis for others to reasonably rely on internal auditors’ work and judgment.
Need Expert Advice?
Contact the team at Farahat & Co. for professional support and expert insights for businesses operating in the UAE.
2024 Global Internal Audit Standards
The Institute of Internal Auditors released the Global Internal Audit Standards on January 9, 2024, following a multi-year development process that incorporated close to 19,000 comments from surveys and direct stakeholder feedback. The Standards became mandatory, effective for quality assessments, from January 9, 2025.
The 2024 Standards replace the previous International Professional Practices Framework issued in 2017, which had separated core elements, the Mission of Internal Audit, the Definition of Internal Auditing, Core Principles, and the Code of Ethics, into four distinct documents. The 2024 update consolidates all of these elements into a single, unified 120-page document, organized around five domains, 15 guiding principles, and 52 specific standards. Each standard carries its own requirements, considerations for implementation, and examples of evidence of conformance. The former distinction between assurance and consulting standards has also been merged into the primary content, simplifying how the Standards apply across different types of internal audit work.
Any internal audit function or organization still referencing the 2017 IPPF as its current governing framework is working from a superseded standard. The 2024 Global Internal Audit Standards are the current authoritative framework, and conformance is now assessed against this version.
Also check: Internal Audit Services
The Five Domains
The Global Internal Audit Standards organize their 15 principles across five domains, moving away from the former “attribute” and “performance” standards structure used under the 2017 framework.
Domain I: Purpose of Internal Auditing
This domain establishes the purpose and value of internal auditing, describing how internal audit enhances the organization and under what conditions it is most effective. The Standards define the purpose of internal auditing as strengthening an organization’s ability to create, protect, and sustain value, by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight.
Domain II: Ethics and Professionalism
This domain embodies what was formerly the standalone Code of Ethics, covering the behavioral expectations for professional internal auditors, including chief audit executives, other internal audit personnel, and any external party providing internal audit services. Its principles center on integrity, objectivity, competency, and due professional care.
Domain III: Governing the Internal Audit Function
This domain outlines the requirements for chief audit executives to work closely with the board to establish the internal audit function, position it independently within the organization, and oversee its performance. It also articulates how the board and senior management are expected to contribute to that governance relationship, reflecting an increased emphasis, relative to the 2017 framework, on the board’s active role in overseeing internal audit.
Domain IV: Managing the Internal Audit Function
This domain covers how the internal audit function itself should be managed at the operational level, including strategic planning, resource management, and the policies and procedures that guide how the function carries out its work on an ongoing basis.
Domain V: Performing Internal Audit Services
This domain covers the conduct of individual audit engagements, with principles addressing engagement planning, fieldwork, developing and reporting findings, developing recommendations or action plans, and following up on management’s corrective actions.
Independence and Objectivity
Independence and objectivity remain central requirements under the 2024 Standards, though their treatment has shifted somewhat from the 2017 framework. Independence refers to the internal audit function’s freedom from conditions that threaten its ability to carry out its responsibilities in an unbiased manner, addressed primarily within Domain III through requirements around the function’s reporting relationship with the board and its structural positioning within the organization. Objectivity refers to the individual auditor’s unbiased mental attitude, addressed within Domain II as part of the Ethics and Professionalism requirements.
The 2024 Standards place particular emphasis on the board’s active role in protecting internal audit’s independence, requiring closer collaboration between the chief audit executive and the board than the 2017 framework required, reflecting the view that independence is best protected through structural governance arrangements rather than through individual auditor conduct alone.
Quality Assurance
The Standards require internal audit functions to maintain a quality assurance and improvement program, covering both ongoing internal monitoring of audit work and periodic external assessments carried out by a qualified, independent reviewer outside the organization. Under the 2024 Standards, an external quality assessment is generally expected to be performed at least once every five years, with effectiveness reviews required to cover an adequate period of the function’s activity. Quality requirements under the new Standards extend beyond conformance with the Standards themselves to also address the overall performance of the internal audit function, a broader lens than the 2017 framework applied.
Conformance
Conformance under the 2024 Standards means that an internal audit function’s practices genuinely meet the requirements set out across the five domains, 15 principles, and 52 individual standards, not merely that a function is broadly aware of the framework. Notably, the 2024 Standards moved away from the 2017 framework’s approach to minimum requirements for determining significant deficiencies; under the current Standards, all criteria are weighted equally, and conformance is assessed by reviewing whether the underlying objective of each standard has genuinely been achieved, rather than applying a fixed set of pass or fail thresholds.
Because the 2024 Standards represent a structural overhaul, not merely an update, organizations transitioning from the 2017 framework are expected to review their existing audit charters, policies, procedures, and documentation against the new domain and principle structure, since references to the old IPPF’s numbering and terminology will need to be updated to remain accurate under the current framework.
Frequently Asked Questions (FAQs)
What are the IIA Global Internal Audit Standards?
When did the 2024 Global Internal Audit Standards take effect?
How is the 2024 framework different from the 2017 IPPF?
What are the five domains of the Global Internal Audit Standards?
How often is an external quality assessment required under the 2024 Standards?
Are organizations still using the 2017 IPPF considered compliant?
Need Expert Advice?
Contact the team at Farahat & Co. for professional support and expert insights for businesses operating in the UAE.
How Farahat & Co. Can Help
These Standards are one part of a complete internal audit framework. For a full overview of internal audit objectives, types, process, and best practices, see our complete internal audit guide.
Farahat & Co. delivers internal audit services aligned with the current IIA Global Internal Audit Standards, supported by independent governance and a structured quality approach.
Contact Farahat & Co. today to discuss your internal audit requirements.
