In January 2024 the Institute of Internal Auditors (IIA) released the Global Internal Audit Standards, replacing the 2017 International Standards for the Professional Practice of Internal Auditing. The new Standards became effective on 9 January 2025, so every internal audit function claiming conformance, from a ministry audit unit in Harare to a bank’s group internal audit in Johannesburg, should by now be working to them.
Many teams updated their charter and moved on, but the 2024 Standards change how internal audit is governed, planned, measured and quality-assured. Here is what changed, the gaps we see most often, and a checklist to use with your team.
How the 2024 Standards are structured
The old split between attribute standards, performance standards and separate assurance (.A) and consulting (.C) requirements is gone. Instead, all mandatory material sits in one document organised into five domains, 15 principles and 52 standards:
- Domain I – Purpose of Internal Auditing: what internal audit exists to do for the organisation.
- Domain II – Ethics and Professionalism (Principles 1–5): integrity, objectivity, competency, due professional care and confidentiality. This replaces the separate Code of Ethics.
- Domain III – Governing the Internal Audit Function (Principles 6–8): authorised by the board, positioned independently, overseen by the board.
- Domain IV – Managing the Internal Audit Function (Principles 9–12): planning strategically, managing resources, communicating effectively and enhancing quality.
- Domain V – Performing Internal Audit Services (Principles 13–15): planning engagements, conducting the work, and communicating results and monitoring action plans.
Each standard sets out mandatory Requirements, then Considerations for Implementation and Examples of Evidence of Conformance, which show what an assessor will expect on file.
The changes that matter most
1. Essential Conditions for the board and senior management
Domain III introduces Essential Conditions: things the board and senior management need to do for internal audit to work. These include approving the internal audit mandate and charter (Standard 6.2), supporting independent positioning and direct reporting to the board (Principle 7), and overseeing the function’s resources and quality (Principle 8). The chief audit executive (CAE) is expected to discuss these conditions with the board. If they are missing, the CAE should explain the impact and document it. For Zimbabwean state-owned enterprises and public entities with new or under-resourced audit committees, this gives the CAE a basis for requesting proper support.
2. A documented internal audit strategy
Standard 9.2 requires the CAE to develop and implement an internal audit strategy that supports the organisation’s objectives and meets stakeholder expectations. An annual plan alone no longer meets this requirement.
3. Risk-based planning and coordination with other assurance providers
The internal audit plan (Standard 9.4) must be based on a documented assessment of the organisation’s strategies, objectives and risks, and must be reviewed and updated as risks change. Standard 9.5 requires coordination with, and where appropriate reliance on, other internal and external assurance providers: compliance, risk management, external auditors and, for public entities, the Auditor-General’s office.
4. Rated findings and engagement conclusions
Under Standard 14.3, findings must be prioritised according to their significance. Standard 14.5 requires an overall conclusion for each engagement. The IIA encourages rating scales but does not mandate a particular one. Standard 15.2 requires the function to confirm that recommendations or action plans have actually been implemented.
5. Performance measurement and stronger quality assurance
Standard 12.2 requires a performance measurement methodology with objectives the function reports against. External quality assessments (Standard 8.4) are still required at least every five years, and the assessment team must now include at least one person who holds an active Certified Internal Auditor (CIA) designation.
6. Topical Requirements
The new framework adds Topical Requirements, which set minimum expectations for auditing specific risk areas. The first, on cybersecurity, was issued on 5 February 2025 and took effect on 5 February 2026. Topical Requirements apply when the topic falls within the scope of an engagement based on the function’s risk assessment, and teams must document how the requirement was applied or why elements were excluded. More, including third-party risk, are being rolled out.
Why it matters for audit teams
Audit committees, regulators and NGO donors increasingly ask whether internal audit “conforms with the IIA Standards.” A function that claims conformance without evidence is exposed at its external quality assessment. The Standards also include public sector guidance, recognising that ministries, local authorities and parastatals operate under laws that shape how internal audit is mandated and funded.
Common gaps seen in practice
- Charter updated, mandate not discussed. The charter was revised by the CAE but never properly discussed with and approved by the board.
- No written strategy. The function has an annual plan but no multi-year strategy linked to organisational objectives.
- Static risk assessments. The plan is never revisited, even when ZiG/USD currency changes or new regulations shift the risk profile.
- Unrated findings. Reports list issues with no prioritisation and no overall engagement conclusion.
- Weak follow-up. Management responses are accepted at face value and implementation is never confirmed with evidence.
- No performance metrics. The function cannot show the board how it measures its own effectiveness.
- Cybersecurity audits without the topical requirement. IT audits go ahead without mapping scope to the cybersecurity Topical Requirement or documenting the exclusions.
- Thin evidence for analytics-based conclusions. Working papers don’t show how data was extracted and tested. Tools such as ProDataTool help teams analyse full populations and keep a repeatable, project-based record of the work.
Practical conformance checklist
| Area | Question to ask | Evidence to hold |
|---|---|---|
| Mandate and charter (6.1–6.2) | Has the board discussed and approved the mandate and charter? | Approved charter; board or audit committee minutes |
| Independence (Principle 7) | Does the CAE report functionally to the board? | Organogram; reporting-line resolution |
| Strategy (9.2) | Is there a documented internal audit strategy? | Strategy document; board review record |
| Audit plan (9.4) | Is the plan based on a documented risk assessment and updated? | Risk assessment; plan change log |
| Coordination (9.5) | Is assurance coordinated with other providers? | Assurance map; reliance assessments |
| Findings (14.3, 14.5) | Are findings prioritised and engagement conclusions given? | Rating methodology; final reports |
| Follow-up (15.2) | Is implementation confirmed with evidence? | Recommendation tracker; closure evidence |
| Performance (12.2) | Are performance objectives measured and reported? | KPI dashboard; board reports |
| Quality (8.3–8.4) | Is an external quality assessment planned within five years? | QAIP; EQA schedule and results |
| Topical Requirements | Are applicable requirements applied and exclusions documented? | Engagement scoping notes |
Conclusion
The 2024 Global Internal Audit Standards ask for more than updated wording. Boards have to engage, CAEs have to plan strategically, and every engagement has to produce prioritised findings, clear conclusions and confirmed follow-up. Teams that build these habits in now will be ready for their next external quality assessment.
Much of the evidence the Standards call for, including risk assessments, rated findings, follow-up and performance reporting, is easier to produce and keep when audit work is digitised. Auditors Track GRC helps organisations across Africa manage risk assessments, audit reviews, findings and report writing in one place, with evidence attachments, dashboards by department and engagement type, multi-user department assignments, and built-in libraries of controls, audits, working papers and risks. Book a free demo of Auditors Track GRC and see how it can support your conformance with the Global Internal Audit Standards.