The Institute of Internal Auditors’ Global Internal Audit Standards became effective on 9 January 2025, replacing the previous standards in the International Professional Practices Framework. Nearly two years on, the standards are being supplemented by a series of topical requirements, three of which take effect during 2026.
For boards and audit committees, the important point is that the new standards are not only addressed to internal auditors. They give the board specific responsibilities of its own.
How the standards are organised
The requirements are grouped into five domains: the purpose of internal auditing, ethics and professionalism, governing the internal audit function, managing the internal audit function, and performing internal audit services. Each domain contains principles and standards, with implementation considerations and examples of evidence of conformance.
What the board is expected to do
- Agree the mandate. The board, senior management and the chief audit executive should work together on the function’s mandate and performance objectives.
- Approve the plan and resources. The board, usually through the audit committee, approves the internal audit plan, budget and resource plan, and significant changes to them.
- Oversee quality. The board approves the approach to the external quality assessment of the internal audit function.
- Support the essential conditions. The standards set out essential conditions for an effective function, such as independence and direct access to the board. The chief audit executive is expected to brief the board on them.
Topical requirements: the new minimum baseline
Topical requirements set the minimum that internal auditors must cover when they audit certain high-risk areas. Those issued so far are:
- Cybersecurity: effective 5 February 2026.
- Third-party risk: effective 15 September 2026.
- Organisational behaviour: effective 15 December 2026.
A requirement on organisational resilience is expected, and the IIA plans to publish an anti-corruption requirement in November 2026.
Questions for your next audit committee meeting
- Has our internal audit charter been updated for the new standards, and has the board approved it?
- Does the audit plan cover cybersecurity, third-party risk and organisational behaviour in line with the topical requirements?
- When is our next external quality assessment, and has the board approved the approach?
- Does the function have the skills and budget to deliver the plan, or should some work be co-sourced?
We provide outsourced and co-sourced internal audit, and help organisations align their internal audit functions with the new standards. See our risk and internal audit services or contact us.