15.1 Conformance Ratings & 'Conforms with Standards' Statement

15.1 Conformance Ratings & 'Conforms with Standards' Statement

[!NOTE] Professional Standards Foundation: Under the Global Internal Audit Standards (GIAS), specifically Domain IV (Managing the Internal Audit Function), Principle 12 (Enhance Quality), and Standard 12.1 (Internal Quality Assessment), the Chief Audit Executive (CAE) is responsible for communicating the results of the Quality Assurance and Improvement Program (QAIP) to senior management and the board (Audit Committee). This communication must include the results of internal and external quality assessments, an explicit evaluation of conformance with the Standards and the Code of Ethics, and any necessary corrective action plans. Standard 12.1 strictly regulates when and how an internal audit function may state that its activities conform with the Global Internal Audit Standards.

Internal auditing derives its organizational authority, stakeholder reliance, and professional legitimacy from adherence to the Global Internal Audit Standards and the IIA Code of Ethics. When audit committees, executive leadership, external auditors, and regulatory examiners read an internal audit report, they presume the underlying work meets rigorous global benchmarks for objectivity, independence, methodology, and evidence. To protect this trust, the Institute of Internal Auditors (IIA) establishes a standardized conformance evaluation framework. Conformance is not a casual self-declaration; it is a formal, evidence-based determination governed by explicit rating tiers and strict disclosure prerequisites.

---

The Three-Tier Conformance Rating Scale

Under the GIAS Quality Assessment framework, both internal periodic assessments and external quality assessments (EQAs) must evaluate the internal audit activity against an established three-tier rating scale: Conforms, Partially Conforms, and Does Not Conform. Assessors assign these ratings at two levels: for individual standards/domains and as an overall aggregate opinion on the function as a whole.

1. Conforms

• Definition and Criteria: The internal audit activity conforms with the Global Internal Audit Standards and the Code of Ethics when it adheres to the mandatory requirements in all material respects.
• Operational Reality: A rating of "Conforms" does not require absolute perfection or the total absence of operational flaws. Minor deviations, process oversights, or isolated procedural lapses may occur, provided they are infrequent, non-systemic, and do not impair the function's independence, objectivity, scope, or the validity of its audit conclusions. Assessors frequently provide advisory recommendations and opportunities for enhancement alongside a "Conforms" rating to foster continuous improvement.
• Impact: Demonstrates to the Audit Committee and external stakeholders that the function delivers reliable, professionally sound assurance and advisory services.

2. Partially Conforms

• Definition and Criteria: A rating of "Partially Conforms" indicates that while the internal audit activity demonstrates constructive intent and adheres to standards in many operational areas, noticeable deficiencies or systemic gaps prevent full adherence across specific standards or entire domains.
• Operational Reality: These deficiencies are more than minor procedural errors. Examples include inconsistent engagement supervision, inadequate root cause documentation across multiple files, incomplete annual audit plan risk refreshers, or gaps in auditor continuing professional education (CPE). However, the deficiencies are not severe enough to completely negate the function's value or compromise fundamental independence and objectivity.
• Impact: The internal audit activity delivers useful assurance in specific areas, but its overall methodology exhibits material weaknesses that create operational risk and undermine consistent stakeholder reliance.

3. Does Not Conform

• Definition and Criteria: A rating of "Does Not Conform" indicates that the internal audit activity exhibits pervasive, material nonconformance with fundamental requirements of the Standards or the Code of Ethics.
• Operational Reality: This rating is assigned when deficiencies are so fundamental that they directly compromise the credibility, independence, objectivity, or competence of the internal audit activity. Examples include executive management imposing direct scope limitations without board reporting, lack of a board-approved Internal Audit Charter, persistent conflicts of interest in audit staffing, total absence of a QAIP, or widespread issuance of unsupported audit reports.
• Impact: Senior management, the board, and external assurance providers cannot place professional reliance on the function's opinions or observations. The function operates outside global professional standards.

---

Conformance Criteria Across GIAS Domains and Code of Ethics

A valid conformance evaluation requires comprehensive assessment across all structural pillars of the profession:

• Ethics and Professionalism (Domain I): Assessors verify adherence to integrity, objectivity, competence, due professional care, and confidentiality. Any intentional breach of ethics (e.g., misrepresenting audit evidence or concealing conflicts of interest) automatically precludes a departmental rating of "Conforms."
• Governance and Positioning (Domains II & III): Assessors examine the board-approved charter, direct reporting lines to the Audit Committee, administrative reporting to the CEO, freedom from operational management duties, and unrestricted access to organizational records, personnel, and properties.
• Management of the Function (Domain IV): Assessors evaluate strategic planning, annual risk-based audit plan formulation, resource management, coordination with second-line assurance providers, and the execution of the QAIP.
• Engagement Performance (Domain V): Assessors inspect engagement planning, risk and control matrices, evidence re-performability, root cause analysis, workpaper supervision, and clear, timely reporting.

---

Strict Conditions for Using the 'Conforms with Standards' Statement

Under GIAS Standard 12.3, the CAE and internal auditors are strictly prohibited from stating that the internal audit function conforms with the Global Internal Audit Standards unless two mandatory prerequisites are simultaneously satisfied:

1. Current External Quality Assessment (Within 5 Years): The internal audit activity must have undergone a comprehensive External Quality Assessment (or a Self-Assessment with Independent Validation) conducted by a qualified, independent external assessor within the previous five years.
2. Supportive Conformance Opinion: The independent external assessment must have concluded with an overall rating of "Conforms" with the Standards and Code of Ethics. An overall rating of "Partially Conforms" or "Does Not Conform" completely bars the use of the statement.
3. Continuous Internal QAIP Validation: Between five-year external assessments, the CAE must maintain ongoing monitoring and annual periodic internal assessments that continuously validate sustained conformance.

[!WARNING] The Five-Year Expiration Cliff: The five-year validity window is strictly enforced. If an internal audit activity completed its last EQA on September 1, 2021, its authorization to use the statement expires on September 1, 2026. On September 2, 2026, if a new EQA has not been completed, the CAE and staff must immediately cease including the statement on audit reports, charters, and committee dashboards—even if annual internal assessments show flawless performance.

---

Prohibitions: When the Statement Cannot Be Used

The IIA establishes strict prohibitions to prevent misleading stakeholders:

• Expired EQA Clock: Lapsing beyond the five-year external review deadline instantly revokes authorization. Internal self-assessments, no matter how rigorous, cannot substitute for independent external validation.
• Non-Conforming Overall Rating: If the latest EQA resulted in "Partially Conforms" or "Does Not Conform," the statement cannot be used in any published report or departmental communication.
• Significant Subsequent Nonconformance: If material impairments or methodology failures arise after a successful EQA, the CAE must suspend the statement until full remediation is achieved and verified.
• Prohibition of Qualified or Piecemeal Statements: Internal auditors are strictly forbidden from issuing qualified statements, such as "This engagement was conducted in conformance with the Global Internal Audit Standards, except for Standard 11.2." The statement represents a binary professional seal of quality: the function either conforms with the Standards as an integrated whole, or it does not.

---

Comparative Analysis: Conformance Rating Tiers