2.3 The IIA Global Internal Audit Standards (IPPF)

2.3 The IIA Global Internal Audit Standards (IPPF)

While external audit bodies such as the European Court of Auditors provide independent oversight to external stakeholders (citizens and parliament), internal audit functions operate within an institution to evaluate and strengthen governance, risk management, and internal controls from within. In the European Union institutional framework, robust internal auditing is mandated by the EU Financial Regulation and operationalized by the European Commission's Internal Audit Service (IAS).

---

1. The IIA and the Evolution of the Global Internal Audit Standards

The Institute of Internal Auditors (IIA), established in 1941, is the recognized global standard-setter and professional authority for the internal audit profession. For decades, the profession was governed by the International Professional Practices Framework (IPPF). In 2024, the IIA completed a comprehensive overhaul, condensing and modernizing its architecture into the Global Internal Audit Standards.

The Official Definition of Internal Auditing

According to the Global Internal Audit Standards:

"Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes."

Assurance Services vs. Consulting Services

Internal auditors provide two distinct categories of professional engagements:

• Assurance Services: An objective examination of evidence for the purpose of providing an independent assessment on governance, risk management, and control processes. Assurance engagements always involve three distinct parties:
  1. The process owner (the person or group directly responsible for the operational activity being reviewed).
  2. The internal auditor (the professional conducting the assessment).
  3. The user (the governing body, audit committee, or senior management relying on the evaluation).
• Consulting Services: Advisory, training, and facilitation activities intended to add value and improve an organization's governance, risk management, and control without the internal auditor assuming management responsibility. Consulting engagements involve two parties: the internal auditor and the engagement client. Internal auditors must never make management decisions during consulting assignments, as doing so impairs subsequent audit objectivity.

---

2. The Five Domains of the Global Internal Audit Standards

The 2024 Global Internal Audit Standards are structured across Five Core Domains, uniting 15 fundamental principles:

Domain I: Purpose of Internal Auditing

Defines the core mandate and societal value of the profession. Internal auditing strengthens the organization's ability to create, protect, and sustain value by providing the governing body and executive management with objective, risk-based assurance, advice, and foresight.

Domain II: Ethics and Professionalism

Mandates adherence to the core ethical tenets required of internal audit practitioners: Integrity, Objectivity, Competence, Due Professional Care, and Confidentiality. Internal auditors must actively avoid conflicts of interest and maintain unbiased judgment.

Domain III: Governing the Internal Audit Function

Establishes the governance conditions that executive management and the governing body must satisfy to ensure internal audit can operate effectively:

• The Internal Audit Charter: A formal, written document approved by the governing body defining internal audit's purpose, authority, scope, and responsibility.
• Dual Reporting Relationship: To preserve independence, the Chief Audit Executive (CAE) must report functionally to the governing body (or audit committee) and administratively to executive leadership:
  • Functional Reporting: The audit committee approves the internal audit charter, the risk-based audit plan, the internal audit budget, and decisions regarding the appointment, remuneration, and removal of the CAE.
  • Administrative Reporting: Executive leadership (e.g., CEO, Secretary-General, or Director-General) facilitates day-to-day administrative support, budgeting logistics, internal communication flows, and personnel administration.

Domain IV: Managing the Internal Audit Function

Outlines the CAE's leadership responsibilities: developing a dynamic, risk-based internal audit plan aligned with organizational strategy; securing adequate financial, human, and technological resources; and maintaining an ongoing Quality Assurance and Improvement Program (QAIP), incorporating internal ongoing monitoring, periodic annual reviews, and an external quality assessment conducted by an independent qualified validator at least once every five years.

Domain V: Performing Internal Audit Services

Governs the end-to-end execution of specific audit engagements:

1. Engagement Planning: Conducting a preliminary engagement risk assessment, setting objectives and scope, and establishing the audit work program.
2. Fieldwork & Testing: Gathering, analyzing, and documenting sufficient, reliable evidence to evaluate internal control effectiveness.
3. Developing Findings: Structuring audit observations using the classic four-part framework: Condition (what is), Criteria (what should be), Cause (why the gap occurred), and Effect (the operational or financial impact).
4. Engagement Communication: Issuing balanced, formal audit reports containing actionable, risk-prioritized recommendations.
5. Monitoring Progress: Systematically tracking management's implementation of agreed corrective action plans until deficiencies are resolved.

---

3. The IIA Three Lines Model

The IIA Three Lines Model (which replaced the older "Three Lines of Defense" framework) provides a clear governance structure for identifying risk management roles, responsibilities, and coordination across an institution:

                    ┌──────────────────────────────────────────────┐
                    │        Governing Body / Audit Committee       │
                    └──────┬────────────────────────────────┬──────┘
                           │ Accountability                 │ Functional
                           │ & Oversight                    │ Reporting
                           ▼                                ▼
                    ┌──────────────┐                 ┌──────────────┐
                    │ Senior Exec  │                 │ Third Line:  │
                    │  Management  │                 │   Internal   │
                    └──────┬───────┘                 │    Audit     │
             Administrative│                         └──────────────┘
                 Reporting │ (Logistics)
            ┌──────────────┴──────────────┐
            ▼                             ▼
     ┌──────────────┐              ┌──────────────┐
     │  First Line: │              │ Second Line: │
     │  Operational │              │  Compliance, │
     │  Management  │◄─────────────┤  Risk & QC   │
     └──────────────┘ (Facilitates)└──────────────┘

---

4. Internal Audit Architecture in EU Institutions

Within the European Union, internal audit underwent radical modernization following the 2000 Kinnock Administrative Reforms, which led to the creation of the Internal Audit Service (IAS) in 2001:

Mandate of the Internal Audit Service (IAS)

The Commission's Internal Audit Service (IAS) is an independent Commission service providing assurance and advice across Commission departments and executive agencies. Its authority and access derive from the current Financial Regulation and its charter. Independence means that audit scope, procedures and conclusions are protected from inappropriate interference; it does not mean the IAS is outside the Commission's institutional and legal accountability arrangements.

The IAS reports its significant results through the Commission's governance structure and coordinates with auditees without allowing them to approve the audit plan or conclusions.

The Audit Progress Committee (APC)

To ensure functional independence in line with Domain III of the Global Standards, the Commission created the Audit Progress Committee (APC):

• The APC acts as the Commission's audit committee, consisting of members of the College of Commissioners and external independent experts.
• The APC reviews the annual internal audit plan, ensures the IAS remains adequately resourced, monitors the implementation of audit recommendations across Commission DGs, and reports directly to the College of Commissioners.

Historically, individual DGs maintained localized Internal Audit Capabilities (IACs). To eliminate conflicts of interest, avoid audit duplication, and enforce professional rigor, the Commission centralized all internal audit activities into the single, unified IAS structure.