Internal audit standards

On 9 January 2024 the new Global Internal Audit Standards (Standards) were released by the Institute of Internal Auditors (IIA). These Standards are meant to guide professional practice of internal auditing and serve as a basis for evaluating and elevating the quality of the Internal Audit Function (IAF). These Standards have become effective as of 9 January 2025, which means that audit functions are required to implement the changes at the earliest.

In this paper, we will provide our views on how an IAF can and should implement the requirements related to two of the new Standards, the requirements to draft a strategy and a performance management methodology. Based on our experiences with audit functions we believe these may have the biggest impact and can serve as a great tool to look ahead and determine what impact you want to make as an IAF. In addition, we will provide an overview of the major changes in the new Standards.

We included our view on how the IAF should implement the requirements for the Standards 9.2 (IA strategy) and Standard 12.2 (performance management) on the next pages. An overview of other major changes between the 2017 and 2024 Standards can be found on page 6 of this report

What do these changes mean for an IAF?

KPMG believes the updated Standards provide momentum to start the conversation with your board of management to discuss the role of the audit function in the future. Specifically the added requirement on establishing an internal audit strategy requires dialogue with the board of management to determine how the IAF supports the strategic objectives and success of the organization and aligns with the expectations of the board, senior management, and other key stakeholders.

As this relates to the minimum every CAE should make the strategy document specific to his or her situation. In order to establish the strategy and comply with Standard 9.2 the IAF should follow the next steps:

Start by defining the vision and ambition of the IAF. We consider this to be the desired state where the IAF wants to be in 3 to 5 years. This should be done by considering the organization’s strategy and objectives and the expectations ofthe board and senior management for the IAF. Also, consider the type of services to provide added value to the organization. Ideally these aspects will be linked with the performance indicators of the IAF to measure success.
The second step for the CAE is to determine where the IAF stands at this moment. This can be done by doing an assessment to determine the current status of the IAF related to the components shown in the framework.
Once the vision and ambition and the current status of the IAF is established, the strategy gives guidance in how this vision and ambition will be achieved. The strategy of the IAF is meant to be designed to define achievable actions. The defined actions should be based upon the gaps and ensure achievable and concrete actions. In order to achieve this the actions should be SMART; specific, measurable, achievable, realistic and time-bound.