Tools for the job: Time to prepare for the Global Internal Audit Standards

The new Global Standards come into operation next year, but internal audit functions should now be identifying any conformance gaps and looking to resolve these. Many functions will find that they already have some areas where they conform, but others where they need to make changes.

However, no internal audit function needs to tackle this alone. IIA Global is regularly releasing new guidance to help internal audit leaders understand the key changes and what these mean for them. The Chartered IIA is currently in the process of updating all the guidance available on its website to ensure that it fully reflects the new Global Standards (a Herculean task).

So what information is available and where can you find it?

External quality assessments (EQAs)

Current EQAs are assessed against the 2017 Standards, although some functions going through EQAs are already requesting additional support to assess their performance against the new Standards and identify gaps. This is an optional extra provided by the Chartered IIA’s EQA team.

From January 2025, internal audit functions undergoing EQAs will need to demonstrate that they conform to the new Global Standards, however most of the work they are being assessed on will have taken place under the older Standards. Ann Brook, Head of Technical Content and Research at the Chartered IIA, says the assessors will take a pragmatic approach for the first months, before switching completely to assessing against the new Standards in April.

“We’ve created a self-assessment checklist for those undergoing EQAs and IIA Global has also published a readiness assessment tool, so we’re trying to be practical about this transition,” she explains. “IIA Global has suggested that those who are due for an EQA very early next year may wish to bring this forward so they are assessed against the existing Standards.” Brook adds that fewer internal audit teams generally choose to do an EQA immediately before the end of the tax year in April and there’s still time to book an assessment before the end of 2024.

“Most of our current EQA clients are choosing the additional service of assessing their progress towards the Global Standards because they see it as part of their preparation and a good chance to understand what the Global Standards will mean for them,” she explains.

Topical requirements

IIA Global is constantly publishing more guidance to the new Standards on its website, so it’s worth checking regularly. The first topical requirement – on cyber security – has been published for consultation. The Chartered IIA responded with feedback and has encouraged its members to engage and respond. The feedback will be used to inform this topical requirement and subsequent ones that are in the pipeline.

“These topical requirements are mandatory, so they matter,” Brook points out. “We don’t yet have a timeline for more, but they are being developed. A list is available on IIA Global’s website and more are likely to be added in future.”

There’s still lots of debate about the optimum format and structure of the topical requirements, so they are likely to evolve further. “If you missed this consultation, get involved in the next and help shape their development,” Brook advises.

IIA Global guidance and translations

Next on the agenda from IIA Global is a Quality Assessment Manual offering advice on EQAs and internal assessment processes. This is expected to be published this month – Brook sits on the committee developing it.

Meanwhile, the Global Standards are being translated into more languages. At the time of writing, three translations have been published, but more are coming out all the time, so, again, it’s worth checking the IIA Global website regularly. The current Standards are translated into 25 languages, so there are many more versions still to appear.

IIA Global has also issued two new model internal audit charters, one for the public sector as well as a general-purpose one. Both versions can be downloaded, edited and used as a template.

Guidance is also available for Domain 3 of the Global Standards. This considers the role and responsibilities of audit committees and how Domain 3 relates to the three lines model.

Chartered IIA guidance

While IIA Global consults and publishes guidance on the Global Standards, the Chartered IIA is focusing on keeping members in the UK and Ireland informed of the latest developments and updating all its existing guidance and resources to ensure they conform.

Members can subscribe to a monthly technical blog offering updates and links to consultations and new guidance. Our new self-assessment tool to help members identify conformance gaps is being regularly updated to meet requirements in our new Code of Practice as well as guidance from IIA Global. This can be downloaded and adapted to suit individual requirements.

More recently guidance and a tool-kit aimed at supporting audit committees has been published on the Chartered IIA’s website for members to access. Lots more guidance is being drafted, including pieces on internal audit strategy and guidance that CAEs can use to support senior management. A list of new guidance and updates to existing guidance will be published regularly on the technical blog.

The Chartered IIA is playing an active part in the ongoing evolution of guidance at IIA Global level. Brook is on the advisory panel for the Quality Assessment Manual and is an adviser on the development of the Public Sector Internal Audit Standards, being managed by CIPFA.  She is also a member of the European Confederation of Institutes of Internal Auditing’s (ECIIA’s) project to review the new Standards for the public sector in the EU.

Various members of Chartered IIA staff, including Brook, will be speaking about the Global Standards at regional conferences and events throughout the year, as well as conducting webinars. There will be a session dedicated to them at the Internal Audit Conference on 2-3 October.

All members are also welcome to attend the online drop-in clinic – you just need to register to be invited.

“If you have a large group of people who need to know more about the Global Standards then let us know. We’re happy to give updates and talks,” Brook says.

“It’s not training, it’s about raising awareness and asking people what they see as the main challenges and what they want from us. If you have any questions, get in touch. The more we know what you are concerned about, the more we can tailor what we’re doing and decide which pieces of work we prioritise.”

One last point that is important to note, she adds, is that the Global Standards do not replace the whole of the existing IPPF. The Global Standards replace the parts that were mandatory, plus the implementation guidance. The old supplemental guidance is still valid and will be updated where necessary (see diagram below).

“Most UK organisations don’t have as much to change as many internal audit functions globally, because the Chartered IIA’s Code of Practice had already set high expectations for best practice,” Brook points out. “The important thing is to do the self-assessment, identify any gaps and develop an action plan to address these. Most people who do this are telling us that their action plan is not as long as they feared it would be. There will be some work, but not a huge amount.”

This article was published in July 2024.