You should read at least the standards that apply to the Part you are currently studying. Do not rely only on the learning materials as your only source.  Being familiar with the standards provides insight into how the standards are expressed, including the requirements, considerations for implementation, and the evidence of conformance.

Glossary

Part of the Global Internal Audit Standards is a glossary of terminology. This glossary is examinable and it is important that you are familiar with the various terms and can use these correctly and in the appropriate context.

There may be terms that are unfamiliar to you, or terms that are used slightly differently from what you are used to.  The standards will reference these terms, and these are also the terms that are used in the exam. 

For example, at work you may refer to the ‘Audit Committee’ while the glossary uses the term ‘the Board’. The glossary explains the board as “the highest-level body charged with governance” listing audit committees and boards of trustees as examples.

Global Guidance

As you can see in the image above, the Global Guidance encircles all the Standards to form part of the IPPF.

The Global Guidance are recommended rather than mandatory guidance but as a student you need to regard the guidance as important reading.

Not only are the guidance a key source of exam questions, it deals primarily with the implementation of the standards, and usually does this against a hypothetical environment unencumbered by the harsh realities of the world, like resources or competing priorities.

There are several documents included under the banner of Global Guidance:

• Practice Guides (GPG): provide practical, detailed guidance on how to apply the Global Internal Audit Standards in real internal audit work.
• Global Technology Audit Guide (GTAG): provide guidance for assessing information technology, information security, data and cybersecurity risks and controls
  (these can be found on The IIA website).
• Position papers: explain and communicate its considered view on significant issues affecting internal audit and its stakeholders
  (also on The IIA website, but look out for those possible outdated).

In addition the IIA also publish tool kits to support internal audit functions key requirements, like the implementation of the standards, drafting internal audit strategy documents, or documenting the internal audit charter.

All the Global Guidance are available from The IIA website.  You will also find additional information and guidance on the Chartered IIA site.

See the list of guidance that you must include in your studies. Not only does it show the guidance, but also the relevance to the three CIA parts. Rather than a definitive list, you should see this as an introduction to the core pieces of guidance.  You should explore the Guidance and read those publications that are relevant to your studies, in particular those areas where you want to develop deeper insight or lack personal experience.  Remember to relate these back to the syllabus.

As you work your way through the guidance, you need to consider the following four steps:

1. Check relevance: match each guide to a specific syllabus outcome rather than reading every guide from cover to cover.
2. Focus on concepts: note the purpose, key risks, responsibilities, processes and practical techniques.
3. Link back to the Standards: record which principles or standards the guidance helps to apply.
4. Practise application: use short scenarios and ask what an internal auditor should do first, next or most appropriately.

As mentioned earlier, the Global Guidance remain the key source of exam questions, so if you are going to engage directly with the guidance rather than focussing on your study materials only, you will develop a deeper understanding of what the standard look like in practice and what is expected of internal auditors working in the profession.

Topical Requirements

The topical requirements establish a mandatory minimum baseline for assurance work on specified significant risk topics, such as cybersecurity and third-party risk. On the IPPF the Topical requirements are associated with Domain V: Performing Internal audit services, and so primarily linked to Part 2. 

The topical requirements are mandatory for assurance engagements, and recommended for advisory services.

As of the end of September 2026, four publications are available:

• Cybersecurity
• Third-party
• Organisational behaviour
• Organisational resilience

A further two will be published within the next few months:

• Talent management
• Anti-corruption

The Part 2 syllabus is very clear on how you are expected to include the Topical requirements in your exam preparation, and requires you to consider the Topical requirements when:

• Determining the objectives and the scope
• Planning the engagement
• Completing a risk assessment

A good place to start would be to download the Topical Requirements Application Guidance which explains how to navigate the mandatory requirements, addressing the limitations, and the identification of critical risk thresholds.  Each of the Topical Requirements also comes with a User Guide.

So when studying for Part 2, you should know the Topical Requirements and when presented with an engagement on any of the topics should be able to apply the topical requirements to demonstrate the impact it will have on the objectives and scope, planning, and risk assessment.

In the exam this will be presented as a scenario question, so the application of the Topical Requirements are key.