The internal audit code of ethics plays a crucial role in maintaining trust in the results of internal audit.
Without an enforced code of ethics, auditors may conceal findings, be swayed by the auditee, or leak sensitive data. Reports produced in such situations can mislead management in decision-making and damage trust in auditors.
Since 9 January 2025, the content of the internal audit code of ethics has been in Domain II of the Global Internal Audit Standards (GIAS) 2024. This article covers its five principles, standards 1.1 to 5.2, dilemma examples, the consequences of violations, and references in Indonesia.
What is the Internal Audit Code of ethics?
The internal audit code of ethics consists of the principles and standards of conduct that internal auditors must follow. It is found in Domain II: Ethics and Professionalism of GIAS 2024 from The Institute of Internal Auditors (IIA). Domain II replaces the IIA Code of Ethics, which previously stood apart within the 2017 IPPF framework. See the IIA's explanation of Ethics and Professionalism.
Domain II applies to all individuals and functions that provide internal audit services, including the chief audit executive (CAE). If an organization has its own code of ethics or code of conduct, conformance with Domain II is still expected. Behavior not mentioned in the standards can still be deemed unacceptable or discreditable to the profession.
As for some of the functions of this code of ethics include:
- Maintaining stakeholder trust: The code of ethics helps ensure that auditors work honestly and transparently, so that the resulting audit results can be trusted.
- Preventing conflicts of interest: By applying the principles of the code of ethics, auditors are expected to maintain objectivity and avoid situations that could create bias.
- Protects the reputation of the organization and the profession: Honest, law-abiding auditors protect the good name of the organization, and Standard 1.3 prohibits involvement in activities that discredit the organization or the profession.
- Increase the professionalism of auditors: Through compliance with the code of ethics, auditors are invited to continue to learn and develop their abilities so that the quality of work increases.
What Are the 5 Principles of the Internal Audit Code of Ethics?
Domain II contains five principles. Each principle is elaborated in standards that set out requirements, considerations for implementation, and examples of evidence of conformance. The official text is available in the Indonesian translation of GIAS 2024.
| Principle of | Standards |
|---|---|
| 1. Demonstrate integrity | 1.1 Honesty and Professional Courage; 1.2 Organization's Ethical Expectations; 1.3 Legal and Ethical Behavior |
| 2. Maintain objectivity | 2.1 Individual Objectivity; 2.2 Safeguarding Objectivity; 2.3 Disclosing Impairments to Objectivity |
| 3. Demonstrate competency | 3.1 Competency; 3.2 Continuing Professional Development |
| 4. Exercise due professional care | 4.1 Conformance with the Global Internal Audit Standards; 4.2 Due Professional Care; 4.3 Professional Skepticism |
| 5. Maintain confidentiality | 5.1 Use of Information; 5.2 Protection of Information |
1. Integrity
GIAS defines integrity as behavior consistent with moral and ethical principles, including honesty and the courage to act on relevant facts even under pressure to do otherwise. Put simply, an auditor says what is true and does what is right even when it is uncomfortable. Integrity is also the foundation of the other four principles.
Standard 1.1 (Honesty and Professional Courage): auditors must not make false or misleading statements, and must not conceal or omit findings. Known material facts must be disclosed if omitting them could affect the organization's decisions.
Standard 1.2 (Organization's Ethical Expectations): auditors understand and respect the organization's ethical expectations, and report behavior that deviates from them in line with policies and procedures.
Standard 1.3 (Legal and Ethical Behavior): auditors do not engage in illegal activity or activity that discredits the organization and the profession, and they report violations of law to the appropriate authorities. GIAS gives examples of discreditable behavior, including lying to or misleading others, including about competence or certifications, and minimizing or concealing findings in reports.
2. Objectivity
Objectivity is an impartial mental attitude that allows auditors to make professional judgments without compromise. This concept differs from the independence of the internal audit function, which is governed separately in Principle 7 and is the responsibility of the board and the CAE.
Standard 2.1: auditors maintain objectivity in all aspects of their services and recognize and manage bias, for example self-review bias, familiarity bias, and prejudice.
Standard 2.2: auditors recognize, and avoid or mitigate, actual, potential, and apparent impairments to objectivity, and do not accept gifts, rewards, or favors that could impair or appear to impair objectivity. Objectivity is considered impaired if an auditor provides assurance over activities they were responsible for within the previous 12 months.
Standard 2.3: impairments to objectivity must be disclosed promptly to the CAE or the designated supervisor. If the CAE's own objectivity is impaired, the CAE discloses it to the board.
3. Competency
Standard 3.1: auditors must possess or obtain the competency to carry out their responsibilities, including knowledge of GIAS, and only perform services for which they have, or can obtain, the competency. The CAE ensures the internal audit function collectively has the competency required.
Standard 3.2: auditors continually develop their competency through education and training. Holders of professional certifications follow their certification's continuing professional education policy. The requirements for becoming an internal auditor are covered in requirements to become an internal auditor.
4. Due Professional Care
Due professional care means planning and performing services with the diligence, judgment, and skepticism of a prudent and competent auditor. Auditors are not expected to be infallible. In the 2017 IPPF, this was set out as Attribute Standard 1220, not as part of the Code of Ethics.
Standard 4.1: services are performed in conformance with GIAS and the internal audit function's methodology. If a requirement cannot be met, the CAE documents and communicates it.
Standard 4.2: auditors consider the nature and needs of the engagement, including the organization's strategy and objectives, the adequacy of governance, risk management, and control, cost versus benefit, the materiality of risks, the probability of significant errors, fraud, or non-compliance, and the use of appropriate techniques, tools, and technology.
Standard 4.3: professional skepticism includes an inquiring attitude, critical assessment of the reliability of information, frankness in questioning inconsistent information, and efforts to obtain additional evidence.
5. Confidentiality
Auditors often have access to confidential, proprietary, and personal data, including information from oral discussions. Standard 5.1 requires auditors to follow policies, procedures, laws, and regulations when using information, and prohibits using it for personal gain or in a way that is detrimental to the organization's legitimate and ethical objectives.
Standard 5.2 requires auditors to protect the confidentiality, privacy, and ownership of information, including the management of storage, retention, disposal, and release of engagement records. Confidential information must not be disclosed to unauthorized parties unless there is a legal or professional responsibility. The CAE ensures that those who assist the internal audit function meet the same requirements.
What Is the Difference from the Old IIA Code of Ethics with 4 Principles?
The old IIA Code of Ethics (IPPF 2017) consisted of four principles along with rules of conduct 1.1 to 4.3. According to the IIA, that code applied until 8 January 2025, and Domain II took effect on 9 January 2025. Many articles still state four principles. The mapping is:
| 2017 IIA Code of Ethics | GIAS 2024 Domain II |
|---|---|
| Integrity | Principle 1, Standards 1.1 to 1.3 |
| Objectivity | Principle 2, Standards 2.1 to 2.3 |
| Competency | Principle 3, Standards 3.1 and 3.2 |
| Not a principle; due professional care is covered by Attribute Standard 1220 | Principle 4, Standards 4.1 to 4.3 |
| Confidentiality | Principle 5, Standards 5.1 and 5.2 |
An overview of the five GIAS domains is available in internal audit standards in Indonesia.
What Are Examples of Ethical Dilemmas for Internal Auditors and How Are They Handled?
The following examples are hypothetical. Each case is mapped to the relevant GIAS standard.
| Situation (hypothetical) | Standards | Steps consistent with the standard |
|---|---|---|
| A unit head asks for a duplicate payment finding to be downgraded to a verbal note. | 1.1, 1.3 | Keep the finding and its evidence. GIAS lists minimizing, concealing, or omitting findings as discreditable behavior. Discuss it with the CAE; the CAE maintains a working environment that supports evidence-based findings, whether favorable or not. |
| A new auditor is transferred from the procurement division, then assigned to audit procurement six months later. | 2.2, 2.3 | Objectivity is considered impaired if an auditor gives assurance over an activity they were responsible for within the last 12 months. Disclose it to the CAE and assign another auditor. |
| The auditee sends year-end gift baskets to the audit team. | 2.2 | Do not accept gifts or favors that could impair or appear to impair objectivity. Follow a stricter policy if the audit function has one. |
| An auditor sends working papers containing salary data to a personal email so they can work from home. | 5.1, 5.2 | Use designated channels and devices, comply with retention and access rules for engagement records, and manage the risk of inadvertent disclosure. |
| An auditor with finance experience is assigned to audit an information system without training. | 3.1 | Accept the engagement only if the competency is held or can be obtained: request training, supervision, or expert support through the CAE. |
| An auditor finds indications that a senior official violated the company's code of ethics. | 1.2 | Report according to policy. If senior management is involved, the CAE reports to the board, and the auditor follows up on and validates corrective action. |
In all cases, first discuss with your supervisor or the CAE and document the decision. GIAS directs auditors to discuss situations that challenge honesty or professional courage with their supervisor (Standard 1.1). Related reading: fraud triangle to understand pressure, audit working papers, and follow-up on audit findings.
Who Established the Internal Audit Code of Ethics?
The Internal Audit Code of Ethics was created by the Institute of Internal Auditors (IIA), an international organization founded in 1941.
IIA aims to develop and promote the internal audit profession through standard, training, and certification.
One of the IIA's biggest contributions is the International Professional Practices Framework (IPPF). In January 2024 the IIA published the Global Internal Audit Standards (GIAS), effective 9 January 2025, which in Domain II replace the IIA Code of Ethics.
The official text is available on the IIA website, including an Indonesian translation.
Local organizations and associations may have their own codes of ethics. Where they do, conformance with Domain II is still expected.
What Are the Legal Basis and Codes of Ethics for Internal Auditors in Indonesia?
Issuers and Public Companies: What Does POJK 56/POJK.04/2015 Say?
POJK 56/POJK.04/2015 requires issuers and public companies to have an Internal Audit Unit. Article 6 letters e and f require internal auditors to comply with the professional standards of the internal audit association and the internal audit code of ethics. Article 6 letter g requires keeping company information and data confidential unless required by laws and regulations or a court decision. Article 9 letter d requires the internal audit charter to contain a code of ethics that refers to the code of ethics of the internal audit association in Indonesia or an internal audit code of ethics that is generally accepted internationally. Article 12 gives the OJK authority to impose administrative sanctions for violations of the POJK, from a written warning to revocation of the business license.
Government Agencies: What Are the APIP Code of Ethics and KE-AIPI?
Article 52 of PP 60/2008 requires government internal supervision officials to abide by the code of ethics drawn up by the auditor professional organization. The Indonesian Government Internal Auditors Association (AAIPI) drew up the Code of Ethics of Indonesian Government Internal Auditors (KE-AIPI) February 2014 version with six principles: integrity, objectivity, confidentiality, competency, accountability, and professional conduct. Some of its rules: do not accept gratuities related to one's position and report to the KPK within 7 days at most if unavoidable (item 11 letter d), and a prohibition on affiliating with political parties or groups that compromise integrity and objectivity (item 20 letter d). This code was drawn up before GIAS 2024, so check for the latest AAIPI version. Public sector coverage is available in public sector internal audit.
What Is the Role of IIA Indonesia?
Article 7 of the IIA Indonesia Legal Provisions requires all members to comply with the IIA standards and code of ethics. Members who violate the IIA Code of Ethics and are proven to have committed a criminal offense may be sanctioned with termination of membership, as determined by the Board of Governors based on a recommendation from the membership committee.
What Is the Difference from the External Auditor Code of Ethics (KEPAP IAPI)?
Public accountants use the Code of Ethics for Public Accountants (KEPAP) from the Indonesian Institute of Public Accountants (IAPI). The 2025 edition adopts the Handbook of the International Code of Ethics for Professional Accountants, including the International Independence Standards, 2024 edition, from the IESBA. Its five fundamental principles are integrity, objectivity, professional competence and due care, confidentiality, and professional behavior. Independence is governed in a separate standard. The difference from internal auditors: GIAS separates competency from due professional care and places the independence of the function in governance (Principle 7), whereas KEPAP treats professional behavior as a principle and engagement independence as a standard of its own. The text is available on the IAPI KEPAP 2025 page, and a broader comparison is at external auditor profession and differences between internal and external audit.
What Are the Consequences of Violating the Internal Auditor Code of Ethics?
GIAS Domain II does not contain a list of sanctions. Consequences come from the organization, the professional association, or applicable law.
- Organizational disciplinary action: follows organizational policy. A written example for APIP: a violation of KE-AIPI can result in a warning or removal from supervisory duties and/or from the organization, and the recommended sanctions include a written reprimand, a proposal for removal from the supervision team, and not being given supervisory assignments for a certain period (KE-AIPI items 21 and 31).
- IIA sanctions for members and certification holders: IIA Disciplinary and Oversight Framework lists, among others, warning letters or formal reprimands, continuing professional education as a corrective measure, suspension or revocation of certification, suspension or termination of membership, and referral to law enforcement if a violation of law is suspected. This authority applies only to IIA members, candidates, and credential holders.
- Association sanctions in Indonesia: IIA Indonesia can terminate membership. AAIPI recognizes three categories of violation: minor, moderate, and severe (KE-AIPI item 33).
- Legal consequences: conduct that also violates the law can be prosecuted under applicable law. Standard 1.3 requires auditors to report violations of law to the appropriate authorities.
- Reputational impact: Auditors found to be in breach of the code of conduct may lose trust and reputation in the industry.
FAQ About the Internal Audit Code of Ethics
What is the internal audit code of ethics?
The principles and standards of conduct for internal auditors, now found in Domain II: Ethics and Professionalism of the IIA's GIAS 2024. Domain II replaces the IIA Code of Ethics and took effect on 9 January 2025.
What are the principles of the internal audit code of ethics?
Five principles: integrity, objectivity, competency, due professional care, and confidentiality. Each is elaborated in standards 1.1 through 5.2.
What is the function of the code of ethics for organizations?
It maintains stakeholder trust in audit results, prevents conflicts of interest that could create bias, protects the reputation of the organization and the profession, and raises auditor professionalism through continuous learning.
Who created the internal audit code of ethics?
The Institute of Internal Auditors (IIA), an international organization founded in 1941. Its code of ethics is now Domain II of GIAS 2024. An organization's own code of ethics or code of conduct can be used alongside it, but conformance with Domain II is still expected.
Which standards must auditors follow under the code of ethics?
Standards 1.1 to 1.3 (integrity), 2.1 to 2.3 (objectivity), 3.1 and 3.2 (competency), 4.1 to 4.3 (due professional care), and 5.1 and 5.2 (confidentiality). The rules of conduct numbered 1.1 to 4.3 belong to the old code of ethics.
What are the consequences if an auditor violates the code of ethics?
It depends on the organization, the professional association, and the law. Consequences can include organizational disciplinary action, association sanctions such as suspension or revocation of IIA certification for members and credential holders, and legal proceedings if the law is broken.
Does the internal audit code of ethics still have four principles?
No. Four principles were the 2017 IIA Code of Ethics, which applied until 8 January 2025. Since 9 January 2025, Domain II of GIAS 2024 has five principles because due professional care was added.
Is the internal auditor code of ethics mandatory in Indonesia?
For all internal auditors, GIAS requires conformance with Domain II. For issuers and public companies, Article 6 letter f of POJK 56/POJK.04/2015 requires compliance with the internal audit code of ethics. For government internal supervisors (APIP), Article 52 of PP 60/2008 requires adherence to a code of ethics. Beyond that, follow organizational policy.
What is the difference between the internal auditor and external auditor codes of ethics?
Internal auditors follow Domain II of GIAS (five principles). Public accountants follow the IAPI Code of Ethics for Public Accountants, which adopts the IESBA code of ethics and has five fundamental principles plus separate independence standards.
What should an auditor do when asked to remove a finding?
Keep the finding along with its evidence and discuss it with your supervisor or the CAE. Standard 1.1 prohibits concealing or omitting findings, and Standard 1.3 lists minimizing or concealing findings as discreditable behavior.
Conclusion
The internal audit code of ethics now consists of five principles in Domain II of GIAS 2024: integrity, objectivity, competency, due professional care, and confidentiality. The old code of four principles has no longer applied since 9 January 2025.
By carrying out standards 1.1 to 5.2, auditors strengthen trust in themselves and in their audit results. In Indonesia, the obligation to abide by a code of ethics comes from GIAS, POJK 56/POJK.04/2015 for issuers, and PP 60/2008 for government agencies.
Audithink is customizable internal audit management software, not an audit executor. Its features include risk assessment, audit planning, work program templates, notifications, follow-up monitoring, and automatic reports. These features help teams manage the audit process, while compliance with the code of ethics still depends on the auditor's decisions and behavior.
Contact we are for a free demonstration!
