Photo by Campaign Creators on Unsplash
SPIs at universities work under two kinds of rules at once. The first comes from government regulations that set their position and duties. The second is the professional standard that explains how internal audit is carried out with consistent quality. The professional standard most widely referenced today is the Global Internal Audit Standards (GIAS) from The Institute of Internal Auditors (IIA).
This article covers the contents of the GIAS 2024, the structure of its domains and principles, its dedicated public sector section, and how campus SPIs adapt it to national regulations. References were checked as of October 21, 2026.
What Is the GIAS 2024?
The GIAS was issued by the IIA on January 9, 2024 and has been effective since January 9, 2025. The standards contain five domains, fifteen principles, and 52 standards. Each standard contains requirements (requirements), essential conditions for the board and senior management (essential conditions), and considerations for implementation (considerations for implementation).
The full GIAS document can be downloaded free of charge from the official IIA website. A general discussion of internal audit standards in Indonesia is in the article on internal audit standards in Indonesia.
What Are the Five Domains and Fifteen Principles of the GIAS?
| Domain | Principle of |
|---|---|
| I. Purpose of Internal Auditing | The purpose of internal auditing as the foundation for all other domains |
| II. Ethics and Professionalism | 1 Demonstrate Integrity, 2 Maintain Objectivity, 3 Demonstrate Competency, 4 Exercise Due Professional Care, 5 Maintain Confidentiality |
| III. Governing the Internal Audit Function | 6 Authorized by the Board, 7 Positioned Independently, 8 Overseen by the Board |
| IV. Managing the Internal Audit Function | 9 Plan Strategically, 10 Manage Resources, 11 Communicate Effectively, 12 Enhance Quality |
| V. Performing Internal Audit Services | 13 Plan Engagements Effectively, 14 Conduct Engagement Work, 15 Communicate Engagement Results and Monitor Action Plans |
Domain II is discussed in the article on the internal auditor code of ethics. Domain III is the most relevant for the head of the SPI because it governs the relationship with leadership and oversight bodies. Domains IV and V concern how engagements are managed and carried out.
Which Standards Matter Most for Campus SPIs?
| GIAS standard | In essence | Example of application in the SPI |
|---|---|---|
| 6.1 Internal Audit Mandate and 6.2 Internal Audit Charter | The chief audit executive develops and maintains a charter covering the purpose of internal auditing, the commitment to the standards, the mandate, and the organizational position and reporting relationships, then discusses it with the board and senior management | An SPI charter approved by the head of the institution |
| 7.1 Organizational Independence | The internal audit function is positioned so that it is free from interference | A direct reporting line from the head of the SPI to leadership and the oversight body |
| 8.3 Quality and 8.4 External Quality Assessment | The chief audit executive establishes a quality assurance and improvement program, including external assessment | Quality review of working papers and assessment by an outside party |
| 9.4 Internal Audit Plan | An audit plan based on a documented assessment of strategies, objectives, and risks, at least annually, and updated as needed | A risk-based annual oversight work program |
| 13.6 Work Program | An engagement work program covering criteria, tasks, methodology, and assigned auditors, approved by the chief audit executive before it is carried out | An audit program for each engagement |
| 15.2 Confirming the Implementation of Recommendations or Action Plans | Ensuring that recommendations or action plans are implemented | Monitoring the follow-up of findings across units |
Standard 9.4 also asks that the audit plan consider information technology governance, fraud risk, and the effectiveness of compliance and ethics programs. For campuses, all three are relevant to academic systems, research funds, and procurement. How to prepare an engagement work program is discussed in the article on internal audit work program, and risk-based planning in the article on risk-based audit. The content of the charter is discussed in the article SPI internal audit charter, the annual plan in the article University SPI annual audit plan (PKPT), and coordination with other assurance providers (Standard 9.5) in the article SPI coordination.
What Does the GIAS Say About the Public Sector?
The GIAS contains a dedicated section titled Applying the Global Internal Audit Standards in the Public Sector. The IIA has not issued specific guidance for universities. Because state universities are institutions funded and regulated by the state, this public sector section is the closest reference. Some of its key points:
- The mandate and charter can come from regulations. When regulations serve as the mandate and charter, the chief audit executive may not have the authority to amend them. However, the chief audit executive can still conduct a documented periodic review to confirm that the path to legal compliance is accurately defined.
- The board may be a policy-setting body. Such a body may not have the authority to appoint, remove, or set the remuneration of the chief audit executive. In that situation, the board should still give input to management on performance evaluations and appointment decisions.
- Public disclosure. Regulations may govern which documents must or must not be released, and internal audit methodologies need to follow them.
- External assurance providers are often mandated. In some jurisdictions, the authority of a supreme audit institution may override the coordination role of the internal audit function.
- A broader set of stakeholders. Public sector auditors may consider public input when planning audits.
- Limited resources. When funding is insufficient for an external assessment, a public sector internal audit function may use peer assessment programs (peer review).
These points are restated from the public sector section of the GIAS. The full text remains the primary reference.
How Do SPIs Align the GIAS with National Regulations?
The GIAS does not replace regulations. For the SPI, regulations remain the basis of its position and duties, while the GIAS helps the quality of its work. Some points where they meet:
| Matter | National regulations | GIAS 2024 |
|---|---|---|
| Charter | Ministerial Regulation of Religious Affairs 25/2017 requires an SPI charter at PTKN. Minister of Finance Regulation 76/2025 sets the minimum content of the internal oversight charter for BLUs | Standard 6.2: the charter covers the purpose, commitment to the standards, mandate, and position and reporting lines |
| Annual plan | Minister of Finance Regulation 129/PMK.05/2020 Article 255: the SPI prepares an annual work program plan and submits it to the head of the BLU for approval | Standard 9.4: a risk-based plan, at least annual, and updatable |
| Independency | Regulation 129 Articles 262 and 263: the head of the SPI is directly accountable to the head of the BLU, and SPI auditors are prohibited from holding operational duties | Standard 7.1: an organizational position free from interference |
| Follow-up | Regulation 129 Article 260: the SPI monitors and encourages the follow-up of recommendations | Standard 15.2: ensuring recommendations are implemented |
| Code of conduct | The BLU charter refers to the code of ethics of an internal oversight association in Indonesia or an internationally accepted code of ethics | Domain II: integrity, objectivity, competency, due professional care, confidentiality |
The provisions in the regulation column apply to specific types of institutions. The legal basis of the SPI for PTN, BLU, PTN-BH, and PTKN is discussed in the article University SPI. Meeting national regulations does not automatically mean being aligned with the GIAS, and vice versa.
What Are IIA Topical Requirements?
Besides the GIAS, the IIA issues Topical Requirements, which are requirements on specific topics that form part of the professional framework. Each Topical Requirement takes effect 12 months after it is issued. As of October 21, 2026, those already issued are:
| Topic | Issued | Effective |
|---|---|---|
| Cybersecurity | February 5, 2025 | February 5, 2026 |
| Third-Party | September 15, 2025 | 15 September 2026 |
| Organizational Behavior | December 15, 2025 | December 15, 2026 |
| Organizational Resilience | April 30, 2026 | April 30, 2027 |
For campus SPIs, Cybersecurity and Third-Party are relevant to audits of academic information systems and vendor management. The list and dates may change, so check the IIA Topical Requirements page.
What Are the Practical Steps to Apply the GIAS in the SPI?
- Carry out a review (gap assessment) comparing the SPI's current practice with the standards, starting from Domain III.
- Review the SPI charter and make sure it contains the minimum elements from regulations and Standard 6.2.
- Prepare an annual oversight plan based on a documented risk assessment.
- Standardize engagement work programs and working papers so they are easy to review.
- Build an internal quality assurance program, then plan an external assessment or peer assessment.
- Monitor the follow-up of findings and report their status to leadership regularly.
How Does Internal Audit Software Help?
Audithink helps the SPI document the work the standards ask for through six main features: risk assessment, audit planning, work program templates, notifications, follow-up monitoring, and automated reports. Audithink is a support tool. Alignment with the GIAS still depends on the SPI's practice and professional judgment. Campus audit needs are discussed on the page Audithink for Educational Institutions.
FAQ About the GIAS 2024 for University SPIs
What is GIAS 2024?
GIAS is the Global Internal Audit Standards from the IIA, issued on January 9, 2024 and effective since January 9, 2025. It contains five domains, fifteen principles, and 52 standards.
Is a university SPI required to follow the GIAS?
The position and duties of the SPI are set by regulations and the statute. The GIAS is a professional standard widely used as a reference for the quality of internal audit work. If a campus adopts the GIAS in its charter or policy, the SPI must follow it as set out in that policy.
Does the IIA have specific guidance for universities?
As of October 21, 2026 there is no guidance specific to higher education. The GIAS has a public sector section that is relevant to state universities.
What is the minimum content of an internal audit charter under the GIAS?
Standard 6.2 states that the charter must at least cover the purpose of internal auditing, the commitment to the standards, the mandate including the scope and types of services, and the organizational position and reporting relationships.
How often must the audit plan be prepared?
Standard 9.4 requires the risk assessment underlying the audit plan to be performed at least annually, and the plan to be updated when risks or organizational conditions change.
What is the difference between the GIAS and Topical Requirements?
The GIAS governs internal audit practice in general. Topical Requirements govern specific topics, such as cybersecurity and third parties, and take effect 12 months after they are issued.
Conclusion
Regulations determine the position of the SPI, while the GIAS helps the SPI work with quality that can be accounted for. With a gap assessment, a clear charter, a risk-based plan, and follow-up monitoring, campus SPIs can meet both. How to assess SPI maturity with the IA-CM and the quality assurance program is discussed in the article SPI capability assessment.
If the SPI at your campus wants to tidy up its plans, work programs, and follow-up of findings, schedule an Audithink demo.
