Photo by Vitaly Gariev on Unsplash
Function internal audit need to adapt to changes in risks, technology, and stakeholder expectations. Professional standards help auditor maintain the quality and relevance of the examination.
This article discusses the changes to the framework. IPPF, five domains GIAS, and implementation steps in company operations. The discussion also covers governance, auditor competency, and the digitalization of the audit process.
Understanding the Background of the IPPF Framework Transformation
Changes in the business environment drive the internal audit function to continuously adapt to the organization's risks and needs. Through updates International Professional Practices Framework (IPPF), The Institute of Internal Auditors (IIA) introduced Global Internal Audit Standards (GIAS) to strengthen the quality and consistency of internal audit practices globally.
Limitations of the Old IPPF in Facing the Complexity of Modern Business
The IPPF framework previously served as a key reference for the internal audit profession. However, technological advancements, regulatory changes, and increasing operational complexity demand a more adaptive audit approach.
Risks such as cybersecurity, data misuse, and reliance on third parties also require increased attention. Auditors need to adapt their risk assessments and audit methods to remain relevant to business conditions.
This need prompted updated standards that provide clearer guidance on governance, audit function management, and engagement execution. This allows internal audit to provide relevant risk assessments and help the organization achieve its objectives.
The Urgency of Global Alignment of Internal Audit Standards by the IIA
The IIA developed GIAS to provide consistent professional standards for internal auditors across sectors and regions. These standards clarify the principles, requirements, and responsibilities that must be applied in carrying out the internal audit function. Using a common framework, global internal audit practices can be compared across organizations.
Global alignment also helps organizations understand expectations regarding audit quality, independence, ethics, and auditor accountability. A uniform framework facilitates the application of professional practices without ignoring the different needs and contexts of each organization.
For companies, implementing GIAS provides an opportunity to evaluate policies, refine audit methodologies, and enhance auditor competency. This step helps the internal audit function add value through more targeted oversight and recommendations.
Analysis of Changes from IPPF to GIAS and the Structure of the 5 Main Domains
GIAS 2024 updates the IPPF framework with a more focused structure to support the implementation of internal audit standards. The framework consists of five interrelated domains, ranging from audit objectives to engagement execution. For an overview of its application in the internal audit environment, see Internal Supervisory Unit (SPI) college, read GIAS 2024 discussion for SPI higher education.
The five main domains of GIAS include:
- Domain I – Purpose of Internal Auditing: explains the purpose of internal audit in helping organizations create, protect, and maintain value.
- Domain II – Ethics and Professionalism: regulates the ethics and professionalism of auditors, including integrity, objectivity, competence, and confidentiality.
- Domain III – Governing the Internal Audit Function: discusses the mandate, independence, oversight, and relationship of the audit function with the board and senior management.
- Domain IV – Managing the Internal Audit Function: includes strategic planning, resource management, communication, and improving the quality of the audit function.
- Domain V – Performing Internal Audit Services: organize assignment planning, implementation of inspections, delivery of results, and follow-up monitoring.
These five domains serve as a reference for organizations in building a consistent and effective internal audit function.
Unification of Mandatory Elements and Operational Guidelines in One Framework
GIAS combines principles, standards, requirements, implementation considerations, and examples of evidence of conformity into a single framework. This structure helps auditors understand the requirements and how to apply them in their work. With this understanding, the global implementation of internal auditing can be more focused.
Organizations need to review existing audit policies and procedures to identify areas that are appropriate and aspects that still require adjustment.
Evaluation results can be used to update audit methodologies, prioritize improvements, and prepare necessary documentation. This makes GIAS implementation more focused and easier to evaluate.
Strengthening Governance (Governance) and Synergy with the Audit Committee
GIAS emphasizes the importance of governance that supports the independence and effectiveness of the internal audit function. This includes clarity of mandate, responsibilities, reporting lines, and oversight of audit implementation. Discussion on three lines model can help clarify the division of roles between management, oversight functions, and internal audit.
The audit committee or relevant oversight body plays a role in supporting the internal audit function. A clear relationship with the head of internal audit helps ensure that significant findings, resource requirements, and audit implementation constraints are communicated appropriately.
Regular coordination also helps align the audit plan with the company's key risks. Discussions can include audit priorities, significant findings, and follow-up on recommendations.
Through clear governance and effective communication, the internal audit function can provide relevant information for oversight and support corporate decision-making.
Key to Implementing the IIA GIAS Standards for Internal Audit
Photo by Berke Citak on Unsplash
Implementing GIAS requires risk-based audit planning, competent auditors, and regular quality evaluations. These three aspects help ensure audit activities are effective and aligned with organizational objectives.
Continuous Risk Assessment (Continuous Risk Assessment)
Continuous risk assessment helps auditors identify changes in risks that could impact the achievement of company objectives. This process includes evaluating operational, financial, compliance, information security, and governance risks.
Auditors need to consider changes in business processes, technology use, regulations, and market conditions. The assessment results are used to determine audit priorities and tailor the audit plan to the level of risk faced by the company.
Companies can implement the following steps:
- Mapping risks based on impact and likelihood of occurrence.
- Update risk assessments when significant changes occur.
- Determine inspection priorities based on risk level.
- Documenting the assessment results as a basis for audit planning.
- Monitor follow-up on high-risk findings.
With this approach, internal audits not only focus on problems that have already occurred, but also help identify potential problems early on.
Improving Auditor Ethics, Professionalism, and Quality Standards
GIAS emphasizes the importance of ethical behavior, objectivity, competence, due professional care, and confidentiality in the performance of internal audits. Auditors must perform their duties independently and avoid conflicts of interest that could affect the audit results. To understand the principles of auditor conduct in more detail, see internal audit code of ethics.
Companies can support the implementation of these principles through training, performance evaluations, knowledge updates, and auditor competency development. Training materials can be tailored to the organization's needs, including risk understanding, audit techniques, data analysis, and technology utilization.
In addition to individual competency, companies need to ensure the quality of audit activities through periodic evaluations. This process includes reviewing documentation, procedures for compliance with standards, the quality of findings, and the effectiveness of recommendations and follow-up.
Some steps that can be implemented include:
- Develop a sustainable auditor competency development program.
- Implement ethical guidelines and conflict of interest reporting mechanisms.
- Conduct supervision and review of audit results.
- Evaluate the conformity of the audit methodology with GIAS.
- Monitor implementation of recommendations and make process improvements.
Through consistent application of ethics, competency improvement, and quality evaluation, companies can strengthen trust in the internal audit function and increase its contribution to the organization.
Adaptation of the New 2025 Internal Audit Guidelines in Company Operations
Implementing GIAS requires adjustments to policies, testing methods, and internal audit documentation. Companies need to evaluate existing processes to ensure they align with the latest standards.
Audit Charter Evaluation and Testing Methodology Adjustments
Companies need to review internal audit charter to ensure that the auditor's mandate, authority, responsibilities and independence are well explained.
Testing methodologies also need to be adjusted through risk evaluation, audit procedures, evidence documentation, and reporting of findings. This will ensure a more focused and consistent audit process.
Digitalization of Working Papers and Software-Based Audit Reporting
Using audit software helps companies manage workpapers, store audit evidence, monitor findings, and track follow-up in one system.
Digitization also simplifies report preparation and improves documentation traceability. Companies need to choose software that aligns with their audit needs, data security, and team workflow.
Read Also: 7 Best Internal Audit Software for Business 2026
Conclusion
The transition to GIAS 2025 is a crucial step in strengthening internal audit governance and quality. This standard helps companies implement a more structured and consistent audit process. Consistent global implementation of internal audit also depends on team readiness and thorough documentation.
Companies need to assess gaps, update their internal audit charter, enhance auditor competency, and adapt audit methodologies. Technology can also assist with documentation management and follow-up monitoring. In this process, global internal audit serves as a benchmark for assessing whether any changes are in line with standards.
To support a more structured internal audit process, visit website Audithink or schedule an Audithink demo according to company needs.
FAQ
What is Global Internal Audit Standards (GIAS) 2025?
GIAS is an internal audit professional standard published by the IIA on January 9, 2024, and effective January 9, 2025. This standard is a mandatory component of the 2024 edition of the IPPF.
What is the relationship between IPPF and GIAS?
The IPPF is a professional framework encompassing internal audit standards and guidance. GIAS is a mandatory standard component of the 2024 edition of the IPPF, not another name for the entire IPPF framework.
What are the five domains of the Global Internal Audit Standards?
Lima domainnya adalah Purpose of Internal Auditing, Ethics and Professionalism, Governing the Internal Audit Function, Managing the Internal Audit Function, dan Performing Internal Audit Services.
When will the Global Internal Audit Standards become effective?
GIAS was issued on January 9, 2024 and became effective on January 9, 2025. The internal audit function needs to evaluate its implementation according to the requirements of the standard and the organizational context.
How do companies begin the transition to GIAS?
Companies can start with a gap assessment, then update policies, internal audit charter, methodology, and competency development plans. Implementation needs to be monitored through evidence and periodic evaluation.
