The internal auditing definition the IIA uses now
The IIA changed the internal auditing definition in 2024. Organizations that keep the retired wording risk tying an internal audit charter or policy to a framework that is no longer effective.
500+
audit and attestation engagements
AICPA
peer reviewed firm
16+
years auditing experience
What the internal auditing definition covers
In the Global Internal Audit Standards glossary, the IIA defines internal auditing as an independent, objective assurance and advisory service designed to add value and improve an organization's operations. The IIA adds that it helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management, and control processes.
Internal auditors may work as employees or through outside providers. The IIA treats independence as freedom from conditions that impair unbiased work, supported by direct accountability to the board and by protection from interference.
What the three parts of the definition mean
Independent and objective.
Where internal auditors stand. They examine work they do not perform themselves, and they report to the board.
Assurance and advisory.
What internal auditors deliver. In assurance work they test whether your team performs a control as designed. In advisory work they help management improve the control before a failure.
Governance, risk management and control.
What internal auditors examine. The IIA names those three processes inside the definition itself.
What changed in the internal auditing definition in 2024
The IIA replaced the 2017 International Professional Practices Framework with the 2024 edition. On its own standards pages the IIA states that the 2017 content stays available for research and study only, because it is no longer effective for internal audit functions, and that the 2024 IPPF supersedes it.
Two things changed. In 2017 the IIA described internal auditing as an assurance and consulting activity; in 2024 it describes it as an assurance and advisory service. In 2017 it listed risk management, control, and governance processes; in 2024 it puts governance first, then risk management and control. The IIA marks the 2017 wording on its own definition page as available for research and study only.
Check the source date on the internal auditing definition you rely on inside a charter or a policy, and update a 2017 reference to the 2024 IPPF.
The role of internal audit in an organization
The IIA opens the standards with a Purpose Statement, and writes that internal auditing strengthens the organization's ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight.
Companies asking why internal audit is required find the answer in their listing rules, their laws and their sector regulators, because the IIA does not impose the requirement in its Standards. We cover the NYSE and Nasdaq listing rules in SOX and internal audit.
The objectives of internal audit, as the IIA states them
In its Purpose Statement the IIA lists five things internal auditing enhances, and those are the objectives of internal audit in practice:
Successful achievement of objectives. Whether the organization reaches what it set out to do.
Governance, risk management and control processes. Whether the organization runs them well.
Decision making and oversight. Whether the people deciding have what they need in front of them.
Reputation and credibility with stakeholders. Whether the organization earns and keeps their trust.
Ability to serve the public interest. Whether the organization fulfills that responsibility.
Types of internal audit work and who does each
Controls audit.
We test whether your team performs the approvals and reconciliations your written process describes. See our internal audit services.
Operational review.
We measure a finance process for time, handoffs and rework and recommend changes. See Six Sigma and operational audit.
SOX control testing.
Your internal auditors, or we, test controls over financial reporting for management's 404(a) assessment. See SOX and internal audit.
We review finance and accounting processes. We do not audit IT systems outside the controls in those processes.
Internal auditor definition
An internal auditor provides assurance and advisory services inside the organization or on its behalf. They plan the work, examine the process, test controls, report findings and confirm that management completed the agreed actions.
Organizations use different titles and divide the responsibilities differently. They may call staff internal auditors, audit seniors or audit managers, while the chief audit executive leads and manages the internal audit function.
The chief audit executive reports directly to the board and typically has an administrative reporting line to the highest-ranking person in senior management, such as the chief executive officer. When you hire for the team, assess candidates against the attributes and competencies you need in the role.
When to outsource the internal audit function
You can place this work with an outside firm. We take the whole function or selected cycles under our internal audit services.
More on internal audit and how we run it
- Internal audit services
- SOX compliance audits
- How often internal audits should be conducted
- Internal auditor attributes and skills
- Internal audit outsourcing
- What an internal audit report contains
Treat the information as general. Ask a CPA to look at your own facts before you rely on any of it.
How we set the cost of running internal audit for you
We set the fee on four things:
Cycles.
We charge by the number of processes you put in scope.
Hours per month.
We price a standing arrangement on the hours your board approves.
The plan.
We charge more where we write the risk assessment and plan than where you hand us one.
Reporting line.
We charge more where we report to a board or audit committee than to one owner.
Tell us what you want examined
Tell us which processes worry you and who the internal audit function would report to. We will come back with a scope and a price.
Contact
Connect with Dimov Audit
Our dedicated team is ready to assist you on your path to financial success.
24 Mercer St, 2nd Floor, Suite 214
New York, NY 10013
United States
Reviewed by George Dimov, CPA. Dimov Audit reviews accounting processes and internal controls for boards and owners across all 50 states. George brings 20+ years of accounting and consulting experience. Profile