In July 2023, Thijs Smit, Associate Partner Internal Audit Leadership at ONE Risk Advisory, wrote a column in Audit Magazine about the proposed Global Internal Audit Standards. IIA Global published the new draft standards in early March 2023 and presented them as an evolution. Thijs came to a different conclusion: it is a revolution, with good and less good sides. He welcomed the new name and the clear structure. He was concerned about the more rule-based character, the requirements imposed directly on the board and the mandatory rating of each finding.
Below is the column as it appeared on 3 July 2023 in Audit Magazine, the professional journal for internal auditors published by IIA Netherlands. The column was written in Dutch; this translation is by ONE Risk Advisory. It is followed by a postscript on what became of these points in the final Standards, which the IIA published on 9 January 2024.
The column: Evolution, really?
No, this column is not about Darwin’s theory of evolution. I want to talk about the proposed new rules for internal audit.
In early March this year, IIA Global published the new draft standards. The whole package has been presented as an evolution. Having studied it, I come to a different conclusion: it is an outright revolution. And as so often with revolutions, this one has its good and less good sides. In my view, the less good sides prevail.
The new rules contain a number of positive points, but also several dangerous developments that may have a negative impact on professional practice.
I will start with two positive points. The first concerns the name. The current name of the standards is ‘The International Standards for the Professional Practice of Internal Auditing’. The new name will be ‘Global Internal Audit Standards’, which in my view is a real improvement.
The second positive point concerns the structure of the standards. The current IIA rules can hardly be called clear. They consist of a series of organically grown mandatory and recommended elements that together form the International Professional Practices Framework (IPPF). The structure of the new rules is much clearer. The proposed standards are divided into five domains. As everything is still only available in English, I have translated the names of the domains into Dutch. My apologies for the sometimes rather amateurish translation:
- domain 1: purpose of internal audit;
- domain 2: ethics and professionalism;
- domain 3: governance of internal audit;
- domain 4: managing an internal audit function;
- domain 5: performing internal audit engagements.
The first domain consists of the definition and mission of internal audit. Domains 2 to 5 contain some 15 principles. Domain 2 sets out the following 5 principles: integrity, objectivity, competencies, professionalism and confidentiality. The 15 principles contain 53 standards. For example, principle 1 ‘integrity’ has 3 standards, namely:
- 1.1 honesty and courage;
- 1.2 the organisation’s ethical expectations; and
- 1.3 professional conduct.
In addition, each standard sets out the considerations that led to it and the way to demonstrate conformance with it. A fine, logical structure for all the standards, with a very thorough explanation. A considerable improvement on the current situation. So much for the good news.
The content of the new standards does not make me happy. Let me start with a general observation. The current IPPF is principle based; the proposed new standards are more rule based in character. The current IPPF uses ‘should’ about a hundred times, and often uses terms such as ‘consider’ or ‘could’. In the proposed standards these have often been replaced by ‘should’, more than three hundred times. That leaves little room for your own interpretation when applying the standards. A bad development, in my view.
The proposed standards impose requirements directly on the company’s board. It will be difficult for the chief auditor to impose those requirements on his executive board and/or audit committee.
Another debatable point: a rating per finding becomes mandatory, as does an overall opinion for the audit as a whole. We all know that ratings can sometimes distract from what really matters, namely improving the organisation. I expect that introducing this standard in the Dutch context will be very difficult.
Many fellow professionals, organisations and institutes have submitted their comments to IIA Global. The final version of the standards is expected in the fourth quarter of this year.
Postscript (October 2026): what became of it in the final Standards?
The IIA published the final Global Internal Audit Standards on 9 January 2024. They have applied since 9 January 2025 and replace the International Standards for the Professional Practice of Internal Auditing, the Code of Ethics and the other mandatory elements of the 2017 IPPF. According to the IIA, the proposed standards drew nearly 19,000 comments from 1,600 consultation responses. Since 9 January 2025, the Standards have also been the framework for the External Quality Assessment (EQA) that an internal audit function must have carried out at least once every five years. The table shows, for each point in the column, what the final text says.
| Point in the column | Final text (9 January 2024) |
|---|---|
| The name | It became Global Internal Audit Standards, the name Thijs considered an improvement. |
| The structure | Five domains, fifteen principles and 52 standards (53 in the proposed standards). Each standard has Requirements, Considerations for Implementation and Examples of Evidence of Conformance. |
| Principle 1, integrity | Principle 1 Demonstrate Integrity, with Standards 1.1 Honesty and Professional Courage, 1.2 Organization’s Ethical Expectations and 1.3 Legal and Ethical Behavior. |
| Principle based or rule based | “Must” specifies an unconditional requirement. “Should” appears in the Considerations for Implementation and describes practices that are preferred but not required. |
| Requirements for the board | The requirements in Domain III are addressed to the Chief Audit Executive (CAE). What the board and senior management do is set out for each standard as an essential condition. The CAE must discuss this domain with them. |
| Rating per finding and overall opinion | Each finding must be prioritised by significance, using the CAE’s methodologies (Standard 14.3). Each engagement has a conclusion (Standard 14.5). A rating scale for that conclusion is not mandatory; the considerations for 14.5 give one as an example. |
In the column, Thijs refers to the executive board and the audit committee. How “board” should be read in the Netherlands was set out by IIA Netherlands on 9 September 2026 in a note on applying the Standards in the Dutch two-tier system. In that reading, the board consists of two bodies: the executive board and the supervisory board with its audit committee. Oversight of the internal audit function under Principle 8 lies with the audit committee.
About Thijs Smit
Thijs Smit is Associate Partner Internal Audit Leadership at ONE Risk Advisory, a Dutch chartered accountant (RA) and a Certified Internal Auditor. He was the Chief Audit Executive of six companies and, besides The Hague, Amsterdam and Utrecht, has worked in Brussels and London. At IIA Netherlands he served for more than 25 years as a committee member, board member and chair of the board. He also served for five years on the board of the European Confederation of Institutes of Internal Auditing (ECIIA), two of them as president, and from 2009 to 2013 he was a board member of the global IIA.
When the column appeared, Audit Magazine introduced him as an audit consultant and guest lecturer at the University of Amsterdam and Nyenrode Business University, and as a former CAE at companies including PostNL, Corus, Ahold, SNS Reaal and SHV. You can read more about Thijs on our team page.
Frequently asked questions
What are the Global Internal Audit Standards?
The Global Internal Audit Standards are the worldwide professional standards for internal auditing of The Institute of Internal Auditors (IIA). They were published on 9 January 2024 and have applied since 9 January 2025. They replace the International Standards for the Professional Practice of Internal Auditing and the other mandatory elements of the 2017 IPPF, and consist of five domains, fifteen principles and 52 standards.
Why did Thijs Smit call the new standards a revolution?
According to Thijs Smit, the draft standards of March 2023 changed not only the structure but also the character of the standards: from principle based to more rule based, with requirements addressed directly to the board and a mandatory rating per finding and overall opinion per audit. He did see the new name and the clear structure as improvements.
Are ratings of findings mandatory under the Global Internal Audit Standards?
Standard 14.3 requires internal auditors to evaluate each finding for significance and prioritise it using the Chief Audit Executive’s methodologies. Standard 14.5 requires a conclusion for each engagement. The Standards do not prescribe a fixed rating scale; the considerations for 14.5 give a scale as an example.
Where did the column Evolution, really? appear?
In Audit Magazine, the professional journal for internal auditors published by IIA Netherlands, on 3 July 2023, under the Dutch title Hoezo evolutie?
Further reading
- Global Internal Audit Standards: what is new?, our post of 21 March 2023 on the proposed standards
- Readiness Check on the Global Internal Audit Standards (January 2024)
- Thijs Smit opens the NBA interview series Getekend
- A good internal audit plan, by Robert Bogtstra and Thijs Smit
- In our glossary: Principles (formerly Core Principles) and Audit finding
Would you like to know how your internal audit function measures up against the Global Internal Audit Standards, or talk with Thijs about a quality assessment? Get in touch.