Global Internal Audit Standards (GIAS)

What Are the Global Internal Audit Standards (GIAS)?

The Global Internal Audit Standards (GIAS) published by the Institute of Internal Auditors (the IIA) are a unified set of principles and guidelines designed to elevate the internal audit profession. Developed by leading experts and backed by the International Internal Audit Institute (IIAI), these standards serve as a roadmap for internal auditors to enhance their practices, ensure organizational alignment, and deliver value-added insights.

The GIAS focus on five core domains:

1. Purpose of Internal Auditing
2. Ethics and Professionalism
3. Governing the Internal Audit Function
4. Managing the Internal Audit Function
5. Performing Internal Audit Services

Each domain includes principles, standards, and actionable evidence to ensure conformance, providing a clear benchmark for auditors, boards, and organizations.

What Does the Checklist Contain?

To ensure adherence to the GIAS, a detailed checklist has been developed. This checklist identifies necessary documents and evidence of conformance required for each domain, principle, and standard. Here’s what the checklist contains:

1. Ethics and Professionalism

This section emphasizes integrity, objectivity, competency, and confidentiality in internal audit practices. The checklist includes:

• Training plans for ethics education.
• Signed acknowledgments of ethical commitments.
• Records of objectivity training and conflict disclosures.
• Performance evaluations showcasing honesty and professional courage.

2. Governing the Internal Audit Function

This domain ensures the internal audit function is properly authorized and supported. Key checklist items include:

• A board-approved internal audit charter.
• Documentation of resources allocated to the audit function.
• Meeting minutes affirming organizational independence.

3. Managing the Internal Audit Function

This domain focuses on strategic planning, resource management, and effective communication. Checklist items include:

• Risk-based internal audit plans.
• Records of coordination with other assurance providers.
• Documentation of internal audit methodologies and strategic objectives.

4. Performing Internal Audit Services

This is the execution phase, covering engagement planning, work, and reporting. Checklist components include:

• Engagement work programs and documented findings.
• Final reports with clear conclusions and recommendations.
• Exception tracking systems for monitoring corrective actions.

Why the GIAS Matter

The GIAS provide a structured framework to elevate the internal audit profession and meet the evolving challenges of modern governance. By adhering to these standards, organizations can:

• Ensure consistency and quality in audit practices.
• Strengthen governance, risk management, and control processes.
• Enhance stakeholder confidence through transparency and accountability.

Consolidated list of necessary documents to evidence conformance with the Global Internal Audit Standards

Domain II: Ethics and Professionalism

Principle 1: Demonstrate Integrity

1. Training plan for ethics education and training.
2. Attendance records for ethics training (e.g., sign-in sheets, certificates).
3. Performance evaluations with honesty and professional courage objectives.
4. Stakeholder feedback on honesty and courage.
5. Records of participation in workshops on ethical expectations.
6. Signed forms acknowledging commitment to ethics policies.
7. Audit plan, work programs, or workpapers addressing ethics-related risks and objectives.
8. Documentation of ethical issues communicated to senior management and regulators.
9. Records of training on laws, regulations, and ethical behavior.
10. Acknowledgment forms for legal and professional expectations.
11. Methodology for handling illegal behavior.
12. Records of communication regarding legal concerns.
13. Reviewed and signed-off workpapers.
14. Final engagement communications (if applicable).

Principle 2: Maintain Objectivity

15. Internal audit charter referencing objectivity responsibilities.
16. Policies and procedures for maintaining objectivity.
17. Records of objectivity training sessions.
18. Signed forms confirming understanding of objectivity.
19. Documentation of disclosed conflicts of interest.
20. Supervisory and mentoring records.
21. Policies for identifying objectivity impairments.
22. Documentation on stakeholder feedback about objectivity.
23. Quality review notes.
24. Compensation plans ensuring unbiased assessments.
25. Meeting minutes on objectivity impairments.
26. Alternative action plans for unavoidable impairments.
27. External quality assessment reports.
28. Methodology for disclosing impairments.
29. Documentation showing the absence or presence of impairments.
30. Records of disclosed impairments and stakeholder approvals.

Principle 3: Demonstrate Competency

31. Records of certifications, education, and experience.
32. Performance evaluations highlighting development needs.
33. Attendance records for training and education.
34. Stakeholder feedback on competency.
35. Training plans addressing development needs.
36. Self-assessment documentation for competency improvement.

Principle 4: Exercise Due Professional Care

37. Checklists demonstrating adherence to standards.
38. Internal and external quality assessment records.
39. Documentation showing auditors’ familiarity with standards.
40. Audit programs based on comprehensive planning.
41. Records of regular work reviews.
42. Compliance evidence with laws and regulations.
43. Documentation of critically evaluated information.
44. Records addressing identified risks.
45. Stakeholder feedback on professional skepticism.

Principle 5: Maintain Confidentiality

46. Records of sensitive information handling.
47. Evidence of adherence to confidentiality policies.
48. Training records on information security.
49. Policies for safeguarding information.
50. Logs of security measures (e.g., encryption, access controls).
51. Documentation of responses to confidentiality breaches.
52. Information security training records.

Domain III: Governing the Internal Audit Function

Principle 6: Authorized by the Board

53. Board-approved internal audit mandate.
54. Meeting minutes on mandate reviews.
55. Documentation of periodic mandate updates.
56. Current internal audit charter.
57. Records of charter communication.
58. Meeting minutes on charter updates.
59. Documentation of resources allocated to the audit function.
60. Records of interactions between the CAE and senior management.

Principle 7: Positioned Independently

61. Policies ensuring organizational independence.
62. Meeting minutes affirming the CAE’s independence.
63. Documentation of direct CAE reporting lines.
64. CAE’s resume and qualifications.
65. Documentation of the CAE selection process.
66. Records of CAE’s professional development.

Principle 8: Overseen by the Board

67. Meeting minutes of CAE interactions with the board.
68. Approved internal audit plan records.
69. Board discussions on audit findings.
70. Internal audit budget documents.
71. Resource allocation meeting minutes.
72. Internal and external quality assessment results.
73. Documentation of improvement initiatives.
74. External quality assessment reports.

Domain IV: Managing the Internal Audit Function

Principle 9: Plan Strategically

75. Governance, risk management, and control process analyses.
76. Records of governance-related training.
77. Risk-based internal audit strategy.
78. Documentation of internal audit methodologies.
79. Approved internal audit plan.
80. Coordination meeting records with assurance providers.

Principle 10: Manage Resources

81. Audit budget and expenditure reports.
82. Staff recruitment and development plans.
83. Records of training participation.
84. Technology and tool assessments.
85. Technology training records.

Principle 11: Communicate Effectively

86. Records of stakeholder meetings.
87. Stakeholder analysis documentation.
88. Communication plans and strategies.
89. Feedback on audit communication clarity.
90. Internal audit reports with findings and recommendations.
91. Documentation of corrected report errors.

Principle 12: Enhance Quality

92. Internal quality assessment results.
93. Performance metrics for audits.
94. Engagement performance review records.

Domain V: Performing Internal Audit Services

Principle 13: Plan Engagements Effectively

95. Records of engagement communication.
96. Risk assessment documentation.
97. Defined engagement objectives and scope.
98. Documented evaluation criteria.
99. Engagement resource allocation records.
100. Work program documentation.

Principle 14: Conduct Engagement Work

101. Records of information gathering methods.
102. Analytical methods for findings.
103. Evaluated findings documentation.
104. Recommendations and action plans.
105. Final engagement conclusions.
106. Work program adherence documentation.

Principle 15: Communicate Engagement Results and Monitor Action Plans

107. Final engagement communication records.
108. Exception tracking systems.
109. Corrective action status reports.

Conclusion

At Leitner & Associates, we are committed to helping organizations implement and comply with the GIAS. Explore our comprehensive checklist and take the first step toward internal audit excellence.

Let’s elevate your internal audit function together!

Sources:

https://www.theiia.org/en

https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards

https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/free-documents/complete-global-internal-audit-standards