What it means
Every sizable organisation needs someone to check that its controls, risk management, and governance actually work, independent of the people running them. That someone is the internal auditor, and the Institute of Internal Auditors is the profession's global home: standard setter, certifier, and advocate in one.
Founded in 1941 in New York, the institute grew from a small American association into a body with chapters and affiliates in more than 170 countries and territories. Its members work inside companies, governments, and nonprofits, auditing their own organisations with a charter that grants them independence from the activities they review.
The institute's most important product is its standards. The Global Internal Audit Standards, comprehensively revised and reissued in 2024, define what internal audit is for, how it should be governed, and what quality looks like, from the audit charter down to individual engagements.
Boards and audit committees use them as the benchmark for their own audit functions. Its second pillar is certification.
The Certified Internal Auditor designation is the profession's flagship credential, earned through examinations covering audit essentials, practice, and business knowledge, plus experience requirements. Holding it signals fluency in the global standards, whatever country the auditor works in.
Internal audit differs from the external audit most managers know. External auditors opine on financial statements for outside stakeholders, while internal auditors work for the board, examining anything from cybersecurity controls to procurement fraud to culture.
The institute's standards make that distinction of purpose explicit. For managers, the standards matter in two practical ways: they define what you may and may not ask of your internal audit function without compromising its independence, and they give you the vocabulary to evaluate whether the function is doing its job.
The institute also researches emerging risk, publishes guidance on topics from artificial intelligence governance to third-party risk, and lobbies for the profession's role in governance codes worldwide, which is why most national governance frameworks now expect a functioning internal audit capability. The Institute of Internal Auditors is to internal audit what a standards body is to engineering, so when your board asks whether internal audit is up to standard, the benchmark being referenced, explicitly or not, is almost certainly the IIA's.
In practice
Real-world examples.
Example
A listed company's audit committee adopts the IIA's Global Internal Audit Standards as the operating framework for its internal audit charter. It requires the chief audit executive to report conformance annually. The committee also asks for an external quality assessment at agreed intervals.
Example
A finance professional in Lagos studies for the Certified Internal Auditor exams, passing the three-part program to qualify for a regional head of internal audit role at a multinational bank. The credential shows the bank that she knows the global standards. She applies them to the bank's branch audits across the region.
Example
A government ministry establishing its first internal audit unit models the unit's mandate, reporting lines, and quality program directly on the IIA standards, as its supreme audit institution recommends. The ministry's secretary agrees that the unit will report functionally to an independent committee. The unit's first plan covers procurement and payroll.
Case study
Seen in the real world.
Fictional example: Altair Foods, a fictional packaged-goods group, suffers a procurement fraud that its finance controls missed. The board's review finds the internal audit team reports to the chief financial officer, audits only financial processes, and lacks qualified staff. A new chief audit executive rebuilds the function on the IIA standards: administrative reporting to the chief executive, functional reporting to the audit committee, a risk-based plan covering operations and technology, and Certified Internal Auditor hiring. A follow-up external quality assessment two years later rates the function conformant.
The rebuilt team's first risk-based plan includes procurement, third-party payments and cybersecurity, areas that the old finance-only plan never reached. Management agrees that the audit committee, not the chief financial officer, approves the plan and receives the findings. The board now asks the chief audit executive to confirm independence every year.
Watch out
Common mistakes.
- Treating internal audit as a branch of finance. The IIA standards require independence from management, with functional reporting to the board, precisely so auditors can examine finance itself.
- Assuming the standards are optional for unlisted companies. Regulators, lenders, and insurers increasingly benchmark any sizable organisation's audit function against them.
- Confusing the IIA with external audit bodies. The institute governs the internal profession; statutory financial statement audits follow separate national and international auditing standards.
Questions
People also ask.
What does the Institute of Internal Auditors do?
It sets the Global Internal Audit Standards, administers the Certified Internal Auditor credential, publishes guidance and research, and represents the internal audit profession in more than 170 countries and territories.
What are the Global Internal Audit Standards?
The IIA's framework, comprehensively revised in 2024, defining internal audit's purpose and how functions should be governed, managed, and performed. Boards use them to benchmark their own audit functions.
How is internal audit different from external audit?
External auditors give an independent opinion on financial statements for outside users. Internal auditors work for the board, examining controls, risk management, and governance across the whole organisation.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%Related