The Global Internal Audit Standards took effect in January 2025, replacing the IPPF structure the profession had lived with for two decades. Most summaries list the mechanics — five domains, fifteen principles, requirements with considerations. Here is what actually changes on the ground.
1. The board's job is now explicit
The old Standards spoke to auditors. The new ones speak to boards. Domain III places documented obligations on the board: approve the mandate, appoint the CAE, safeguard independence, ensure resources. If your audit committee has never seen the word "mandate," Domain III is your conversation starter.
2. The CAE becomes a performance-managed executive
Domain V requires the CAE to measure the performance of the function itself — methodologies, objectives, KPIs, improvement actions. QAIP is no longer a periodic ritual; it is a management system. The functions that thrive will treat their own performance data with the same rigour they demand of auditees.
3. "Essential Conditions" make politics auditable
The Standards now openly acknowledge what practitioners always knew: internal audit effectiveness depends on conditions the CAE does not control — positioning, access, resourcing, board support. Naming these as essential conditions gives CAEs standing to escalate structural problems that were previously career-limiting to mention.
4. Topical requirements are coming
The IIA now issues topical requirements (cybersecurity being the first) that define minimum coverage when auditing specific areas. This is a quiet revolution: for the first time, the Standards will say not just how to audit, but what good coverage of a topic looks like.
5. Conformance becomes continuous
Mapping your methodology to fifteen principles once is table stakes. The real shift is evidencing conformance continuously — engagement by engagement — instead of rediscovering gaps every five years when the external assessor arrives.
The practical move
Run a gap assessment against the fifteen principles, but present it to the audit committee as their gap assessment too. The 2024 Standards' deepest change is that internal audit quality is now explicitly a shared responsibility between the CAE and the board. Use that.