Institute of Internal Auditors

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
The Institute of Internal Auditors (IIA)
Institute of Internal Auditors Logo.png
MottoStep Forward (2019)
HeadquartersLake Mary, Florida, United States
Region served
Official language
Richard F. Chambers
J. Michael Joyce Jr. (2019 - 2020)
Decrease USD $65.32 million (2019)
ExpensesIncrease USD $61.65 million (2019)

The Institute of Internal Auditors (IIA) is an organization which advocates, provides educational conferences, and develops standards, guidance, and certifications for the internal audit profession.[3]

IIA mission[edit]

The stated mission of The Institute of Internal Auditors is to provide "dynamic leadership" for the global profession of internal auditing. This includes:

  • Advocating and promoting the value that internal audit professionals add to their organizations;
  • Providing comprehensive professional education and development opportunities; standards and other professional practice guidance; and certification programs;
  • Researching, disseminating, and promoting to practitioners and stakeholders knowledge concerning internal auditing and its appropriate role in control, risk management, and governance;
  • Educating practitioners and other relevant audiences on best practices in internal auditing;
  • Bringing together internal auditors from all countries to share information and experiences.

The critical role of the IIA in establishing a corporate conscience for internal auditors has been explored by Kapoor and Brozzetti in the CPA Journal.[4]

The IIA’s annual report, Pulse of Internal Audit is based on a survey of over 500 internal audit executives and identifies key risk areas.[5] In 2019, those risk areas were:[5]

  • Cybersecurity and data protection
  • Third-party risks
  • Emerging and atypical risks
  • Board and management activity


Established in 1941,[6] the IIA today serves more than 200,000 members [7] from more than 170 countries and territories. IIA's global headquarters are in Lake Mary, FL, United States. Richard Chambers is the President and CEO.[8][9] Chambers succeeded David A. Richards, CIA, in 2009. Previously, Chambers was IIA vice president of the Learning Center from 2001 to mid-2004 and national practice leader in Internal Audit Advisory Services at PricewaterhouseCoopers until 2009.[10]

Certified Internal Auditor (CIA)[edit]

The CIA (Certified Internal Auditor) is the primary professional designation offered by The IIA. The CIA designation is a globally recognized certification for internal auditors and is a standard by which individuals may demonstrate their competency and professionalism in the internal audit field. In order to become a certified internal auditor, candidates must possess a four-year degree from an accredited institution as well as pass all three parts of the CIA exam.[11]

Earning the CIA certification is intended to demonstrate a professional knowledge of the internal audit profession. CIAs are required to take continuing education courses.

Many CIAs today are senior internal audit managers, Vice Presidents, Directors and Chief Audit Executives in top global MNC companies driving internal audit functions in their respective companies. The first CIA exam was given in 1974. Through December 31, 2019, over 165,000 CIAs have been awarded.[12]

Internal Auditors who take and pass the CIA Part One exam can earn the designation of Internal Audit Practitioner.[13] In 2019, the IIA announced it would be changing the Internal Audit Practitioner program.[13] The program changes include a new exam and waiving of the educational requirement for active Internal Audit Practitioner designation holders applying for the CIA program.[13] The changes go into effect in 2020.[13]

Other certificates offered by the IIA[edit]

In 2019, the IIA announced plans to change its Certification in Risk Management Assurance (CRMA) program.[13] The CRMA changes go into effect in October 2020, and will include a new exam and updated prerequisites and experience requirements.[13]

  • Certification in Risk Management Assurance (CRMA)
  • Qualification in Internal Audit Leadership (QIAL)
  • Internal Audit Practitioner (IAP)
  • Certification in Control Self Assessment (CCSA)
  • Certified Government Auditing Professional (CGAP), for Government performance auditing and Government Auditors
  • Certified Financial Services Auditor (CFSA)

Changes to CCSA, CFSA, and CGAP[edit]

As of December 31, 2018, the CCSA, CFSA, and CGAP are no longer accepting new applications, and the 3 designations will be re-positioned into assessment-based certifications in the future.[14]

Number of Certificate Holders[edit]

Africa 3,988 828 146 179 565 19 74 5,799
Asia Pacific 77,521 2,476 721 1,215 4,536 11 97 86,394
Caribbean 86 1 4 11 16 0 3 121
Central & South America 1,643 554 182 61 710 3 34 3,187
Europe 18,010 1,615 1,752 952 3,015 473 170 25,987
Middle East 4,025 271 54 147 737 23 114 5,371
North America 54,962 1,979 2,773 4,513 6,437 49 465 71,178
Other 5,036 43 6 53 1 0 0 5,139
Total 165,271 7,767 5,638 7,131 15,834 578 957 203,176

Professional standards: the International Professional Practices Framework[edit]

The IIA has two levels of professional guidances: (1) Mandatory Guidance (including the Standards) and (2) Strongly Recommended Guidance. The two levels of guidance constitute the IIA's International Professional Practices Framework (IPPF).

Mandatory guidance: the definition of internal auditing, the code of ethics[15] and the Standards[16][edit]

These guidelines are mandatory for IIA members and internal audit organizations claiming to complete audits to IIA technical standards around the world. The guidelines and recommendations are recorded in what is referred to as the "Red Book."

  • The Definition: Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.
  • The four principles of the IIA's Code of Ethics are Integrity, Objectivity, Confidentiality and Competency.
  • The International Standards for the Professional Practice of Internal Auditing:
Attribute standards Performance standards
1000 – Purpose, Authority, and Responsibility 2000 – Managing the Internal Audit Activity
1010 – Recognition of the Definition of Internal Auditing, the Code of Ethics, and the Standards in the Internal Audit Charter 2010 – Planning
1100 – Independence and Objectivity 2020 – Communication and Approval
1110 – Organizational Independence 2030 – Resource Management
1111 – Direct Interaction with the Board 2040 – Policies and Procedures
1120 – Individual Objectivity 2050 – Coordination
1130 – Impairments to Independence or Objectivity 2060 – Reporting to Senior Management and the Board
1200 – Proficiency and Due Professional Care 2070 - External Service Provider and Organizational Responsibility for Internal Auditing
1210 – Proficiency 2100 – Nature of Work
1220 – Due Professional Care 2110 – Governance
1230 – Continuing Professional Development 2120 – Risk Management
1300 – Quality Assurance and Improvement Program 2130 – Control
1310 – Requirements of the Quality Assurance and Improvement Program 2200 – Engagement Planning
1311 – Internal Assessments 2201 – Planning Considerations
1312 – External Assessments 2210 – Engagement Objectives
1320 – Reporting on the Quality Assurance and Improvement Program 2220 – Engagement Scope
1321 – Use of "Conforms with the International Standards for the Professional Practice of Internal Auditing" 2230 – Engagement Resource Allocation
1322 – Disclosure of Nonconformance 2240 – Engagement Work Program
1112 – Chief Audit Executive Roles Beyond Internal Auditing 2300 – Performing the Engagement
IIA Glossary 2310 – Identifying Information
2320 – Analysis and Evaluation
2330 – Documenting Information
2340 – Engagement Supervision
2400 – Communicating Results
2410 – Criteria for Communicating
2420 – Quality of Communications
2421 – Errors and Omissions
2430 – Use of "Conducted in Conformance with the International Standards for the Professional Practice of Internal Auditing"
2431 - Engagement Disclosure of Nonconformance
2440 – Disseminating Results
2450 – Overall Opinions
2500 – Monitoring Progress
2600 – Resolution of Senior Management's Acceptance of Risks

Strongly Recommended Guidance: position papers, practice advisories, and practice guides[edit]

These Strongly Recommended Guidance help define and explain the IIA standards.

Practice guides[edit]

As practice guides, 8 PGs, 15 GTAG (Global Technology Audit Guide), and 3 GAITs (Guide to the Assessment of IT Risk) have been issued in 2009 and 2010. GTAGs are written in straightforward business language to address a timely issue related to information technology (IT) management, control, and security. To date, the IIA has released GTAGs on the following topics:

  • GTAG 1: Information Technology Controls
  • GTAG 2: Change and Patch Management Controls: Critical for Organizational Success
  • GTAG 3: Continuous Auditing: Implications for Assurance, Monitoring, and Risk Assessment
  • GTAG 4: Management of IT Auditing
  • GTAG 5: Managing and Auditing Privacy Risks
  • GTAG 6: Managing and Auditing IT Vulnerabilities
  • GTAG 7: Information Technology Outsourcing
  • GTAG 8: Auditing Application Controls
  • GTAG 9: Identity and Access Management
  • GTAG 10: Business Continuity Management (BCM)
  • GTAG-11: Developing the IT Audit Plan
  • GTAG-12: Auditing IT Projects (Mar. 2009)
  • GTAG-13: Fraud Prevention and Detection in an Automated World (December 2009)
  • GTAG-14: Auditing User-developed Applications (June 2010)
  • GTAG-15: Information Security Governance (June 2010)
  • GTAG-16: Data Analysis Technology (August 2011)
  • GTAG-17: Auditing IT Governance (July 2012)
  • Auditing Smart Devices: An Internal Auditor’s Guide to Understanding and Auditing Smart Devices (August 2016)
  • Assessing Cybersecurity Risk: Roles of the Three Lines of Defense (September 2016)
  • Understanding and Auditing Big Data (May 2017)
  • Auditing Insider Threat Programs (August 2018)

The IIA offers 31 General practice guides, 4 Financial Services guides, 4 Public Sector guides, 18 Global Technology Audit Guides (GTAG), 3 Guides to the Assessment of IT Risk (GAIT), and 2 guides for supplemental guidance.[17]

Additional sources of guidance: Development and practice aids[edit]

This includes a variety of materials that are developed and/or endorsed by the IIA, including research studies, books, seminars, conferences, and other products and services related to the professional practice of internal auditing.

Internal Audit Foundation[edit]

The Internal Audit Foundation is a not-for profit organization that promotes and advances the value of the internal audit profession globally. It supports research, grants and awards, and promotes internal auditing study at post-secondary institutions world wide.

American corporate governance index[edit]

In December 2019, the IIA announced the results from its inaugural American Corporate Governance Index (ACGI).[18] The ACGI is a joint project of the IIA and the Neel Corporate Governance Center at the University of Tennessee, and grades companies on eight Guiding Principles of Corporate Governance.[19] The principles were compiled from guidance and principles from organizations like the Business Roundtable, National Association of Corporate Directors, and New York Stock Exchange. Scores were based on the survey responses of 128 chief audit executives.[18][20] The criteria included: board performance, external disclosures, company wide communication, corporate culture, and long-term strategies.[21] The first report graded U.S. publicly listed companies overall with a C+.[18][19]

See also[edit]


  1. ^ "Annual Reports". About the Profession. Institute of Internal Auditors. Retrieved 21 July 2020.
  2. ^ "About The IIA". About the Profession. Institute of Internal Auditors. Retrieved 21 July 2020.
  3. ^ "Membership".
  4. ^ Kapoor, G., & Brozzetti, M. (2012).The Transformation of Internal Auditing. CPA Journal, 82(8), 32–35.
  5. ^ a b "Audit executives concerned about emerging risks". Accounting Today. 2019-03-05. Retrieved 2020-02-28.
  6. ^ Parker, S., & Johnson, L. A. (2017). The Development of Internal Auditing as a Profession in the U.S. During the Twentieth Century. Accounting Historians Journal, 44(2), 47–67.
  7. ^ Cohn, M. (2019). IIA sees membership exceed 200,000. Accountingtoday.Com
  8. ^ "What We Need Our Auditors to Do". Retrieved 2020-04-16.
  9. ^ "Internal Auditors global chief cautions about emerging risks". Retrieved 2020-04-16.
  10. ^ "Institute of Internal Auditors Names Richard F. Chambers New President". Retrieved 2020-04-23.
  11. ^
  12. ^ "Certified Internal Auditor" (PDF). TheIIA.
  13. ^ a b c d e f "IIA plans changes to certifications and exams for internal auditors next year". Accounting Today. 2019-11-20. Retrieved 2020-01-21.
  14. ^ "CFSA, CGAP, CCSA Transition FAQs" (PDF). CCSA, CFSA, CGAP Transition. Institute of Internal Auditors. Retrieved 27 July 2020.
  15. ^ "IIA Code of Ethics". IIA Code of Ethics. IIA. Archived from the original on 4 May 2011. Retrieved 30 March 2011.
  16. ^ "IIA standards". IIA standards. IIA. Retrieved 30 March 2011.
  17. ^ "Supplemental guidance". IIA. Retrieved 6 March 2020.
  18. ^ a b c "Corporate governance rated only C+ by auditors". Accounting Today. 2019-12-12. Retrieved 2020-04-20.
  19. ^ a b Heller, Matthew (2019-12-12). "Governance Survey Grades Companies With C+". CFO. Retrieved 2020-04-20.
  20. ^ "Corporate Governance Gets a C+ Grade from Institute of Internal Auditors". Retrieved 2020-04-23.
  21. ^ "The Morning Ledger: Fed Decision Keeps Rates Steady, Sees Long Pause". Retrieved 2020-04-23.

External links[edit]