IPPF and the Code of Ethics
The framework
Candidates must know the IPPF structure: the Global Internal Audit Standards (2024, effective 9 January 2025, replacing the 2017 Standards) sit alongside the Code of Ethics, which sets four principles - Integrity, Objectivity, Confidentiality, Competence - and twelve rules of conduct. The Standards are organised into five domains: purpose, ethics and professionalism; governance and the internal audit function; managing the internal audit function; managing individual engagements; and communicating results and monitoring progress. Topical requirements supplement the Standards for specific subject areas.
Core concepts
Key concepts to master: the internal audit charter (approved by the board, defining purpose, authority, responsibility and scope); independence in mind and appearance; organisational independence; objectivity; the dual reporting line (functional to the board/audit committee, administrative to senior management); the chief audit executive's role; quality assurance and improvement programme with internal and external assessments; and the requirement to confirm conformance.
Traps
Questions often test the distinction between independence (organisational, structural) and objectivity (individual, attitudinal). Another trap: confidentiality does not prevent disclosure where legal or professional obligations require it. Impairments to independence or objectivity must be disclosed - even a perceived impairment. Also watch the trap of treating the Code as aspirational: it is mandatory and enforceable.
Rule of thumb
Ask "is this a structural/relationship issue (independence) or a personal/attitudinal issue (objectivity)?" Independence is about where you sit; objectivity is about how you think.
Worked example
An internal auditor is offered a temporary assignment to manage the procurement department for three months. Correct answer: this is a significant impairment; accepting management responsibility compromises objectivity and independence, and the assignment should be declined or the impairment disclosed and managed, with the audit activity excluded from auditing that area afterwards.