I85PREP
⌘ K
CGIA study materials
CGIA study resources

CGIA: Internal Audit Fundamentals, IIA Standards, and the IPPF

CGIA · Work through your exam, one topic at a time.

All guide sections

Internal Audit Fundamentals, IIA Standards, and the IPPF

This domain tests whether you can define internal auditing precisely, place any task inside the IPPF architecture, and separate mandatory from advisory content. Expect definitional items plus scenarios contrasting assurance with consulting.

Core rules

  • The IIA definition: internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps the organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
  • Mandatory IPPF elements: the Mission, Core Principles, the Definition, the Code of Ethics and the Standards. Implementation Guidance and Supplemental Guidance are not mandatory.
  • Attribute Standards (1000–1300) cover purpose, authority and responsibility, independence and objectivity, proficiency and due professional care, and the quality program. Performance Standards (2000–2600) cover managing the activity, nature of work, engagement planning, performing the engagement, communicating results, monitoring progress, and risk acceptance.
  • "Must" clauses are unconditional; "should" clauses presume conformance unless a documented alternative achieves the same objective.
  • The 2024 Global Internal Audit Standards became the core of the IPPF, effective 9 January 2025, keeping a five-domain, 15-principle structure alongside Topical Requirements and Global Guidance.

Worked example

An operations director asks the CAE to write management's corrective action plan and then confirm it is complete. Helping management evaluate control options is legitimate consulting; writing the plan assumes management responsibility, and the later confirmation is assurance that must be performed independently. Correct handling: advise, do not own; management drafts and owns the plan; internal audit validates implementation during follow-up.

Traps

Equating consulting with any contact with management; treating Implementation Guidance as binding; and claiming conformance while a known nonconformance remains open.