Professional Practices Framework and Standards
This domain tests whether you can navigate the International Professional Practices Framework (IPPF) and distinguish mandatory requirements from recommended guidance, then apply the Global Internal Audit Standards (GIAS) to real engagement decisions.
Core rules and concepts
- The IPPF's mandatory elements are the Global Internal Audit Standards and the Code of Ethics. Global Guidance, including topical and sector guides, is recommended and does not create conformance obligations.
- The GIAS is organized into five domains covering purpose, ethics, governing the function, managing the function, and performing services. Principles state the intent; standards state requirements using "must."
- A function conforms only when it meets all applicable principles and standards. There is no valid claim of partial conformance. Nonconformance must be disclosed to the board and senior management.
- Applicability matters: a one-person audit function still must meet applicable standards; it cannot opt out because it is small.
- The Code applies to individuals and organizations that perform internal audit services, not only to the chief audit executive.
Worked example
A chief audit executive tells the audit committee the function "generally conforms with the IPPF" but has not completed an external quality assessment and has not reported two known standard deviations. The correct conclusion is that general conformance cannot be claimed. The CAE must disclose the nonconformance, explain its effect, and present a remediation plan. Citing a practice guide as the source of a mandatory requirement is also wrong because guidance is not mandatory.
Traps that cost marks
Treating implementation guides as requirements; quoting superseded standards; assuming standards are a fieldwork checklist rather than outcome requirements; and overlooking the Code's application to every internal auditor.