Stating Conformance with the Global Internal Audit Standards: A Complete CIA Part 3 Guide
Overview
When an internal audit function or an individual engagement claims it was conducted in conformance with the Global Internal Audit Standards, it is making a public promise of quality. The Institute of Internal Auditors (IIA) allows this claim only when evidence supports it. When conformance is not achieved, the IIA requires the shortfall to be disclosed. This topic sits in CIA Part 3 under Engagement Results and Monitoring. It is tested through scenarios that ask whether a conformance statement is permitted and what must be disclosed when it is not.
1. Why It Is Important
Credibility and trust: The board, senior management, regulators and external auditors rely on internal audit work. A conformance statement tells them the work followed a globally recognized framework.
Protection against misrepresentation: An unsupported statement is misleading. It breaches the ethical principles of Integrity (honesty and professional courage) and Due Professional Care.
Transparency: Disclosing nonconformance lets stakeholders judge how much to rely on the results. Hiding it would undermine the whole profession.
Link to quality: The right to claim conformance is earned through the Quality Assurance and Improvement Program (QAIP). This connects engagement reporting to ongoing monitoring, internal assessments and external assessments.
Reliance by others: External auditors and regulators may place reliance on internal audit work only if it conforms. A false or missing statement affects their decisions.
2. What It Is
Under the Global Internal Audit Standards (effective 9 January 2025), the relevant requirements appear mainly in four places:
- Domain II, Principle 4 (Exhibit Professionalism), Standard 4.1 Conformance with the Global Internal Audit Standards: internal auditors must plan and perform internal audit services in conformance with the Standards.
- Domain IV, Standard 8.3 Quality and Standard 8.4 External Quality Assessment: these cover board oversight of quality.
- Domain IV, Standard 12.1 Internal Quality Assessment.
- Domain V, Standard 15.1 Final Engagement Communication.
The key concepts are:
- Conformance statement: a statement in engagement communications or reports to the board that internal audit services were conducted in conformance with the Standards.
- Basis for the statement: it is appropriate only if the results of the QAIP support it. That support includes:
- ongoing monitoring;
- periodic internal assessments;
- an external quality assessment performed at least once every five years by a qualified, independent assessor or assessment team.
- Nonconformance disclosure: when nonconformance affects an engagement, the final engagement communication must disclose three things:
(a) the requirement(s) not conformed with;
(b) the reason(s) for nonconformance;
(c) the impact of the nonconformance on the engagement and its findings and conclusions.
- Function-level nonconformance: the Chief Audit Executive (CAE) must communicate significant nonconformance, and its impact, to the board and senior management. This is often reported alongside QAIP results.
- Laws and regulations: if a law or regulation prevents conformance with part of the Standards, internal auditors must follow the law. They must still conform with all other requirements and disclose the departure appropriately.
- Use with other standards: internal auditors may cite conformance with the Standards alongside other frameworks, such as government auditing standards, if they conform with both.
3. How It Works
Step 1: Build the evidence through the QAIP. The CAE maintains a QAIP that covers all aspects of the function. Ongoing monitoring includes supervision, review of workpapers and engagement metrics. Periodic internal assessments test conformance with the Standards. External assessments are performed at least every five years. The CAE discusses the external assessment approach and the assessor's qualifications with the board.
Step 2: Evaluate the results. If assessments conclude that the function generally conforms, the CAE may state conformance. If there is no evidence, the statement cannot be used. Examples include a first external assessment never performed, or one that is more than five years old.
Step 3: Apply the statement at engagement level. An individual engagement report may include the conformance statement only if the function's QAIP supports it and nothing in that engagement departed from the Standards.
Step 4: Identify engagement-specific nonconformance. Typical examples are:
- an independence impairment that was not managed;
- insufficient evidence caused by a scope limitation;
- auditors lacking the required competency;
- a skipped supervisory review.
Step 5: Disclose. The final engagement communication states the requirement not met, why it happened, and how it affected the results.
Step 6: Report upward and remediate. The CAE reports significant nonconformance and QAIP results to the board and senior management. Action plans to restore conformance follow, and progress is monitored.
Illustrative scenario: Partway through an engagement, an auditor discovers he previously managed the area under review within the last year. The CAE does not reassign the work. The report cannot simply state conformance. It must disclose the objectivity requirement that was breached, the reason, and the possible impact on the reliability of the conclusions.
4. How to Answer Exam Questions on This Topic
Questions usually follow a few patterns:
(1) When may internal audit state conformance? The answer is: only when supported by QAIP results, including internal and external assessments.
(2) What happens if no external assessment has been done in five years? The function cannot claim conformance. The gap is a nonconformance to be reported to the board.
(3) What must be disclosed for engagement nonconformance? The requirement, the reason and the impact.
(4) Who receives the communication? Engagement-level disclosure goes in the final engagement communication to its recipients. Significant function-level nonconformance goes to the board and senior management.
(5) Law versus Standards conflict? Follow the law, conform with the rest of the Standards, and disclose.
Exam Tips: Answering Questions on Stating Conformance with the Global Internal Audit Standards
- Remember the phrase "only if supported by the QAIP." Any option suggesting conformance can be claimed on management's assurance, the CAE's opinion alone, or good intentions is wrong.
- Know the trio for nonconformance disclosure: What requirement, Why, and Impact. Watch for distractors such as "the name of the responsible auditor" or "disciplinary actions taken."
- Five-year rule: the external assessment is required at least once every five years. Ongoing monitoring and internal assessments alone are not enough to claim full conformance.
- Disclosure beats omission: if a choice involves silently dropping the conformance statement without explanation, prefer the option that discloses the nonconformance and its impact.
- Don't over-punish: nonconformance does not automatically mean the report should be withheld or the engagement cancelled. The usual correct answer is disclose and communicate.
- Distinguish levels: engagement-level disclosure goes in the final engagement communication. Function-wide or significant nonconformance is reported by the CAE to the board and senior management.
- Legal conflicts: the law prevails. The best answer still keeps conformance with the remaining requirements and includes disclosure.
- Use the right terms: the Standards use "conformance" (with IIA Standards) and "compliance" (with laws and policies). Do not let the wording confuse you.
- Link to ethics: claiming conformance falsely violates Integrity. If an option frames the issue ethically, it may be the best choice.
- Read for the 'most appropriate' action: CIA questions often have several partially correct options. Choose the one that is evidence-based, transparent, and communicated to the right parties.
Key Takeaway
A conformance statement is earned, not assumed. It must rest on QAIP evidence, including a recent external assessment. When conformance is not achieved, internal auditors must say so clearly: which requirement was not met, why, and what effect it had. This protects the credibility of internal audit and the trust of those who rely on it.
