Under the IIA's Global Internal Audit Standards (2024), Domain III, Governing the Internal Audit Function, establishes how internal audit is authorized, positioned, and overseen. A central idea is the internal audit mandate (Standard 6.1). The mandate sets out the function's authority, role, and responsibilities. It may come from laws or regulations, or from the board. The mandate defines the scope of assurance and advisory services, and it is documented in the internal audit charter (Standard 6.2). The charter covers purpose, commitment to the Standards, reporting relationships, unrestricted access to records, personnel, and property, and the nature and scope of services. Each standard in this domain includes 'Essential Conditions', which describe how the board and senior management must support internal audit, alongside the CAE's own requirements. Board responsibilities include: (1) discussing with the CAE and senior management the appropriate authority, role, and responsibilities of internal audit; (2) approving the charter and reviewing it periodically; (3) championing the function and supporting unrestricted access; (4) establishing direct reporting to the board so the function stays independent, and approving decisions on the CAE's appointment, removal, and compensation; (5) approving the internal audit plan, budget, and resources; and (6) overseeing the Quality Assurance and Improvement Program, including external quality assessments at least once every five years. CAE responsibilities include: (1) helping the board understand internal audit's mandate and proposing the charter; (2) documenting the mandate and keeping the charter current; (3) maintaining direct, unrestricted communication with the board; (4) confirming organizational independence at least annually and disclosing any impairments; (5) reporting on plan performance and conformance with the Standards; and (6) managing resources and quality. For the CIA Challenge Exam, remember the distinction: the board authorizes, supports, and oversees internal audit, while the CAE proposes, implements, communicates, and reports. Together, these roles let internal audit deliver objective, credible assurance that strengthens governance and adds organizational value.

In the IIA's International Professional Practices Framework, independence is freedom from conditions that threaten the internal audit activity's ability to carry out its responsibilities in an unbiased manner. Objectivity is the individual auditor's unbiased mental attitude. An impairment is any situation that compromises either one, whether it is real or only appears so. Standard 1130 (and Standard 2.3 and Principle 7 in the 2024 Global Internal Audit Standards) requires that impairments be disclosed to appropriate parties.

Impairments at the organizational level include: 1) scope limitations, where management restricts which areas may be audited; 2) restricted access to records, personnel, or properties; 3) resource or budget constraints imposed to limit audit coverage; and 4) a reporting line in which the chief audit executive (CAE) reports functionally to management rather than to the board. Another impairment arises when the CAE holds roles beyond internal auditing, such as compliance or risk management, without safeguards.

Impairments at the individual level involve personal conflicts of interest, such as family ties, financial interests, or close relationships with auditees. They also include self-review threats, which arise when an auditor assesses work they performed or designed. Accepting gifts or favors, bias, and undue influence also impair objectivity. Exam rule: objectivity is presumed impaired if an auditor provides assurance on an activity they were responsible for within the previous year. Auditors may still provide consulting services on such operations, provided impairments are disclosed before the engagement is accepted.

Responses: the CAE must disclose the nature of the impairment. Disclosure goes to the board and senior management, depending on its nature. If the impairment is discovered after the report is issued, its effect must be communicated. Safeguards include reassigning staff, independent oversight, and rotating auditors. CAE assurance over functions the CAE manages must be overseen by a party outside the internal audit activity. Annual confirmation of organizational independence to the board, along with Quality Assurance and Improvement Program reviews, help detect and remediate impairments. These reviews also preserve conformance and stakeholder trust.

Internal audit's role in risk management centers on providing independent, objective assurance and advice on whether an organization's governance, risk management, and control processes are effective. Under the IIA's Global Internal Audit Standards, the internal audit function evaluates and helps improve these processes. Management, however, owns and manages risk. The IIA Three Lines Model (updated in 2020) clarifies these responsibilities. The governing body (the board) is accountable to stakeholders for oversight. It sets direction, approves risk appetite, and ensures that appropriate structures exist. Management holds first line roles, which involve delivering products and services and owning and managing risks and controls directly. Management also holds second line roles, which provide expertise, support, monitoring, and challenge on risk-related matters. Examples include risk management, compliance, and information security functions. Internal audit holds the third line role. It provides independent assurance and advice to the board and senior management. Its independence comes from accountability to the governing body, typically through a functional reporting line to the audit committee. External assurance providers add further assurance. The model is principles-based, not rigid. It emphasizes collaboration, communication, and alignment among all roles in creating and protecting value. The IIA's guidance on enterprise risk management distinguishes three categories of internal audit involvement. Core assurance roles include evaluating risk management processes and confirming that key risks are reported and managed correctly. Legitimate consulting roles, which require safeguards, include facilitating risk workshops, coaching management, and coordinating risk reporting. Prohibited roles include setting risk appetite, imposing risk processes, making risk response decisions, implementing controls, and taking accountability for risk management. When internal audit performs consulting roles, it must avoid assuming management responsibility. It must disclose any impairments to independence or objectivity and obtain board oversight. For CIA candidates, the key principle is this: internal audit evaluates and advises but never owns risk. Preserving independence and objectivity is essential to professionalism and quality, as reinforced by the Quality Assurance and Improvement Program.

Individual objectivity is an unbiased mental attitude that lets internal auditors make professional judgments, reach conclusions, and report results without compromising quality or subordinating their judgment to others. Under the IIA's IPPF (Standards 1120 and 1130, now reflected in Principle 2 of the Global Internal Audit Standards), auditors must avoid conflicts of interest and must disclose any impairment, whether real or only apparent. An impairment exists when circumstances could cause a reasonable observer to doubt the auditor's impartiality. Common sources include: (1) Self-review threat, where an auditor assesses specific operations they were responsible for within the previous year. The Standards presume objectivity is impaired in this case. (2) Conflicts of interest, such as financial stakes, family members working in the audited area, or close personal relationships with auditees. (3) Familiarity threat, from long-term assignment to the same area, which can lead to complacency or excessive trust. (4) Undue influence or intimidation, where management pressure, threats, or concern for future job opportunities sway conclusions. (5) Gifts, entertainment, or other benefits from auditees, beyond nominal items. (6) Prior or anticipated employment in the audited activity. (7) Cognitive biases, such as confirmation bias or overreliance on management representations. For consulting engagements, auditors may provide services related to operations they previously held responsibility for. If potential impairments exist, they must be disclosed to the client before accepting the engagement. Assurance engagements over functions the chief audit executive (CAE) manages must be overseen by someone outside internal audit. When an impairment is identified, the auditor must disclose it promptly to the CAE. The CAE then applies safeguards, such as reassigning staff, increasing supervisory review, rotating assignments, or excluding the individual. The nature of the disclosure depends on the impairment and may extend to senior management and the board. If an impairment is discovered after results are communicated, the CAE must communicate it and assess its effect. CIA candidates should be able to recognize these scenarios, distinguish individual objectivity from organizational independence, and select the appropriate disclosure or safeguard response.

Confidentiality is a core ethical principle for internal auditors. It was traditionally one of the four principles of the IIA Code of Ethics, alongside integrity, objectivity, and competency, and it is now Principle 5 of the Global Internal Audit Standards (Ethics and Professionalism domain). For the CIA Challenge Exam, candidates should understand both what confidentiality requires and how it supports trust and audit quality. Internal auditors routinely access sensitive records, personnel data, strategic plans, and proprietary information. Stakeholders give this access because they trust that auditors will respect the value and ownership of the information and will not disclose it without appropriate authority unless there is a legal or professional obligation to do so. The principle has two main components. The first is appropriate use of information (Standard 5.1). Auditors must use information only for legitimate audit purposes. They must not use it for personal gain, in any manner contrary to law, or in ways that harm the legitimate and ethical objectives of the organization. Examples of violations include trading shares based on insider knowledge gained during an engagement or sharing findings with unauthorized parties. The second is protection of information (Standard 5.2). Auditors must be prudent in safeguarding information, following organizational policies, laws, and regulations on data privacy, retention, and disclosure. The chief audit executive should establish methodologies for access, storage, and release of engagement records, including requirements for approval before releasing information to external parties. Auditors must also respect confidentiality after leaving an engagement or the organization. Confidentiality is not absolute. Auditors may need to disclose information when required by law, regulation, or professional standards, such as reporting illegal acts to regulators or audit committees, but they should seek guidance from legal counsel and senior management or the board. Breaching confidentiality damages credibility, independence, and the internal audit function's reputation, so exam questions often test ethical judgment about when, how, and to whom information may be disclosed.

A Quality Assurance and Improvement Program (QAIP) is the system the chief audit executive (CAE) develops and maintains to evaluate and improve every aspect of the internal audit activity. Under the IIA framework it was historically Standard 1300. In the 2024 Global Internal Audit Standards it falls mainly under Standard 8.3 (Quality), Standard 8.4 (External Quality Assessment) and Standard 12.1 (Internal Quality Assessment). For the CIA Challenge Exam, candidates should know its purpose, components, reporting requirements and conformance implications.

The QAIP has three purposes. It evaluates the internal audit function's conformance with the Standards. It assesses whether internal auditors apply the Code of Ethics or ethics principles. It also measures the efficiency and effectiveness of the function and identifies opportunities for improvement. The board's support of the QAIP is essential.

The program has two broad components. Internal assessments include ongoing monitoring, such as engagement supervision, workpaper review, checklists, performance metrics and stakeholder feedback. They also include periodic self-assessments, or assessments by other qualified people in the organization who know internal audit practices.

External assessments must be performed at least once every five years by a qualified, independent assessor or assessment team from outside the organization. They may take the form of a full external assessment or a self-assessment with independent external validation. The CAE discusses the form, frequency, and the qualifications and independence of the assessor with the board. The 2024 Standards add that at least one assessor should hold an active CIA designation.

The CAE must communicate QAIP results to senior management and the board. These results include the scope and frequency of assessments, assessor qualifications, conclusions, and corrective action plans.

The internal audit activity may state that it conforms with the Standards only when the QAIP results support that claim. If nonconformance affects the overall scope or operation of the activity, the CAE must disclose the nonconformance and its impact.

Ultimately, the QAIP builds credibility, supports continuous improvement and reinforces professionalism across the internal audit function.

Disclosing nonconformance is a core part of internal audit professionalism and quality assurance in the IIA's International Professional Practices Framework (IPPF). Internal auditors are expected to conform with the Code of Ethics and the Standards. When they cannot, transparency is required rather than concealment.

Under the 2017 Standards, two levels of disclosure apply.

First, Standard 1322 (Disclosure of Nonconformance) covers the internal audit activity as a whole. When nonconformance affects the overall scope or operation of the activity, the chief audit executive (CAE) must disclose the nonconformance and its impact to senior management and the board. Examples include a lack of independence caused by reporting lines, insufficient resources, or failure to obtain a required external quality assessment at least once every five years.

Second, Standard 2431 (Engagement Disclosure of Nonconformance) covers individual engagements. When nonconformance affects a specific engagement, the communication of results must disclose:
- the principle, rule of conduct, or standard not fully met;
- the reasons for the nonconformance;
- the impact on the engagement and its communicated results.

This links to Standard 1321, which allows internal audit to state that it "conforms with the International Standards" only when the results of the Quality Assurance and Improvement Program (QAIP) support that claim. Internal and external assessments identify gaps, and the CAE reports these results to senior management and the board.

The 2024 Global Internal Audit Standards keep the same expectations. They require the CAE to disclose nonconformance, its reasons, and its effects to the board and senior management. They also require engagement communications to disclose any nonconformance that affects engagement results.

Key exam points:
- Disclosure is mandatory, not optional.
- The CAE is responsible for it.
- Disclosure goes to senior management and the board.
- The board, together with management, decides how to resolve or accept the issue.

Disclosure preserves stakeholder trust and allows informed reliance on audit work. It also supports continuous improvement of the internal audit activity.

Internal audit key performance indicators (KPIs) and scorecard metrics are tools the chief audit executive (CAE) uses to show that the internal audit activity is effective, efficient and adds value. They connect directly to professionalism and quality. Under the IIA Global Internal Audit Standards (Standard 12.2, Performance Measurement), the CAE must develop an objective-based performance measurement methodology, and the results support the Quality Assurance and Improvement Program (QAIP), with ongoing monitoring and periodic self-assessments. A balanced scorecard groups metrics into perspectives so that performance is not judged on cost or speed alone. 1) Stakeholder or board perspective: satisfaction survey scores from the audit committee and management, alignment of audits with key risks, and the percentage of significant risks covered. 2) Internal process perspective: audit plan completion rate, average cycle time from fieldwork to final report, days to issue reports, budget versus actual hours, and conformance with the Standards. 3) Innovation and capabilities perspective: professional certifications such as the CIA, CPE hours completed, use of data analytics, staff turnover, and training against competency gaps. 4) Value or results perspective: the rate at which recommendations are implemented, repeat findings, cost savings identified, and a reduction in control deficiencies. Good metrics are SMART: specific, measurable, achievable, relevant and time-bound. A sound scorecard balances quantitative and qualitative measures. It also balances lagging indicators, such as plan completion, with leading indicators, such as staff competency development. Results are reported to senior management and the board, usually on a regular basis together with QAIP results. Exam tips: activity-based metrics alone, such as the number of audits completed, are weak indicators of value. Stakeholder feedback and the implementation of recommendations show real impact. Overemphasizing efficiency can harm audit quality and objectivity. KPIs should be agreed with the board and support the internal audit strategy. They help the CAE find areas to improve, justify resources, and show that the internal audit activity conforms with the Standards and achieves its mandate.