Integrity and Professional Courage are foundational principles in the ethics framework governing internal auditors, as emphasized in the CIA Part 1 examination. Integrity is the cornerstone of the internal audit profession and is explicitly recognized in The IIA's Code of Ethics. It requires internal auditors to perform their work with honesty, diligence, and responsibility. Auditors must observe the law and make disclosures expected by law and the profession. They must not knowingly be a party to any illegal activity or engage in acts that discredit the internal audit profession or the organization. Integrity establishes trust and provides the basis for reliance on the auditor's judgment. Because internal auditors often examine sensitive information and report findings that may be unwelcome, their credibility depends entirely on their reputation for honesty and truthfulness. Professional Courage is closely linked to integrity and is essential for effective auditing. It refers to the auditor's willingness to raise difficult issues, report unfavorable findings, and stand firm on conclusions despite pressure from management or other stakeholders. Internal auditors frequently encounter situations where they must communicate uncomfortable truths, challenge established practices, or resist attempts to suppress or alter findings. Professional courage enables auditors to maintain objectivity and uphold the truth even when facing resistance, intimidation, or potential career consequences. Together, integrity and professional courage ensure that internal auditors act in the best interest of the organization and its stakeholders rather than succumbing to personal or political pressures. These qualities support the auditor's ability to add value, provide assurance, and protect the organization's assets and reputation. Without integrity, audit conclusions lack credibility; without courage, auditors may fail to disclose critical issues. The IIA's Standards and Code of Ethics reinforce these principles, requiring auditors to demonstrate both consistently. Ultimately, they safeguard the independence, objectivity, and effectiveness essential to the internal audit function's success and legitimacy.

Legal and ethical behavior expectations are foundational to the internal audit profession and are governed by The IIA's Code of Ethics. Internal auditors must uphold both legal requirements and ethical standards, recognizing that ethical conduct often exceeds mere legal compliance. The IIA Code of Ethics is built upon four core principles: Integrity, Objectivity, Confidentiality, and Competency. Integrity requires auditors to perform work honestly, diligently, and responsibly, while observing the law and making required disclosures. Auditors must not knowingly engage in illegal acts or activities that discredit the profession. Objectivity demands that auditors exhibit the highest level of professional impartiality, avoiding conflicts of interest and refraining from accepting anything that may impair their judgment. They must disclose all material facts that could distort reporting. Confidentiality obligates auditors to protect and prudently use information acquired during their duties, never disclosing it for personal gain or in ways contrary to law or organizational detriment. Competency requires auditors to apply the knowledge, skills, and experience necessary, engage only in services they are qualified to perform, and continually improve their proficiency. Beyond the Code of Ethics, internal auditors operate within a legal framework that includes laws, regulations, and corporate governance requirements relevant to their organization and industry. They must understand relevant legislation such as fraud statutes, data protection laws, and financial reporting regulations. Ethical expectations also include organizational codes of conduct and whistleblower protections. When auditors identify legal or ethical violations, they are expected to report them through appropriate channels. Failure to meet these expectations can result in disciplinary action, loss of certification, and damage to professional reputation. Ultimately, adherence to legal and ethical standards enhances trust, credibility, and the value internal auditors provide, supporting sound governance, risk management, and control processes throughout the organization while protecting stakeholder interests and the public good responsibly always.

Individual objectivity is a fundamental principle in internal auditing that requires each internal auditor to maintain an impartial, unbiased mental attitude when performing engagements. According to the International Professional Practices Framework (IPPF), objectivity means that internal auditors do not subordinate their judgment on audit matters to others and avoid conflicts of interest that could impair their professional decision-making. At the individual level, objectivity is about the auditor's state of mind and the ability to make balanced assessments of all relevant circumstances without being unduly influenced by their own interests or the interests of others. To preserve individual objectivity, internal auditors should not audit operations for which they were recently responsible, typically within the past year, as this could create a self-review threat. Additionally, auditors should not accept assignments where they have personal relationships, financial interests, or biases that could compromise their neutrality. If objectivity is impaired in fact or appearance, the auditor must disclose the details of the impairment to appropriate parties, such as the Chief Audit Executive or the board. The Code of Ethics under the IPPF explicitly addresses objectivity, requiring auditors to exhibit the highest level of professional objectivity in gathering, evaluating, and communicating information. Auditors must make a balanced assessment of all relevant circumstances and not be unduly influenced by their own interests or by others in forming judgments. They should refrain from accepting anything, such as gifts or favors, that may impair or be presumed to impair their professional judgment. They must also disclose all material facts known that, if not disclosed, may distort the reporting of activities under review. Maintaining individual objectivity ensures the credibility, reliability, and value of the internal audit function, allowing stakeholders to trust the audit findings and conclusions as fair, accurate, and free from personal bias or external manipulation.

Impairments to objectivity occur when an internal auditor's ability to make impartial, unbiased judgments is compromised. Objectivity is a fundamental principle in the IIA's Code of Ethics and International Standards, requiring auditors to maintain an unbiased mental attitude and avoid conflicts of interest. Several conditions can impair objectivity: personal relationships, financial interests, self-review situations, familiarity threats, and management pressure. A common impairment is the self-review threat, which arises when auditors assess work they previously performed or systems they helped design. To address this, the Standards state that auditors should not assess specific operations for which they were previously responsible; objectivity is presumed impaired if an auditor provides assurance services for activities they oversaw within the preceding year. Scope limitations imposed by management, resource restrictions, or restricted access to records and personnel can also impair both individual objectivity and organizational independence. When impairments occur, disclosure is mandatory. According to IIA Standards, if independence or objectivity is impaired in fact or appearance, the details of the impairment must be disclosed to appropriate parties. The nature of the disclosure depends on the impairment. For individual auditors, impairments should be reported to the chief audit executive (CAE), who then reassigns the engagement or takes corrective action. If the CAE's objectivity is impaired, disclosure should be made to the board or senior management. When impairments affect an entire engagement's ability to meet objectives, disclosure to the engagement's stakeholders is required in the final communication or report. Proper documentation of impairments and their resolution supports transparency and accountability. Managing impairments protects the credibility and value of the internal audit function. By proactively identifying, avoiding, and disclosing impairments, auditors uphold professional standards, maintain stakeholder trust, and ensure that audit conclusions remain reliable, credible, and free from undue influence or bias.

Conflicts of interest, gifts, and favors are critical concepts in the IIA Code of Ethics that internal auditors must understand to maintain objectivity and integrity. A conflict of interest occurs when an internal auditor has a competing professional or personal interest that could impair their ability to perform duties impartially. Even the appearance of a conflict can undermine confidence in the auditor, the internal audit activity, and the profession. The IIA's Objectivity principle requires auditors to disclose all material facts and avoid situations where personal interests could compromise their unbiased assessment. For example, an auditor should not audit a department where a close relative works or where they previously held a management position, as this creates a self-review or familiarity threat. Regarding gifts and favors, the IIA Code of Ethics explicitly addresses this under the Objectivity principle, stating that internal auditors 'shall not accept anything that may impair or be presumed to impair their professional judgment.' Accepting gifts, entertainment, or favors from clients, vendors, or auditees can create actual or perceived bias, potentially influencing audit findings and conclusions. Even nominal gifts must be evaluated carefully because they may create a sense of obligation or reciprocity. Best practices include establishing organizational policies that define acceptable limits, requiring disclosure of any gifts received, and generally declining items of significant value. When conflicts arise, auditors should disclose them promptly to appropriate parties, such as the Chief Audit Executive, and may need to recuse themselves from specific engagements. The overarching goal is to protect the independence of the internal audit function and the objectivity of individual auditors. Maintaining these standards preserves stakeholder trust, ensures credible audit results, and upholds the professional reputation of internal auditing. Ultimately, transparency, disclosure, and avoidance of compromising situations are the foundations for managing conflicts of interest, gifts, and favors ethically.

Competency requirements for internal auditors are foundational to maintaining professionalism and delivering effective assurance and consulting services. According to the IIA's International Professional Practices Framework (IPPF), internal auditors must possess the knowledge, skills, and other competencies needed to perform their individual responsibilities. This principle is embedded in the Attribute Standards, particularly Standard 1210 on Proficiency. Proficiency means internal auditors collectively must have the competencies necessary to carry out engagements. If the internal audit activity lacks certain skills, the Chief Audit Executive (CAE) must obtain competent advice and assistance from external sources or qualified experts. Key competency areas include understanding auditing standards, procedures, and techniques; knowledge of accounting principles; and awareness of management principles and business risks. Auditors must also be proficient in evaluating fraud risk, though they are not expected to have the expertise of a fraud investigation specialist. Additionally, they should understand information technology risks, controls, and available technology-based audit techniques. The IIA's Ethics component reinforces competency through the Code of Ethics, specifically the principle of Competency. This requires internal auditors to engage only in services for which they have the necessary knowledge, skills, and experience; to perform services in accordance with the International Standards; and to continually improve their proficiency, effectiveness, and quality of services. Continuing professional development (Standard 1230) is essential, requiring auditors to enhance their knowledge through ongoing education, professional certifications like the CIA, and staying current with industry developments. Due professional care (Standard 1220) complements competency, requiring auditors to apply the care and skill expected of a reasonably prudent and competent internal auditor. Together, these competency requirements ensure that internal auditors provide credible, objective, and value-adding services while upholding the profession's integrity, ultimately strengthening organizational governance, risk management, and control processes through skilled and ethical professional conduct.

Continuing Professional Development (CPD), sometimes called Continuing Professional Education (CPE), is a fundamental requirement for internal auditors under the IIA's International Professional Practices Framework (IPPF). Standard 1230 explicitly states that internal auditors must enhance their knowledge, skills, and other competencies through continuing professional development. This ensures auditors remain proficient and capable of performing their responsibilities effectively in a constantly evolving business, regulatory, and technological environment. For Certified Internal Auditors (CIAs), CPD is not optional but a mandatory condition for maintaining certification. The IIA requires practicing CIAs to complete 40 CPE hours annually, while non-practicing CIAs must complete 20 hours. Of these, at least two hours must relate to ethics each year, reinforcing the profession's commitment to integrity and professionalism. CPD activities can take many forms, including attending seminars, conferences, and workshops; completing formal coursework; participating in webinars or e-learning; self-study programs; teaching or presenting; and publishing professional articles. These activities help auditors stay current on emerging risks, new auditing techniques, changes in standards, regulatory developments, and industry-specific issues. From an ethics and professionalism perspective, CPD directly supports the IIA Code of Ethics principle of Competency, which obligates auditors to engage only in services for which they have the necessary knowledge, skills, and experience, and to continually improve their proficiency and effectiveness. Failing to maintain adequate CPD can result in the suspension or revocation of certification, and may compromise audit quality and stakeholder trust. Auditors are responsible for tracking and documenting their CPD hours and must be prepared to report them to the IIA, which may conduct audits of compliance. Ultimately, CPD reflects the internal audit profession's dedication to lifelong learning, ensuring auditors provide value-added, objective assurance and consulting services. It safeguards professional credibility, promotes ethical conduct, and helps auditors adapt to organizational and global changes effectively over time.

Due Professional Care is a fundamental principle in the Internal Auditing profession, embedded within the IIA's Code of Ethics and the International Standards for the Professional Practice of Internal Auditing. It requires internal auditors to apply the care, competence, and diligence that a reasonably prudent and competent internal auditor would exercise under similar circumstances. Importantly, due professional care does not imply infallibility or perfection; auditors are not expected to detect every irregularity or fraud, but they must perform their work conscientiously and with reasonable judgment. According to IIA Standard 1220, internal auditors must consider several factors when exercising due professional care. These include: the extent of work needed to achieve the engagement's objectives; the relative complexity, materiality, or significance of matters under review; the adequacy and effectiveness of governance, risk management, and control processes; the probability of significant errors, fraud, or noncompliance; and the cost of assurance in relation to potential benefits. Due professional care also extends to the use of technology-based audit techniques and data analysis tools where appropriate, reflecting the evolving nature of the profession. Auditors must remain alert to significant risks that could affect objectives, operations, or resources. However, assurance procedures alone, even when performed with due care, do not guarantee that all significant risks will be identified. Under the Ethics and Professionalism domain, due professional care links closely with the principles of Competency and Integrity. Auditors must engage only in services for which they have the necessary knowledge, skills, and experience, and must continually improve their proficiency through professional development. By exercising due professional care, internal auditors enhance the reliability and credibility of their work, protect stakeholders' interests, and uphold the reputation of the profession. Ultimately, this principle balances thoroughness with practicality, ensuring audits are conducted responsibly, ethically, and effectively while acknowledging inherent limitations.

Professional skepticism is a fundamental mindset that internal auditors must maintain throughout their engagements. It involves an attitude that includes a questioning mind, being alert to conditions that may indicate possible errors, fraud, or misstatements, and critically assessing audit evidence rather than accepting information at face value. In the context of the Certified Internal Auditor (CIA) Part 1 examination and the domain of Ethics and Professionalism, professional skepticism is closely tied to the auditor's objectivity and integrity. It requires auditors to neither assume that management is dishonest nor assume unquestioned honesty. Instead, auditors should remain neutral, gather sufficient and appropriate evidence, and evaluate it objectively. Professional skepticism helps mitigate risks such as being overly trusting of client-provided information, relying too heavily on prior experiences with an auditee, or accepting persuasive but insufficient evidence. It encourages auditors to seek corroborating evidence, ask probing questions, and investigate inconsistencies or unusual transactions. This mindset is especially critical when assessing the risk of fraud, as fraudsters often attempt to conceal their actions through deception and manipulation. The International Professional Practices Framework (IPPF) and the IIA's Code of Ethics support professional skepticism by emphasizing principles of integrity, objectivity, competency, and confidentiality. Auditors demonstrating professional skepticism uphold the credibility and value of the internal audit function. Additionally, skepticism must be balanced with professionalism, meaning auditors maintain respectful and constructive relationships with auditees while still challenging assumptions and verifying facts. Exercising due professional care, another key concept, is enhanced by maintaining skepticism because it ensures thoroughness and diligence. Ultimately, professional skepticism protects the organization by improving the likelihood of detecting misstatements, control weaknesses, and fraudulent activity. For CIA candidates, understanding and applying professional skepticism demonstrates their commitment to ethical conduct and their ability to provide reliable, independent, and objective assurance and consulting services that add measurable value to their organizations.

Confidentiality and the proper use of information are fundamental principles within the IIA Code of Ethics, directly supporting the CIA Part 1 focus on Ethics and Professionalism. Internal auditors routinely access sensitive, proprietary, and privileged information during engagements, and they bear a professional duty to protect this data. The Confidentiality principle of the IIA Code of Ethics establishes that internal auditors respect the value and ownership of information they receive and do not disclose it without appropriate authority, unless there is a legal or professional obligation to do so. This builds trust between auditors and the organization, ensuring stakeholders feel secure sharing information. Two key rules of conduct reinforce this principle. First, internal auditors shall be prudent in the use and protection of information acquired in the course of their duties. This means safeguarding data through secure storage, controlled access, and careful communication, preventing accidental or intentional leaks. Second, internal auditors shall not use information for any personal gain or in any manner that would be contrary to the law or detrimental to the legitimate and ethical objectives of the organization. This prohibits activities such as insider trading, misusing confidential findings, or leveraging privileged knowledge for private benefit. The improper use of information can severely damage the auditor's credibility, the internal audit function's reputation, and the organization itself, potentially resulting in legal liability. Auditors must balance confidentiality obligations against legitimate disclosure requirements, such as reporting fraud, complying with regulatory demands, or responding to court subpoenas. Even when disclosure is required, auditors should follow proper channels and seek legal or professional guidance when uncertain. Ultimately, maintaining confidentiality and using information ethically demonstrates integrity, objectivity, and professional competence. These behaviors uphold public and organizational trust in the internal audit profession, aligning individual conduct with the broader ethical framework that governs certified internal auditors worldwide throughout their careers.