Institute of Internal Auditors

In 2019, the IIA announced plans to change its Certification in Risk Management Assurance (CRMA) program.[9] The CRMA changes went into effect on October 2020, and include a new exam, updated prerequisites and experience requirements.[9]

• Certification in Risk Management Assurance (CRMA)
• Qualification in Internal Audit Leadership (QIAL)
• Internal Audit Practitioner (IAP)
• Certification in Control Self Assessment (CCSA)
• Certified Government Auditing Professional (CGAP), for Government performance auditing and Government Auditors
• Certified Financial Services Auditor (CFSA)

As of December 31, 2018, the CCSA, CFSA, and CGAP are no longer accepting new applications, and the three designations will be re-positioned into assessment-based certifications in the future.[10]

Below demonstrates the Number of CIA Holders by Region as of December 31, 2021.[11]

The definition of internal auditing and the code of ethics[12] and the Standards[13] are mandatory for IIA members and internal audit organizations claiming to complete audits to IIA technical standards around the world. The guidelines and recommendations are recorded in what is referred to as the "Red Book."

• The definition: Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.
• The four principles of the IIA's Code of Ethics are integrity, objectivity, confidentiality and competency.
• The international standards for the professional practice of internal auditing:

Position papers, practice advisories, and practice guides are Strongly Recommended Guidance that help define and explain the IIA standards.

Additional sources of guidance include a variety of materials that are developed and/or endorsed by the IIA, including research studies, books, seminars, conferences, and other products and services related to the professional practice of internal auditing.

As practice guides, 8 PGs, 15 GTAG (Global Technology Audit Guide), and 3 GAITs (Guide to the Assessment of IT Risk) have been issued in 2009 and 2010. GTAGs are written in straightforward business language to address a timely issue related to information technology (IT) management, control, and security. To date, the IIA has released GTAGs on the following topics:

• GTAG 1: Information Technology Controls
• GTAG 2: Change and Patch Management Controls: Critical for Organizational Success
• GTAG 3: Continuous Auditing: Implications for Assurance, Monitoring, and Risk Assessment
• GTAG 4: Management of IT Auditing
• GTAG 5: Managing and Auditing Privacy Risks
• GTAG 6: Managing and Auditing IT Vulnerabilities
• GTAG 7: Information Technology Outsourcing
• GTAG 8: Auditing Application Controls
• GTAG 9: Identity and Access Management
• GTAG 10: Business Continuity Management (BCM)
• GTAG-11: Developing the IT Audit Plan
• GTAG-12: Auditing IT Projects (Mar. 2009)
• GTAG-13: Fraud Prevention and Detection in an Automated World (December 2009)
• GTAG-14: Auditing User-developed Applications (June 2010)
• GTAG-15: Information Security Governance (June 2010)
• GTAG-16: Data Analysis Technology (August 2011)
• GTAG-17: Auditing IT Governance (July 2012)
• Auditing Smart Devices: An Internal Auditor’s Guide to Understanding and Auditing Smart Devices (August 2016)
• Assessing Cybersecurity Risk: Roles of the Three Lines of Defense (September 2016)
• Understanding and Auditing Big Data (May 2017)
• Auditing Insider Threat Programs (August 2018)

The IIA offers 31 General practice guides, 4 Financial Services guides, 4 Public Sector guides, 18 Global Technology Audit Guides (GTAG), 3 Guides to the Assessment of IT Risk (GAIT), and 2 guides for supplemental guidance.[14]

The Internal Audit Foundation[15] is a not-for profit organization that promotes and advances the value of the internal audit profession globally. It supports research, grants and awards, and promotes internal auditing study at post-secondary institutions worldwide. The 2020 Annual Report of the Foundation included white papers on auditing during the COVID pandemic.[16]

In December 2019, the IIA announced the results from its inaugural American Corporate Governance Index (ACGI).[17] The ACGI is a joint project of the IIA and the Neel Corporate Governance Center at the University of Tennessee, and grades companies on eight Guiding Principles of Corporate Governance.[18] The principles were compiled from guidance and principles from organizations like the Business Roundtable, National Association of Corporate Directors, and New York Stock Exchange. Scores were based on the survey responses of 128 chief audit executives.[17][19] The criteria included: board performance, external disclosures, companywide communication, corporate culture, and long-term strategies.[20] The first report graded U.S. publicly listed companies overall with a C+.[17][18]