Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CIA] CIA1: Mastering the Global Internal Audit Standards (GIAS 2024)
Transcript
- Hey, welcome to VoraPrep Audio. Today we're covering a topic that's huge on the CIA exam. It's even bigger in the real world. We're talking about the new Global Internal Audit Standards. Picture this. You’re the Chief Audit Executive. You walk into the big quarterly meeting. The audit committee chair looks right at you and asks, "Are we fully conformant with the new standards?" You know she's talking about the Global Internal Audit Standards, or GIAS. These became mandatory on January 9th, 2025. A "no" answer in that room isn't just awkward. It's a huge red flag about governance. So understanding this framework isn't just about passing a test. It's about your credibility. So what are these new standards? They were issued by The Institute of Internal Auditors, the IIA. They replace the old framework you might have heard of, the IPPF. The best way to think about the new GIAS structure is to compare it to a legal system. It's a hierarchy. At the very top, you have the five Domains. Think of these like the major branches of law—you know, criminal law, civil law, that kind of thing. They're the big buckets that organize everything. Then, within those domains, you have the 15 Guiding Principles. These are like the fundamental rights in our legal system, things like due process. They are the core requirements for an effective internal audit function. They are not optional. And finally, you have the Standards themselves. These are the specific, mandatory statutes. The detailed rules you have to follow to actually live up to those Guiding Principles. So it flows from broad categories, down to core principles, and then to specific, actionable rules. The heart of the framework is the 15 Guiding Principles. They're sorted into the five Domains. Let's go through each domain now. The first domain is just called the Purpose of Internal Auditing. It's the big-picture mission statement, setting the stage for everything else. Then you get to Domain Two, Ethics and Professionalism. This is all about you, the auditor. It’s your personal code of conduct. It covers five principles. First, Demonstrating Integrity. Second, Maintaining Objectivity. Then, Demonstrating Competency, Exercising Due Professional Care, and finally, Maintaining Confidentiality. Basically, it’s about being the person in the room that everyone can trust to be honest, unbiased, sharp, careful, and discreet. Simple as that. Next up is Domain Three, Governing the Internal Audit Function. This isn't about you personally. It's about the audit department's place in the whole organization. This is huge. The principles here are that the function must be Authorized by the Board, Positioned Independently, and Overseen by the Board. This is where the audit charter lives. It's what makes sure you report to the audit committee, not the CFO you might be auditing. It gives you the authority and the independence to do your job without interference. From there, we go to Domain Four, Managing the Internal Audit Function. If Domain Three is about setting up the department correctly, Domain Four is about running it day-to-day. This is the CAE's world. The principles are to Plan Strategically, Manage Resources, Communicate Effectively, and Enhance Quality. Are you building the right team? Do you have the budget you need? Is your quality assurance program working? That's all Domain Four. And finally, Domain Five, Performing Internal Audit Services. This is the work itself. This is what most people think of when they hear "audit." The principles are to Plan Engagements Effectively, Conduct the Engagement Work, and Communicate Conclusions and Monitor Action Plans. This covers everything. It starts with the initial planning memo. And it goes all the way through to following up six months later, to see if management actually fixed the problem. Now, there's one more piece you need to know about: Topical Requirements. These are also mandatory. They’re specific standards for specific types of audits. Think of them as special instructions. If you're doing a regular operational audit, you just follow the main standards. But if your audit plan includes, say, a review of cybersecurity risks, you must also follow the specific rules in the Cybersecurity Topical Requirement. Same for areas like fraud, or ESG reporting. So, if you're planning an audit, you always have to ask yourself: is there a Topical Requirement for this? Okay, so how do you apply this on the exam? Here's a simple four-step approach for any question. First, identify the actor and the action. Who is the question about—the CAE, a staff auditor, the board? And what are they doing or what problem are they facing? Second, map that scenario to one of the five GIAS. Domains. Is this about an auditor's personal ethics? That's Domain Two. Is it about the department's reporting line and independence? That's Domain Three. Third, once you have the domain, pinpoint the specific Guiding Principle at stake. If the CAE is reporting to the CFO, you've gone from Domain Three down to a violation of Principle 7, "Positioned Independently." And fourth, scan the answer choices. You need to immediately eliminate two types of wrong answers. First, get rid of any answers that mention old, retired IPPF terms. Second, eliminate answers that describe management's job, not internal audit's job. For example, setting the company's risk appetite is management's responsibility. Let's use an example. A regional bank's audit function is getting its quality assessment. The reviewer finds several issues with the audit charter. First, it hasn't been updated since 2020. It also still refers to the old IPPF. And finally, the last person to approve it was the CFO, not the board's audit committee. What's the biggest problem here? Step one: The actor is the CAE, and the problem is a flawed audit charter. Step two: A charter is all about the function's authority and independence. That maps squarely to Domain Three: Governing the Internal Audit Function. Step three: Which principles are at stake? Well, Guiding Principle 6 says the function must be "Authorized by the Board." Having the CFO approve the charter directly impairs Guiding Principle 7, "Positioned Independently." Standard 6.2 actually requires the CAE to get the charter approved by the board. So the corrective action is clear. The CAE needs to redraft the charter to align with GIAS and get it approved by the audit committee. The most critical finding here is the fundamental failure of governance. The function doesn't have the proper authority from the top. Now, you might see an answer choice that focuses on the charter still referencing the old IPPF. And yes, that's a problem, it's a non-conformance. But it's a symptom. The root cause, the much bigger issue, is the lack of board approval. The exam will test if you can spot the most significant governance failure, not just the easy technical error. This brings me to a common pitfall. If you've been around for a while, you might still think in the old IPPF terms. Watch out for exam distractors that mention "Attribute Standards" or "Performance Standards." Those terms are retired. They've been absorbed into the new structure. If you see an answer choice based on that old terminology, it is almost certainly wrong. To help you remember the new structure on exam day, I've got a quick mnemonic for the five domains: P-E-G-M-P. That’s Purpose, Ethics, Governing, Managing, and Performing. Just think of the phrase: "Professional Experts Guide Management's Performance." P-E-G-M-P. So on the exam, when you get a scenario question, your first thought should be: which domain does this fit into? An auditor taking a gift from a client? That's Domain Two, Ethics. The CAE struggling to hire enough data analysts for the team? That's Domain Four, Managing. Starting with the domain quickly narrows your focus to the right principles and standards. So let's recap the key points. The Global Internal Audit Standards, or GIAS, are the new mandatory framework. They replaced the old IPPF. The structure is a hierarchy. It starts with five Domains. Inside those are 15 Guiding Principles, which are then supported by detailed Standards. Remember the mnemonic for the five domains: P-E-G-M-P. That's Purpose, Ethics, Governing, Managing, and Performing. And don't forget about the mandatory Topical Requirements for specialized audits. When you see a question on the exam, map the scenario to one of those domains first. And always discard answers that use retired IPPF terms. VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. Get started at Vora Prep dot com.