The IIA 2024 Standards: what South African audit functions actually need to change

The Global Internal Audit Standards 2024 replaced the framework most South African internal audit functions were built around. This is not a renumbering exercise. The structure, the expectations placed on the board, and the way conformance is assessed have all changed.

The five domains

The Standards are organised into five domains. Domain I sets out the purpose of internal auditing and carries no numbered standards. Domain II covers ethics and professionalism. Domain III covers governing the internal audit function — the charter, independence, and board oversight. Domain IV covers managing the function, including strategy, the audit plan, resources and quality. Domain V covers performing internal audit services, from engagement planning through to confirming that agreed actions were implemented.

The change most functions have not made

The internal audit charter is the most common gap. Under the 2024 Standards the charter is expected to reflect an explicit mandate agreed with the board, and to be reviewed against the Standards themselves. A charter written for the previous framework and merely re-dated does not meet this. Functions that fix the charter first find the methodology and plan changes follow naturally; functions that start with engagement-level documentation often have to redo it.

Conformance is now rated on four levels

External quality assessments express conformance on a four-tier scale: Full Achievement, General Achievement, Partial Achievement and Non-Achievement. The older three-tier language of Generally Conforms, Partially Conforms and Does Not Conform is superseded. If your last EQA used the old scale, your next one will not.

Only a qualified external assessor may express a conformance opinion. An internal self-assessment is useful for identifying gaps and sequencing remediation, but it is not an EQA and confers no rating.

Where South African requirements sit alongside the Standards

For public entities the PFMA, and for municipalities the MFMA, impose their own internal audit obligations, and King IV addresses the assurance role of the governing body. These sit alongside the Standards rather than replacing them. A function can conform to the Standards and still fall short of its statutory obligations, and the reverse is equally true.

Common questions

When did the IIA 2024 Standards take effect?

The Global Internal Audit Standards 2024 were released in January 2024 and became effective in January 2025, giving functions a transition period to align their charter, methodology and plan.

Do the 2024 Standards replace the IPPF?

They replace the mandatory guidance most functions worked to under the previous framework, restructuring it into five domains with principles and numbered standards beneath them.

How often is an external quality assessment required?

An external quality assessment is expected at least once every five years, conducted by a qualified, independent assessor from outside the organisation.