The Global Internal Audit Standards, released by the Institute of Internal Auditors in January 2024 and effective from 9 January 2025, replaced the International Professional Practices Framework that the profession had worked under since 2009 and, in substance, since the 1970s. The change is larger than a renumbering. The Standards fold the mission, the core principles, the definition, the code of ethics, the attribute and performance standards and much of the implementation guidance into one document with one structure; they add requirements that did not exist (a mandate, a strategy, documented methodologies, performance measurement, professional courage); they describe for the first time what the board and senior management need to provide for the function to work, as essential conditions; and they introduce a new instrument, the topical requirement, that prescribes minimum coverage for named risk areas. This guide explains what changed, maps the 2024 standards to their 2017 ancestors, sets out what the changes mean for staff, leads and chief audit executives, and lists the gaps that external assessors have been finding in the first conformance year.
In this guide
- The new structure: domains, principles, standards
- What changed: the nine substantive shifts
- Standard-by-standard mapping to the 2017 Standards
- Terminology that changed, and the conformance statement
- Essential conditions: what the board and management now provide
- Topical requirements: the new instrument
- What the changes mean by role
- Implementation: the artifacts a function must now have
- Gaps found in the first conformance year
- Frequently asked questions
- Related guides
The new structure: domains, principles, standards
The 2017 framework separated mandatory guidance (the definition, the code of ethics, the core principles, the Standards) from recommended guidance (implementation guides, practice guides), and the Standards themselves into attribute standards (the 1000 series, about the function) and performance standards (the 2000 series, about the work). The 2024 Standards reorganise all of that into five domains, fifteen principles and fifty-two standards. Each standard has three parts: requirements (mandatory), considerations for implementation (common and preferred practices, not mandatory) and examples of evidence of conformance (what an assessor might look for). The implementation guides have been absorbed into the second and third parts, which is why the document is long and why conformance is now easier to evidence.
| Domain | Principles | Standards | What it covers | 2017 equivalent |
|---|---|---|---|---|
| I. Purpose of Internal Auditing | None (a statement) | None | What internal auditing is for: strengthening the organisation’s ability to create, protect and sustain value through independent, risk-based and objective assurance, advice, insight and foresight | The Mission and the Definition |
| II. Ethics and Professionalism | 1 Integrity; 2 Objectivity; 3 Competency; 4 Due Professional Care; 5 Confidentiality | 1.1 to 5.2 (13 standards) | The conduct expected of every internal auditor, including professional courage, skepticism and the use and protection of information | The Code of Ethics and attribute standards 1100 to 1230 |
| III. Governing the Internal Audit Function | 6 Authorized by the Board; 7 Positioned Independently; 8 Overseen by the Board | 6.1 to 8.4 (9 standards) | The mandate, charter, independence, CAE qualifications, board interaction, resources, quality and external assessment | Standards 1000 to 1130 and 1300 to 1322, with the board’s role made explicit |
| IV. Managing the Internal Audit Function | 9 Plan Strategically; 10 Manage Resources; 11 Communicate Effectively; 12 Enhance Quality | 9.1 to 12.3 (16 standards) | Understanding the organisation, the strategy, methodologies, the plan, coordination and reliance, resources, communication, errors, risk acceptance, internal quality, performance measurement, supervision | Standards 2000 to 2600 at function level, plus 1300 series internal assessment |
| V. Performing Internal Audit Services | 13 Plan Engagements Effectively; 14 Conduct Engagement Work; 15 Communicate Engagement Conclusions and Monitor Action Plans | 13.1 to 15.2 (14 standards) | Engagement planning, risk assessment, objectives and scope, criteria, resources, work programme, evidence, findings, recommendations, conclusions, documentation, final communication, follow-up | Standards 2200 to 2500 at engagement level |
Numbering follows the structure: Standard 9.4 is the fourth standard under Principle 9 in Domain IV. The profession has adopted the numbers quickly, and an auditor who still cites 2010 for the plan or 2340 for supervision in 2026 signals a methodology that has not been updated, which is exactly what the plan template guide warns about in its first section. The Domain II, Domain III and Domain IV guides on this site walk each domain standard by standard; this guide is the map of what moved.
What changed: the nine substantive shifts
Much of the 2024 content is the 2017 content reorganised and expanded. Nine changes are substantive, in the sense that a function fully conformant with the 2017 Standards would have had to do something new to conform in 2025.
| Change | Standard | What is new | Why it matters |
|---|---|---|---|
| 1. Professional courage is a requirement | 1.1 Honesty and Professional Courage | Internal auditors must demonstrate courage in the face of pressure, including by raising concerns and not being deterred from reporting significant matters | What was a cultural aspiration is now a conformance matter; the behaviour the escalation ladder guide describes has a standard number |
| 2. The internal audit mandate | 6.1 Internal Audit Mandate | The function’s authority, role and responsibilities are to be established by the board, documented in the charter, and include the mandate’s scope and any restrictions | Functions must be able to show what they are authorised to do and by whom; informal scope understandings no longer suffice |
| 3. An internal audit strategy | 9.2 Internal Audit Strategy | The CAE must develop and implement a strategy that supports the organisation’s objectives and the mandate, with a vision, strategic objectives and supporting initiatives, reviewed periodically with the board | A planning horizon beyond the annual plan is now mandatory |
| 4. Documented methodologies | 9.3 Methodologies | The CAE must establish methodologies to guide the function in conformance with the Standards, and update them as needed | The methodology manual is a required artifact; the methodology manual guide gives the outline |
| 5. Performance measurement | 12.2 Performance Measurement | The CAE must develop objectives to evaluate the function’s performance, with performance measures, considering input from the board and senior management | Functions must measure themselves, not only assess quality; the KPIs guide covers the measures |
| 6. Essential conditions for the board and senior management | Domain III, across 6.1 to 8.4 | Each governing standard states what the board and senior management need to do for the function to be effective: approve the mandate, charter, plan and budget; appoint, remove and remunerate the CAE; receive communications; support external assessment | The Standards speak to the board for the first time; CAEs have a document to point to |
| 7. Coordination and reliance made explicit | 9.5 Coordination and Reliance | The CAE must coordinate with other assurance providers and, where relying on their work, assess their competency, objectivity and the scope of their work, with the basis for reliance documented | Assurance maps and documented reliance decisions are now expected; see the assurance mapping guide |
| 8. Engagement documentation and supervision made explicit | 14.6 Engagement Documentation; 12.3 Oversee and Improve Engagement Performance | Documentation must be sufficient for an experienced auditor to understand the work and support the conclusions; supervision must be performed and evidenced throughout the engagement | The stand-alone standard for workpapers has a number; the annotated workpaper guide shows what meets it |
| 9. Topical requirements as a new element | Separate instrument alongside the Standards | The IIA may issue mandatory requirements for assessing named risk areas; cybersecurity and third-party risk were the first | Engagements in covered areas have a prescribed minimum; see below |
Three further changes are presentational but consequential. The word “activity” became “function”; “engagement communications” became “engagement conclusions” with a stronger expectation that each engagement conclude; and public-sector considerations were written into the document rather than left to separate guidance, which matters for government auditors reconciling the Standards with the Yellow Book, as the Yellow Book vs IIA Standards guide maps.
Standard-by-standard mapping to the 2017 Standards
For functions converting their methodology, a mapping table is the working tool. The table below covers the standards that functions cite most often; it is abridged (the full crosswalk runs to all fifty-two standards and is a methodology appendix in most functions), and where a 2024 standard has no 2017 ancestor it says so.
| 2024 standard | Title | 2017 ancestor | Note on the change |
|---|---|---|---|
| 1.1 | Honesty and Professional Courage | Code of Ethics: Integrity (1.1 to 1.4) | Courage added as a requirement |
| 2.1 to 2.3 | Individual Objectivity; Safeguarding Objectivity; Disclosing Impairments | 1120, 1130, Code of Ethics: Objectivity | Largely carried over; the one-year restriction on auditing former responsibilities remains |
| 3.1, 3.2 | Competency; Continuing Professional Development | 1210, 1230, Code of Ethics: Competency | Fraud and IT knowledge expectations carried over; CPD expectations stated |
| 4.3 | Professional Skepticism | 1220 (due professional care) and Implementation Guidance | Skepticism given its own standard; see the professional skepticism guide |
| 5.1, 5.2 | Use of Information; Protection of Information | Code of Ethics: Confidentiality | Protection expectations expanded, including for technology |
| 6.1 | Internal Audit Mandate | None directly (parts of 1000 and 1010) | New concept |
| 6.2 | Internal Audit Charter | 1000, 1010 | Charter must now include the mandate, the Standards reference and the board’s support |
| 7.1 | Organizational Independence | 1100, 1110, 1111 | Essential conditions for the board added, including approving the CAE’s remuneration |
| 7.2 | Chief Audit Executive Qualifications | 1210 (in part) | Board’s responsibility for the CAE’s qualifications made explicit |
| 8.1 to 8.4 | Board Interaction; Resources; Quality; External Quality Assessment | 1111, 2020, 2030, 1300 to 1322 | The five-year external assessment continues; board’s role in each stated |
| 9.1 | Understanding Governance, Risk Management and Control Processes | 2100, 2110, 2120, 2130 | Consolidated; the function must assess all three |
| 9.2 | Internal Audit Strategy | None | New requirement |
| 9.3 | Methodologies | 2040 (policies and procedures) | Strengthened to a required, maintained set of methodologies |
| 9.4 | Internal Audit Plan | 2010, 2020 | Risk-based plan with documented assessment, board input and approval; see the risk assessment guide |
| 9.5 | Coordination and Reliance | 2050 | Reliance assessment made explicit |
| 10.1 to 10.3 | Financial, Human and Technological Resource Management | 2030, 2230 (in part) | Technology resources added as a standard |
| 11.1 to 11.3 | Building Relationships; Effective Communication; Communicating Results | 2060, 2400 series, 2420 | Function-level communication consolidated |
| 11.4 | Errors and Omissions | 2421 | Carried over |
| 11.5 | Communicating the Acceptance of Risks | 2600 | Carried over; the escalation to the board when management accepts risk the CAE considers unacceptable |
| 12.1 | Internal Quality Assessment | 1311, 1310 | Ongoing monitoring and periodic self-assessment; see the self-assessment guide |
| 12.2 | Performance Measurement | None | New requirement |
| 12.3 | Oversee and Improve Engagement Performance | 2340 | Supervision strengthened and tied to quality |
| 13.1 to 13.6 | Engagement planning standards | 2200 to 2240 | Criteria (13.4) and work programme (13.6) made explicit; engagement risk assessment (13.2) includes fraud |
| 14.1 to 14.6 | Engagement work standards | 2300 to 2330 | Findings evaluated for significance; recommendations and action plans (14.4); conclusions (14.5); documentation (14.6) |
| 15.1, 15.2 | Final Engagement Communication; Confirming Implementation | 2400 to 2440, 2500 | Follow-up expectations carried over; see the issue validation guide |
Essential conditions: what the board and management now provide
The most practically useful change for CAEs is the essential conditions. In Domain III each standard states, alongside the requirements on the CAE, what the board and senior management need to do for the function to be effective. They are not requirements the IIA imposes on boards, which it cannot do; they are conditions, and the Standards say so. But they give the CAE a document to put in front of a committee chair, and the audit committee effectiveness review guide uses them as the assessment criteria. The main conditions, grouped:
| Area | What the board is to do | What senior management is to do | How CAEs are using it |
|---|---|---|---|
| Mandate and charter (6.1, 6.2, 6.3) | Establish and approve the mandate; approve the charter; discuss it with the CAE and senior management; support the function visibly | Support the mandate; provide access to records, people and property | Charter refresh with a mandate section, approved and minuted; the audit committee charter template includes the counterpart clauses |
| Independence (7.1) | Position the CAE to report functionally to the board; approve the appointment, removal and remuneration of the CAE; make inquiries about scope or resource limitations | Provide an administrative reporting line that does not impair independence | Reporting-line and remuneration arrangements documented; see the CAE compensation guide |
| CAE qualifications (7.2) | Ensure the CAE has the qualifications and competencies; consider them when appointing | Not applicable | Position descriptions and development plans for the CAE |
| Board interaction (8.1) | Meet the CAE, including privately; receive communications; discuss the function’s performance | Not applicable | Standing private sessions; the quarterly pack structured around the four questions |
| Resources (8.2) | Approve the budget and resource plan; respond to resource limitations the CAE escalates | Provide the approved resources | Resource escalation documented in the plan’s coverage section |
| Quality (8.3, 8.4) | Oversee the quality programme; approve the external assessment arrangements at least every five years; receive the results | Not applicable | Five-year external assessment calendar; the QAIP guide covers the programme |
| Plan and strategy (9.2, 9.4) | Approve the plan and the strategy; provide input to the risk assessment | Provide input; support plan delivery | Chair preview of the risk assessment before drafting; strategy on the annual agenda; see the audit committee annual agenda |
Topical requirements: the new instrument
The 2024 framework introduced a category of mandatory guidance that did not exist before: topical requirements, which set minimum expectations for assessing governance, risk management and controls in a named risk area whenever an internal audit function performs an engagement in that area. They do not require the function to audit the area; they require that, if it does, the engagement cover the prescribed elements. The first two addressed cybersecurity and third-party risk, with further topics in development. For functions, the practical consequences are three: the engagement risk assessment must identify when a topical requirement applies; the work programme must map to its elements; and the methodology must say how the function demonstrates conformance.
| Topical requirement | What it prescribes | When it applies | Function response |
|---|---|---|---|
| Cybersecurity | Minimum assessment of governance (strategy, roles, policies), risk management (identification, assessment, reporting) and controls (access, change, monitoring, incident response, recovery) over cybersecurity | Any engagement whose objectives include assessing cybersecurity, in whole or in part | Cybersecurity work programmes mapped to the requirement’s elements; specialist capability confirmed; coverage limitations stated |
| Third-party risk | Minimum assessment of the governance, risk management and controls over third-party relationships through their lifecycle: selection, contracting, onboarding, monitoring, termination | Engagements assessing third-party management; in force from September 2026 | Vendor management programmes mapped to the lifecycle elements; see the third-party topical requirement guide |
| Further topics | The IIA publishes topics for consultation before issue | As issued | Methodology provision for identifying applicable requirements at engagement planning (Standard 13.2) |
Two misunderstandings have been common in the first year. The first is that a topical requirement obliges the function to add the topic to the plan; it does not, although a function that never audits cybersecurity will be asked by its committee why. The second is that a partial engagement (a review of access management, say) escapes the requirement; the IIA’s guidance is that an engagement assessing part of the area must document which elements of the requirement were in scope and why the others were not. The safe practice is a scoping note in the planning memo for any engagement touching a covered area.
Terminology that changed, and the conformance statement
A conversion is incomplete while the function’s documents still speak 2017. The table lists the vocabulary changes that appear most often in charters, methodologies and report templates, with the reason each was made. The last row is the one that carries conformance consequences.
| 2017 term | 2024 term | Reason for the change | Where it appears |
|---|---|---|---|
| Internal audit activity | Internal audit function | A function is an organisational unit with a mandate; an activity is something anyone might do | Charter, methodology, reports |
| Attribute and performance standards | Domains, principles and standards | The attribute/performance split did not reflect how functions are governed and managed | Methodology, training |
| Engagement communications | Engagement conclusions and final engagement communication | Every engagement is expected to conclude, not only to communicate | Report templates (Standards 14.5 and 15.1) |
| Policies and procedures | Methodologies | A stronger, maintained set of methods rather than an administrative manual | Standard 9.3 and the methodology manual |
| Quality assurance and improvement programme (QAIP) | Quality (Principle 8 and Principle 12) with internal and external assessment | The programme is split between what the board oversees and what the CAE runs; the term QAIP remains in common use | Standards 8.3, 8.4, 12.1 |
| Consulting services | Advisory services | Plain language; the distinction from assurance remains, as the assurance vs advisory guide explains | Charter, plan |
| Governance (as a separate subject) | Governance, risk management and control processes, assessed together | The three are inseparable in practice; Standard 9.1 treats them as one understanding | Risk assessment, plan |
| “Conforms with the International Standards for the Professional Practice of Internal Auditing” | “Conforms with the Global Internal Audit Standards” | The conformance statement may be used only when supported by the results of the quality programme | Every report; the external assessment tests it |
The conformance statement is the point at which vocabulary becomes substance. A function that updated its report footer to cite the Global Internal Audit Standards in January 2025 without an internal assessment supporting the claim has made a statement its own quality programme cannot back, and external assessors have written it up as such. The orderly sequence is the self-assessment first, the gap closure second and the statement third, which for many functions meant a transition year in which reports cited the Standards as the framework followed without claiming full conformance.
What the changes mean by role
| Role | What changes in daily work | What to learn | Where it will be tested |
|---|---|---|---|
| Staff and senior auditors | Engagement risk assessment with explicit fraud consideration (13.2); criteria stated for every objective (13.4); workpapers meeting the documentation standard (14.6); findings evaluated for significance with recommendations and action plans (14.3, 14.4); skepticism as a named duty (4.3); courage as a named duty (1.1) | The Domain II and V standards; the new numbering; the documentation standard applied to one’s own files | Review notes; the internal quality assessment; interviews, as the interview questions guide shows |
| Audit leads and managers | Supervision performed and evidenced throughout (12.3); engagement conclusions that conclude (14.5); coordination with other providers at engagement level (9.5); topical requirement scoping (13.2) | Domain IV standards 11 and 12; the reliance assessment logic; the topical requirements | The external quality assessment’s engagement sample; the committee’s questions about engagement quality |
| Audit directors | Methodology ownership (9.3); performance measures for their portfolio (12.2); assurance mapping (9.5); resource planning including technology (10.3) | Domain IV in full; the essential conditions | The methodology’s review; the plan defence; see the manager and director interview guide |
| Chief audit executives | The mandate and charter refresh (6.1, 6.2); the strategy (9.2); the methodology set (9.3); performance measurement (12.2); the board conversation about essential conditions; the five-year external assessment (8.4); the conformance statement | Domain III and the essential conditions; what the board must approve and when | The external quality assessment; the committee’s own effectiveness review; regulators, who have adopted the Standards as a reference |
| Audit committee members | Approving the mandate, charter, plan, budget and strategy; the CAE’s appointment, removal and remuneration; private sessions; the external assessment | The essential conditions in Domain III | Their own effectiveness review; regulatory expectations of board oversight |
Implementation: the artifacts a function must now have
Conformance is demonstrated by artifacts, and the 2024 Standards name more of them than the 2017 Standards did. The table is the checklist that external assessors have been working from; a function that can produce each item, current and approved, has done most of the conversion.
| Artifact | Standard | What it must contain | Common state in first-year assessments |
|---|---|---|---|
| Internal audit mandate, in the charter | 6.1, 6.2 | Authority, role, responsibilities, scope, restrictions; the Standards referenced; board approval | Charters updated for the reference but not for the mandate |
| Internal audit strategy | 9.2 | Vision, strategic objectives, initiatives, review cadence; discussed with the board | Missing or a slide, not a strategy |
| Methodology set | 9.3 | Risk assessment, planning, engagement, reporting, follow-up, quality, documentation and retention methodologies; version control | Present but citing 2017 numbering; retention and technology sections absent |
| Risk assessment and plan | 9.4 | Documented assessment; board input; approval; coverage and limitations; change process | Present; board input and limitations disclosure weak |
| Assurance map and reliance assessments | 9.5 | Other providers mapped; basis for reliance per provider | Often absent |
| Resource plan | 10.1 to 10.3 | Financial, people and technology resources against the plan; limitations escalated | Technology resources rarely addressed |
| Performance measures | 12.2 | Objectives and measures for the function, with board and management input; reported | Operational metrics only; no objectives |
| Quality programme | 12.1, 8.3, 8.4 | Ongoing monitoring, periodic self-assessment, external assessment at least every five years; results to the board | Present; self-assessment thin |
| Engagement documentation standard | 14.6, 12.3 | Templates and review evidence meeting the experienced-auditor test | Templates present; review evidence inconsistent |
| Conformance statement | Domain I and 4.1 | Reports state conformance only if the quality programme supports it | Statement made without supporting assessment |
Gaps found in the first conformance year
External quality assessments performed against the 2024 Standards during 2025 and 2026 have produced a consistent set of findings, which are worth knowing before an assessor arrives. They cluster in the new requirements, which is unsurprising, and in two old ones that the new document made harder to fudge.
- No strategy, or a strategy that is a plan. Standard 9.2 asks for a multi-year view with objectives and initiatives; a list of next year’s engagements with a vision statement on top does not meet it.
- Mandate not articulated. Charters updated with the new Standards reference but silent on the function’s authority, scope and restrictions in the terms Standard 6.1 uses.
- Performance measurement absent. Metrics exist (plan completion, timeliness) but objectives for the function do not, and the board was not asked for input.
- Reliance without assessment. The plan assumes the second line covers an area, with no documented assessment of the second line’s competency, objectivity and scope.
- Supervision not evidenced. Review happened, according to interviews, but the files show sign-offs without review notes or evidence of what was reviewed.
- Documentation below the experienced-auditor test. Files that need the preparer present to be understood; populations without completeness evidence; conclusions broader than the testing.
- Essential conditions unaddressed. The CAE’s remuneration set by management without board approval; no private sessions; the external assessment overdue.
- Topical requirements not scoped. Cybersecurity engagements performed without reference to the requirement’s elements, or with a partial scope and no statement of what was excluded.
- The conformance statement made unsupported. Reports state conformance while the quality programme has not assessed it; assessors treat this as a finding in itself.
The pattern is that the Standards have made implicit expectations explicit, and functions that had been meeting them in spirit now have to meet them in evidence. Most of the gaps are closed by writing things down that were already being done: the strategy the CAE carries in her head, the reliance judgment the director made in a meeting, the review the manager performed without a note. The internal self-assessment guide is the instrument for finding the gaps before the external assessor does, and the what is a CAE guide describes the role that owns closing them.
Frequently asked questions
What are the Global Internal Audit Standards?
The IIA’s mandatory standards for the practice of internal auditing, released in January 2024 and effective from 9 January 2025. They replace the 2017 International Standards for the Professional Practice of Internal Auditing and consolidate the mission, definition, core principles and code of ethics into one document organised in five domains, fifteen principles and fifty-two standards, each with requirements, considerations for implementation and examples of evidence of conformance.
What are the five domains of the Global Internal Audit Standards?
Domain I, Purpose of Internal Auditing; Domain II, Ethics and Professionalism (principles 1 to 5); Domain III, Governing the Internal Audit Function (principles 6 to 8); Domain IV, Managing the Internal Audit Function (principles 9 to 12); and Domain V, Performing Internal Audit Services (principles 13 to 15).
What changed between the 2017 Standards and the 2024 Standards?
Nine substantive additions: professional courage as a requirement; an internal audit mandate; an internal audit strategy; documented methodologies; performance measurement; essential conditions describing what the board and senior management provide; explicit coordination and reliance assessment; explicit engagement documentation and supervision; and topical requirements as a new mandatory instrument. The rest is the 2017 content reorganised, renumbered and expanded with implementation guidance.
What are topical requirements?
Mandatory minimum expectations for assessing governance, risk management and controls in a named risk area whenever an internal audit function performs an engagement in that area. They do not require the function to audit the area. The first two addressed cybersecurity and third-party risk; others follow the IIA’s consultation process.
What are the essential conditions in the Standards?
Statements in Domain III of what the board and senior management need to do for the internal audit function to be effective: approve the mandate, charter, plan, budget and strategy; appoint, remove and remunerate the CAE; meet the CAE privately; respond to resource limitations; and support the external quality assessment. They are conditions, not requirements imposed on boards, and they give CAEs a document to discuss with committee chairs.
When did the Global Internal Audit Standards take effect?
On 9 January 2025, one year after release. Functions could adopt early. External quality assessments performed from that date are against the 2024 Standards, and a function may state conformance only if its quality programme supports the statement.
Do the Standards still require an external quality assessment every five years?
Yes. Standard 8.4 requires an external quality assessment at least once every five years by a qualified, independent assessor or assessment team, with the board approving the arrangements and receiving the results.
Related guides
- GIAS Domain II: Ethics and Professionalism — the conduct standards, including courage and skepticism, standard by standard.
- GIAS Domain III: Governing the Function — mandate, charter, independence and the essential conditions.
- GIAS Domain IV: Managing the Function — strategy, methodologies, plan, resources, communication and quality.
- The third-party topical requirement — what it prescribes and how to scope engagements under it.
- The internal audit methodology manual — the Standard 9.3 artifact, with a full outline mapped to GIAS.
- The quality assurance and improvement program — internal and external assessment under Principles 8 and 12.
- How to run an internal self-assessment — finding the conformance gaps before the external assessor does.
- Internal audit KPIs — the Standard 12.2 performance measures.
- Audit committee charter template — the committee’s side of the essential conditions, clause by clause.
- Yellow Book vs IIA Standards — GAGAS mapped to the Standards for public-sector auditors.
Leave a Reply