The Internal Audit Code of Practice is the Chartered Institute of Internal Auditors’ benchmark for what an effective internal audit function looks like in the United Kingdom and Ireland. Its current edition, effective from January 2025, contains thirty-seven principles in nine sections and applies across financial services, the private sector and the third sector; external quality assessors benchmark functions against it, regulators read it, and audit committee chairs use it to ask whether the function they oversee is built properly. This guide sets out where the Code came from and its status; the nine sections and every principle in summary; the four sections that bite hardest (scope, reporting, independence and quality); the gap analysis most functions produce on first reading; a twelve-month implementation plan; the UK context the Code sits in, including the 2024 Corporate Governance Code’s controls declaration, the senior managers regime and the end of the audit-reform legislation in 2026; and a worked gap assessment at an illustrative UK-listed manufacturer.
It replaces the earlier guide at this address and absorbs the former note on post-Brexit compliance into the UK context section. The Global Internal Audit Standards guide covers the international standards the Code is applied alongside, and the external quality assessment guide the review that tests conformance with both.
In this guide
- Where the Code came from and what status it has
- The nine sections and thirty-seven principles
- Scope and priorities: the twelve areas in Principle 8
- Reporting results and the annual opinion
- Independence and authority: the ten principles that decide the function
- Resources and quality assurance
- The gap analysis most functions produce
- A twelve-month implementation plan
- The UK context: the Governance Code, the senior managers regime and audit reform
- Worked example: Pennine Foods plc’s Code gap assessment
- Frequently asked questions
- Related guides
Where the Code came from and what status it has
The Code began in financial services. After the 2008 crisis the Chartered IIA convened an independent committee that published Effective Internal Audit in the Financial Services Sector in 2013, a set of recommendations on the mandate, scope, reporting line and standing of internal audit in banks and insurers that the UK regulators endorsed and examined against. A second code for the private sector followed in 2020, and in 2024 the Institute consolidated the two into a single Code, updated for the IIA’s Global Internal Audit Standards, the revised UK Corporate Governance Code and the risks of the decade (culture, climate, technology and artificial intelligence), extended to the third sector, and effective from January 2025. The public sector is outside it and follows the Public Sector Internal Audit Standards.
The Code has no statutory force and does not use the words “comply or explain”. Its force comes from three places: the Prudential Regulation Authority and the Financial Conduct Authority treat it as the benchmark for internal audit at the firms they supervise, and ask about departures; external quality assessment providers benchmark against it and report conformance to the audit committee; and the audit committee chairs who appoint chief audit executives read it as the specification of the job. It is to be applied proportionately to the organisation’s nature, scope and complexity, and every function in scope is expected to engage with its principles.
The nine sections and thirty-seven principles
The table gives every section with its principles in summary. The four sections that generate most of the work are developed below.
| Section | Principles | In summary |
|---|---|---|
| A. Purpose and mandate | 1–4 | Internal audit helps the board and senior management protect the organisation’s assets, reputation and sustainability, under a published charter (1); the board and senior management set a tone that supports it (2); the chief audit executive reports annually to the audit committee on the application of the Code (3); the audit committee’s annual report summarises internal audit’s mandate, activities, impact and effectiveness (4) |
| B. Scope and priorities | 5–8 | Scope is unrestricted, without second-guessing board decisions (5); internal audit forms its own risk-based view of coverage, including emerging and systemic risks, informed but not determined by stakeholders (6); plans are approved by the audit committee and stay dynamic (7); twelve scope areas from strategy and culture to artificial intelligence (8) |
| C. Reporting results | 9–11 | Attendance at and consolidated reporting to the audit, risk and other board committees (9); reports that include overall opinions on higher-risk areas, root causes, themes, a view on remediation, post-mortems of significant adverse events including internal audit’s own role, and areas of effective control (10); at least annually, an overall opinion on the governance, risk and control framework and on adherence to risk appetite (11) |
| D. Interaction with risk management, compliance, finance and control functions | 12–14 | Independence from the risk, compliance and finance functions, mandatory in financial services and best practice elsewhere (12); no sole reliance on control functions’ work (13); coordination with other assurance providers (14) |
| E. Independence and authority | 15–24 | The chief audit executive at executive committee level (15); attendance at executive forums (16); unrestricted access (17); primary reporting line to the audit committee chair (18), who appoints and removes the chief audit executive (19), sets objectives and appraises at least annually with an explicit discussion of tenure beyond seven years (21), and recommends pay that is not tied to short-term performance (22); outsourced functions accountable to the organisation (20); subsidiary heads report to the group chief audit executive (23); any administrative line to the chief executive in financial services or an agreed senior manager elsewhere (24) |
| F. Resources | 25–29 | Suitable skills through training, recruitment, secondment or co-sourcing (25); regular assessment of skills and budget for the committee (26); diversity of background and thought (27); appropriate tools including data analytics and artificial intelligence (28); the audit committee approves the budget and discloses in the annual report whether the function is adequately resourced (29) |
| G. Quality assurance and improvement programme | 30–34 | Performance objectives and regular evaluation beyond plan delivery (30); current methodology and performance measures (31); a programme run independently of delivery, reported at least annually, with periodic self-assessment (32); co-sourced and outsourced work subject to the same programme (33); an external quality assessment at least every five years covering the Code and the Global Standards (34) |
| H. Relationship with regulators and external audit | 35–36 | An open, constructive relationship with regulators (35); regular communication with the external audit partner (36) |
| I. Wider considerations | 37 | The Institute commissions an independent review of the Code at least every five years (37) |
Scope and priorities: the twelve areas in Principle 8
Principle 8 is the Code’s most specific demand and the one most plans fail. It lists twelve areas that internal audit’s coverage should include, several of which (strategy, culture, risk appetite, outcomes rather than design) were absent from most plans before the 2013 code introduced them. The table gives each area with the engagement that typically covers it and the guide on this site that sets out the method.
| Scope area | What the Code expects | Typical engagement | Method on this site |
|---|---|---|---|
| a. Purpose, strategy and business model | Assurance over the processes that set and execute strategy, without second-guessing the decisions | Audit of strategic planning and initiative governance | The strategic risk guide |
| b. Organisational culture, including risk and control culture | Assessment of whether the culture supports the control framework | Culture assessment with field interviews and data | The corporate culture audit guide and the organizational behavior requirement |
| c. Internal governance | Board and committee effectiveness, decision-making, information flows | Governance review; audit committee effectiveness | The audit committee effectiveness guide |
| d. Risk appetite | Whether appetite is set, cascaded and adhered to | Risk appetite framework audit; adherence in the annual opinion | The risk appetite statements guide |
| e. Key corporate and external events | Acquisitions, outsourcing, restructuring, geopolitical events | Program and integration audits; post-mortem reviews | The third-party risk management guide for outsourcing |
| f. Capital and liquidity risk, including stress testing | For financial services in particular, the management of capital and liquidity and the stress tests behind them | Capital planning and liquidity audits | The liquidity risk guide and the liquidity audit program |
| g. Customer treatment, conduct and reputational risk | Outcomes for customers and the behaviour that produces them | Conduct risk and complaints audits | The conduct risk guide and the reputation risk guide |
| h. Environmental sustainability, climate change and social issues, including diversity, equity and inclusion | Assurance over the management of these risks and the disclosures about them | ESG disclosure controls and climate risk audits | The ESG auditing guide |
| i. Financial crime, economic crime and fraud | The programs that prevent, detect and respond | Fraud risk management and financial crime audits | The fraud risk management guide |
| j. Technology, cyber, cloud, digital, data and artificial intelligence | The full technology estate including AI systems | IT general controls, cyber, cloud and AI governance audits | The AI governance audit guide |
| k. Risk management, compliance, finance and other control functions | The effectiveness of the second line and finance | Audits of the risk, compliance and finance functions themselves | The auditing ERM guide and the internal audit versus compliance guide |
| l. Outcomes of processes, not just design | Testing that controls achieve their purpose, not that they exist | Outcome testing in every engagement | The audit work program guide |
Principle 6 is the companion rule: the function forms its own view of what needs covering, taking stakeholder views as input rather than instruction, which is the Code’s answer to the plan that is the sum of what management asked for. The annual risk assessment guide gives the method, and an assurance map is the instrument for showing the committee that the twelve areas are covered by someone.
Reporting results and the annual opinion
Principles 9 to 11 set a reporting standard that is higher than most functions deliver. Reports to the committees must contain overall opinions on higher-risk areas rather than lists of findings; root cause analysis of significant weaknesses; thematic issues across engagements; internal audit’s view of management’s remediation plans; post-mortem reviews of significant adverse events that include internal audit’s own role; and, at least annually, an overall opinion on the governance, risk and control framework and on whether risk appetite is being adhered to. The annual opinion is the Code’s most demanding deliverable and the one audit committee chairs ask for first; the audit committee reporting guide gives the pack structure and the root cause guide the analysis the reports have to carry.
| Requirement | What it means in practice | Common shortfall |
|---|---|---|
| Overall opinions on higher-risk areas | A rated conclusion per area, built from the engagements and monitoring in the year | Engagement reports with no view across them |
| Root cause analysis | Why the weakness exists, at the level of design, resource, incentive or culture | Findings that state the condition and the fix and nothing between |
| Thematic issues | Patterns across engagements and business units | Themes seen by the auditors and never written down |
| View on remediation | Whether management’s plans will fix the cause | Actions accepted as drafted |
| Post-mortems including internal audit’s own role | After a significant adverse event, a review of what the function covered and missed | Post-mortems of the business only |
| Annual opinion on the framework and on adherence to risk appetite | A written, evidenced opinion with its basis and limitations | A summary of the year’s activity presented as an opinion; no view on appetite |
Independence and authority: the ten principles that decide the function
Section E is where the Code departs most from common practice outside financial services, and where audit committee chairs have the most to do. The table gives each principle, the test of conformance and the arrangement that fails it.
| Principle | Requirement | Conformance test | Fails when |
|---|---|---|---|
| 15 | The chief audit executive is at senior management level, normally the executive committee or equivalent | Membership or standing attendance of the executive committee | The CAE is two levels below and learns of decisions from minutes |
| 16 | Internal audit may attend and observe executive and decision-making forums | Standing invitations to the key forums | Attendance by invitation only |
| 17 | Unrestricted, timely access to information, records, people and property, including board and executive papers | Access rights in the charter and in practice | Board papers withheld; access negotiated engagement by engagement |
| 18 | The primary reporting line is to the audit committee chair | The chair sets the agenda and receives the reports first | The CAE reports in substance to the CFO or chief executive |
| 19 | The audit committee chair appoints and removes the chief audit executive | Appointment decision and documentation | The chief executive hires the CAE and informs the committee |
| 20 | An outsourced function remains accountable to the organisation | A named executive and the committee own the relationship | The outsourcer reports to the finance director and nobody owns the opinion |
| 21 | The chair sets the CAE’s objectives and appraises at least annually, with an explicit discussion of independence, objectivity and tenure; tenure beyond seven years is discussed annually | Objectives and appraisal records held by the chair; tenure discussion minuted | The CAE is appraised by the CFO; a fifteen-year tenure never discussed |
| 22 | The chair recommends the CAE’s remuneration to the remuneration committee; pay avoids conflicts and is not directly tied to short-term performance | Remuneration decision record; bonus structure | Bonus on group profit targets |
| 23 | Subsidiary and divisional heads of internal audit report primarily to the group CAE | Reporting lines in the group | Divisional heads report to divisional management |
| 24 | Any administrative reporting line is to the chief executive in financial services, or to a senior manager agreed with the chair elsewhere | Charter and organisation chart | Administrative line to the CFO at a bank |
The chief audit executive role guide covers reporting lines in depth, the CAE compensation guide the pay structures Principle 22 allows, and the internal audit charter guide the document in which the access and reporting rights are written down.
Resources and quality assurance
Sections F and G turn two things that functions assert into things they have to evidence: that the function has the skills and budget for the plan, and that its work is of a quality someone independent has checked. Principle 29 adds a disclosure: the audit committee states in the annual report whether internal audit is adequately resourced, which makes under-resourcing a published board statement. Principle 34 requires an external quality assessment at least every five years covering both the Code and the Global Internal Audit Standards; the external quality assessment guide covers preparation.
| Principle | Requirement | Evidence the assessor asks for |
|---|---|---|
| 25 | Suitable skills including subject-matter expertise, through training, recruitment, secondment or co-sourcing | Competency matrix against the plan; co-sourcing decisions; the skills guide |
| 26 | Regular assessment of skills needs and budget adequacy, reported to the committee | The assessment paper and the committee minute |
| 27 | Diversity of background and thought in line with the organisation’s policies | Team profile; recruitment practice |
| 28 | Appropriate tools and technology including data analytics and artificial intelligence, regularly reviewed | Tool inventory; analytics use in engagements; the generative AI guide |
| 29 | The committee approves the budget and discloses adequacy in the annual report | Budget approval; the annual report statement |
| 30 | Performance objectives and regular evaluation beyond plan delivery | Objectives, measures, committee evaluation |
| 31 | Current policies, methodology and performance measures, continuously improved | Methodology version history |
| 32 | A quality programme run independently of delivery, reported at least annually; periodic self-assessment | Programme design; reports; self-assessment |
| 33 | Co-sourced and outsourced work under the same programme | Quality reviews of co-sourced files |
| 34 | External quality assessment at least every five years against the Code and the Global Standards | The last assessment report and the actions |
The gap analysis most functions produce
Functions that assess themselves against the Code for the first time find a recognisable set of gaps, and the set differs between financial services, where the 2013 code has applied for a decade, and the private and third sectors, where the Code arrived in 2020 and 2025.
| Gap | Where it is common | Principle | Fix |
|---|---|---|---|
| No annual opinion on the governance, risk and control framework, or none on adherence to risk appetite | Private and third sectors | 11 | Design the opinion’s basis from the plan; report the first one with its limitations stated |
| Culture, strategy and risk appetite absent from the plan | Private sector | 8 | Add one engagement in each area to the next plan; use the assurance map to show coverage |
| Administrative reporting line to the chief financial officer | Private sector and smaller financial firms | 24 | Move the line to the chief executive or an agreed senior manager; record it in the charter |
| The CAE appointed and appraised by the executive, not the chair | Everywhere outside large financial services | 19, 21 | Change the appointment and appraisal process; minute the tenure discussion |
| Bonus tied to short-term group performance | Private sector | 22 | Restructure through the remuneration committee |
| No post-mortem reviews including internal audit’s own role | Everywhere | 10 | Add a post-mortem procedure triggered by defined events |
| External quality assessment overdue or never performed | Smaller functions | 34 | Commission one; the guide above |
| Outsourced function with no internal owner | Third sector and smaller companies | 20 | Name the executive and the committee member who own the relationship and the opinion |
| Reliance on compliance or risk testing without testing it | Financial services | 13 | Test the testing before relying; document the reliance decision |
| No disclosure of resourcing adequacy in the annual report | Everywhere | 29 | Draft the statement with the committee chair for the next report |
A twelve-month implementation plan
| Quarter | Actions | Owner | Output |
|---|---|---|---|
| Q1 | Self-assess against all thirty-seven principles with evidence; agree the gap list with the audit committee chair; revise the charter for access, reporting lines and the chair’s role in appointment, appraisal and pay | Chief audit executive with the chair | Gap register; revised charter approved |
| Q2 | Rebuild the plan from an independent risk assessment covering the twelve scope areas; produce the assurance map; design the annual opinion’s basis; agree the post-mortem trigger | Chief audit executive | Plan approved; assurance map; opinion methodology |
| Q3 | Deliver the first culture, strategy or risk appetite engagement; implement thematic and root cause reporting; assess skills and budget against the plan and report to the committee; restructure remuneration through the remuneration committee | Chief audit executive; committee chair | Engagement reports in the new format; resourcing paper |
| Q4 | Issue the first annual opinion on the framework and on adherence to appetite; report on application of the Code (Principle 3); draft the annual report statements (Principles 4 and 29); commission or schedule the external quality assessment | Chief audit executive; committee | Annual opinion; Code report; annual report text; assessment scheduled |
The UK context: the Governance Code, the senior managers regime and audit reform
The Code is one of several UK instruments that shape what the function has to deliver, and a head of internal audit at a UK company or regulated firm works with all of them. The table gives the ones that interact most with the Code as they stand in October 2026; the former note on post-Brexit compliance on this site is superseded by it, since the UK’s post-exit regime is now settled in these instruments rather than in transition.
| Instrument | What it requires | Interaction with the Code | Status |
|---|---|---|---|
| UK Corporate Governance Code 2024, Provision 29 | Boards of companies listed in the commercial companies category declare annually the effectiveness of their material internal controls, with the basis for the declaration | Internal audit’s coverage of material controls and its annual opinion are the evidence most boards rely on; the Code’s Principle 11 opinion and the Provision 29 declaration should be designed together | Applies to financial years beginning on or after 1 January 2026; first declarations in 2027 annual reports |
| Senior Managers and Certification Regime | Named senior managers hold prescribed responsibilities, including responsibility for the internal audit function at PRA- and FCA-regulated firms | The audit committee chair holds the prescribed responsibility for the independence and performance of internal audit, and at banks and larger firms the head of internal audit is a senior management function in their own right; both must evidence reasonable steps, and the Code’s Section E is that evidence | In force; under review for simplification since 2025 |
| PRA and FCA supervisory expectations | The regulators treat the Code as the benchmark for internal audit at the firms they supervise and ask about departures in supervisory meetings | Departures need a documented rationale | In force; the regulators guide covers how examiners read the function |
| Global Internal Audit Standards | The IIA’s mandatory standards, effective January 2025 | Applied alongside the Code; the external quality assessment covers both | In force |
| Audit reform and the proposed new regulator | The Audit Reform and Corporate Governance Bill would have replaced the Financial Reporting Council with a statutory regulator and widened the definition of public interest entities | The bill was dropped by the government in early 2026, citing regulatory burden; the FRC remains the regulator and the Governance Code the main instrument | Dropped, January 2026 |
| UK Sustainability Reporting Standards | UK SRS S1 and S2, published February 2025, voluntary, with the FCA proposing mandatory use by listed companies from 2027 | Scope area h; the ESG auditing guide | Voluntary; mandatory proposal pending |
| Ring-fencing and Basel 3.1 for banks | Ring-fencing above 35 billion pounds of core deposits; Basel 3.1 from 2027 | Scope area f for banks | In force; 2027 |
The instruments above are administered by regulators a head of internal audit in the United Kingdom deals with directly, and the function is often the organisation’s most frequent point of contact with several of them. The table gives each regulator’s remit as it stands in October 2026 and where internal audit meets it; it absorbs the former note on post-Brexit compliance, whose regulators these are.
| Regulator | Remit | Where internal audit meets it |
|---|---|---|
| Financial Conduct Authority (FCA) | Conduct regulator for financial services firms and markets; the Consumer Duty, in force for open products since July 2023 and for closed products since July 2024; the Senior Managers and Certification Regime, jointly with the PRA; market abuse and the listing rules | Supervisory questions on the function’s coverage of conduct and the Duty; the audit committee chair’s prescribed responsibility for internal audit; the open relationship Principle 35 expects |
| Prudential Regulation Authority (PRA) | Part of the Bank of England; prudential regulator of banks, building societies, credit unions, insurers and the largest investment firms; capital, liquidity, ring-fencing and the Basel 3.1 standards from 1 January 2027 | Scope area f; the PRA’s expectation that internal audit assesses the risk management framework and the independence of the risk function; its reading of the Code as the benchmark |
| Financial Reporting Council (FRC) | Regulator of audit, corporate reporting and actuarial work; custodian of the UK Corporate Governance Code and the Stewardship Code; remains the regulator after the government confirmed on 20 January 2026 that it would not proceed with the bill that would have replaced it | Provision 29 and the controls declaration; the FRC’s guidance on board effectiveness, which frames the audit committee’s reliance on internal audit |
| Information Commission (the former Information Commissioner’s Office) | Data protection and freedom of information; UK GDPR and the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025; fines of up to 17.5 million pounds or 4 percent of global turnover; a board-led corporate body since 30 September 2026 | Data protection audits; breach notification within 72 hours; the international transfer and adequacy questions that followed Brexit |
| Competition and Markets Authority (CMA) | Competition and consumer protection; direct consumer-law enforcement under the Digital Markets, Competition and Consumers Act 2024, in force from April 2025, with fines of up to 10 percent of global turnover | Pricing, subscription and advertising practice audits; merger control in acquisitions |
| HM Revenue and Customs (HMRC) | Tax, and since Brexit the UK’s own customs regime at the border with the EU; the corporate offence of failing to prevent the facilitation of tax evasion | Customs and supply-chain audits for goods moving to and from the EU; tax risk governance |
| Sector regulators: Ofcom, Ofgem, the MHRA and the Pensions Regulator | Communications and the Online Safety Act 2023 duties; energy; medicines and medical devices, where the MHRA can diverge from the European Medicines Agency; occupational pensions | Sector compliance audits; regulatory change tracking in the annual risk assessment |
| Serious Fraud Office and the Home Office | The failure-to-prevent-fraud offence under the Economic Crime and Corporate Transparency Act 2023, in force for large organisations since 1 September 2025, with a reasonable-procedures defence | Fraud risk management and the procedures the defence relies on; scope area i |
For international groups the Code applies to the UK and Irish entities and often to the group function that serves them, and its Section E requirements (the chair’s role in appointment and pay, the administrative line) are the ones most likely to conflict with a US parent’s practice, where the administrative line to the chief financial officer is common. The bank regulatory thresholds guide sets out the tiers a UK bank sits in.
Worked example: Pennine Foods plc’s Code gap assessment
Pennine Foods plc is the illustrative 900-million-pound UK-listed food manufacturer used across this site, with a December year-end and a first Provision 29 declaration due for the 2026 financial year. Its audit committee chair asked the head of internal audit, a function of four with a co-sourced technology audit provider, to assess the function against the Code before the declaration year, so that the committee could rely on the function’s opinion. The assessment found the following.
| Principle | Finding | Action |
|---|---|---|
| 8 (scope) | The plan covered financial, operational and technology processes; no engagement in culture, strategy, risk appetite or climate in three years | Culture and strategy engagements added to the next plan; climate covered through the ESG disclosure controls audit; assurance map produced |
| 11 (annual opinion) | The annual report to the committee summarised engagements; no opinion on the framework or on risk appetite had ever been given, and the appetite statement was qualitative | Opinion methodology designed with the committee chair; the appetite statement revised by the board so that adherence could be assessed |
| 18, 19, 21, 24 (reporting lines) | The head of internal audit was appointed by the chief executive, appraised by the finance director, and reported administratively to the finance director | Appointment and appraisal moved to the committee chair; administrative line moved to the chief executive; charter revised |
| 22 (remuneration) | Bonus set on the group profit scorecard | Restructured by the remuneration committee to function and conduct measures |
| 13 (reliance) | The function relied on the group’s control self-assessment results for low-risk sites without testing them | Test of the self-assessment process before any reliance; reliance decisions documented |
| 20, 33 (co-sourcing) | The co-sourced technology audits were reported directly to the IT director and were outside the quality programme | Reports routed through the head of internal audit; co-sourced files included in quality reviews |
| 29 (resourcing disclosure) | No statement in the annual report | Statement drafted with the chair for the 2026 report |
| 34 (external assessment) | Never performed | Assessment commissioned for the second half of 2027, after the declaration year |
The committee chair presented the assessment and the actions to the board as the basis for relying on internal audit in the Provision 29 declaration, and the board approved the revised charter and the resourcing increase the plan required. The function’s treasury engagement, described in the treasury audit guide, and its issue-tracking migration, described in the issue tracking guide, were the first outputs under the new plan.
Frequently asked questions
What is the Internal Audit Code of Practice?
The Chartered Institute of Internal Auditors’ benchmark for effective internal audit in the United Kingdom and Ireland: thirty-seven principles in nine sections covering purpose and mandate, scope, reporting, interaction with control functions, independence and authority, resources, quality assurance, relationships with regulators and external audit, and review of the Code itself. The current edition is effective from January 2025 and applies across financial services, the private sector and the third sector.
Is the Code mandatory?
It has no statutory force and does not use the comply-or-explain formula. Its force comes from the PRA and FCA, which treat it as the benchmark for internal audit at the firms they supervise; from external quality assessment providers, which benchmark against it; and from audit committee chairs, who use it to define the job. It is to be applied proportionately, and every function in scope is expected to engage with its principles.
What does the Code say about reporting lines?
The chief audit executive’s primary reporting line is to the audit committee chair, who appoints and removes the CAE, sets objectives, appraises at least annually with an explicit discussion of tenure beyond seven years, and recommends remuneration that is not tied to short-term performance. Any administrative line runs to the chief executive in financial services or to a senior manager agreed with the chair elsewhere. Subsidiary heads report to the group CAE, and outsourced functions remain accountable to the organisation.
What scope areas does the Code require?
Twelve, in Principle 8: purpose, strategy and business model; organisational culture; internal governance; risk appetite; key corporate and external events; capital and liquidity risk including stress testing; customer treatment, conduct and reputational risk; environmental sustainability, climate change and social issues; financial crime and fraud; technology, cyber, cloud, digital, data and artificial intelligence; the risk, compliance, finance and other control functions; and the outcomes of processes rather than their design alone.
What is the annual opinion the Code requires?
At least annually, an overall opinion on the organisation’s governance, risk and control framework and on whether risk appetite is being adhered to, built from the year’s engagements and monitoring and stated with its basis and limitations. It is the deliverable audit committee chairs ask for first and the one most private-sector functions have never produced; under the 2024 Corporate Governance Code it is also the evidence most boards rely on for the Provision 29 controls declaration.
How often does the Code require an external quality assessment?
At least every five years, covering conformance with both the Code and the IIA’s Global Internal Audit Standards, obtained by the audit committee. The internal quality programme must run independently of audit delivery, report at least annually, include periodic self-assessment and cover co-sourced and outsourced work.
How does the Code relate to the Global Internal Audit Standards?
The Code is applied alongside the Standards, which are the IIA’s mandatory requirements for the profession worldwide, effective January 2025. The Code is more specific on UK governance matters (the chair’s role in appointment, appraisal and pay; the twelve scope areas; the annual opinion on risk appetite; the annual report disclosures), and the external quality assessment covers both.
What changed in the UK in 2026 that affects internal audit?
The 2024 Corporate Governance Code’s Provision 29 applies to financial years beginning on or after 1 January 2026, so boards of companies listed in the commercial companies category will declare the effectiveness of material controls in their 2027 annual reports and are relying on internal audit for the evidence; and the government dropped the audit reform legislation that would have replaced the Financial Reporting Council with a new statutory regulator, in January 2026, leaving the Governance Code and the existing regulator as the framework.
Related guides
- Global Internal Audit Standards 2024: What Changed — the standards applied alongside the Code
- The Global Internal Audit Standards: Every Domain and Principle — the full map
- Preparing for an External Quality Assessment — the five-yearly review the Code requires
- The Internal Audit Charter — where the Code’s access and reporting rights are written
- What Is a Chief Audit Executive? — role and reporting lines
- CAE Compensation — pay structures that satisfy Principle 22
- Reporting to the Audit Committee — the pack and the annual opinion
- Assurance Mapping — showing coverage of the twelve scope areas
- How to Audit Corporate Culture — scope area b
- ESG Auditing — scope area h
- What Regulators Expect From Internal Audit — how the PRA and FCA read the function
- Regulation and Compliance category — every regulatory guide in one archive
Leave a Reply