Domain I of the Global Internal Audit Standards is the shortest of the five domains and the only one that contains no standards at all. It is a single purpose statement: internal auditing strengthens the organization’s ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight. Everything else in the Standards, the thirteen ethics standards of Domain II, the board’s essential conditions in Domain III, the chief audit executive’s sixteen standards in Domain IV and the fourteen engagement standards in Domain V, exists to make that one sentence true. Domain I does not tell you what to do. It tells you why the rest of the document exists, and it is the yardstick an external assessor, a board chair or a regulator will reach for when they ask whether a function is doing its job.
This guide reads the purpose statement one clause at a time, sets it beside the three things it replaced in the 2017 International Professional Practices Framework (the Mission, the Definition and the Core Principles), explains the three conditions the Standards attach to effectiveness, and shows where Domain I is actually used: in the charter, in the external quality assessment, in board reporting and in the public-interest discussion that the IIA added for the first time. It completes the site’s domain series, which already covers Domain II, Domain III, Domain IV and Domain V, and sits alongside the complete reference map of the Standards and the IPPF-to-GIAS mapping table.
In this guide
- What Domain I is, and what it is not
- The purpose statement, clause by clause
- The five things internal auditing enhances
- The three conditions for effectiveness
- What Domain I replaced: Mission, Definition, Core Principles
- The public interest: the clause that is new
- Assurance, advice, insight, foresight: four services, not one
- Where Domain I shows up: the charter
- Where Domain I shows up: the external assessment
- Where Domain I shows up: board reporting and the strategy
- Five misreadings of Domain I
- A Domain I self-check for the function
- Template: the purpose paragraph for a charter or strategy
- Worked example: MidState Beverage rewrites its charter around the purpose
- Questions about Domain I
- Related guides
What Domain I is, and what it is not
The Global Internal Audit Standards were published by the IIA on 9 January 2024 and took effect on 9 January 2025. They are organized into five domains. Domains II to V hold the fifteen principles and fifty-two standards that carry requirements. Domain I holds the purpose of internal auditing: one statement, a list of five things internal auditing enhances, and three conditions under which it is most effective. There are no numbered standards in Domain I, no “Requirements” sections, no “Considerations for Implementation” and no “Examples of Evidence of Conformance”. You cannot be in nonconformance with Domain I in the way you can be with Standard 9.4 or Standard 15.2.
That does not make it decorative. Three things give Domain I its weight. First, the Standards say the other four domains should be read in light of it: the purpose is the reason the requirements exist, and when a requirement is ambiguous, the purpose is the tie-breaker. Second, Domain I is where the Standards define the function’s relationship to the board and to management, which is the architecture the rest of the document assumes. Third, it is the text an external assessor will quote when writing about a function whose work is technically conformant but strategically pointless, and the text a chief audit executive can quote when a chief financial officer asks why internal audit should look at strategy execution at all.
| Domain | Title | Principles | Standards | What it governs |
|---|---|---|---|---|
| I | Purpose of Internal Auditing | 0 | 0 | Why the function exists; the relationship to board and management; the public interest |
| II | Ethics and Professionalism | 5 | 13 | Integrity, objectivity, competency, due care, confidentiality (guide) |
| III | Governing the Internal Audit Function | 3 | 9 | What the board must provide: mandate, independence, oversight (guide) |
| IV | Managing the Internal Audit Function | 4 | 16 | Strategy, plan, resources, communication, quality (guide) |
| V | Performing Internal Audit Services | 3 | 14 | Planning, conducting and concluding engagements (guide) |
A practical way to hold the structure in mind: Domain I is the job description, Domains II and III are the terms of employment, and Domains IV and V are the operating manual. The reference map lays out all fifty-two standards with their titles; this guide stays inside Domain I.
The purpose statement, clause by clause
The sentence rewards slow reading. Each clause was argued over during the 2023 public consultation, and each one carries a position the IIA chose over an alternative. The table takes the sentence apart.
| Clause | What it establishes | The alternative it rejects | What it means for a function |
|---|---|---|---|
| “Internal auditing strengthens the organization’s ability…” | The subject is the organization’s ability, not the auditor’s output. The measure of success is organizational capacity, not report count. | A purpose defined by activity (“internal auditing examines and evaluates…”), which is how the 1978 and 1999 formulations began | Metrics and the annual report to the board should show what changed in the organization, not how many engagements closed (see the audit committee deck template) |
| “…to create, protect, and sustain value…” | Three verbs, in that order. Creation is listed first; protection is not the whole job; sustaining value over time is a distinct aim | The 2017 Mission’s “enhance and protect organizational value”, which many functions read as protect first | Advisory work on new ventures, strategy and change belongs in the plan on equal footing with control testing, subject to the independence rules in Domain III |
| “…by providing the board and management…” | Two clients, named in that order. The board is the primary reporting line (Standard 7.1); management is a client too | A purpose defined only in terms of the board, or only in terms of “the organization” | Communication standards in Domain IV (11.1 to 11.5) apply to both audiences, with different content for each |
| “…with independent, risk-based, and objective…” | Three qualities that are conditions of the service, not aspirations. Independent (positioning), risk-based (what gets attention), objective (state of mind) | “Reasonable” or “professional” as the qualifier, which would make the service indistinguishable from management’s own reviews | Every engagement should be traceable to the risk assessment (Standard 9.4), and every impairment of independence or objectivity should be reported (Standards 2.1, 7.1) |
| “…assurance, advice, insight, and foresight.” | Four products. Assurance and advice were in the 2017 Mission; insight was there too; foresight is new to the purpose statement | A purpose limited to assurance, which is what most charters written before 2017 described | The plan should contain all four, explicitly labeled, and the strategy (Standard 9.2) should say how much of each the function intends to deliver |
Two points are easy to miss. The sentence does not say internal auditing provides assurance “over governance, risk management and control processes”; that scope language moved into the list of things internal auditing enhances. And the sentence does not mention controls at all. The Standards’ glossary retains the Definition of Internal Auditing, with its reference to governance, risk management and control processes, but the purpose statement is written one level up, in terms of value. A function whose charter still describes its purpose as “evaluating internal controls” is describing a method, not the purpose.
The five things internal auditing enhances
After the purpose sentence, Domain I lists five things internal auditing enhances. The list is the closest Domain I comes to a scope statement, and it is the list an assessor will test a function’s plan against.
| Internal auditing enhances the organization’s… | Where it lands in the Standards | How a function shows it | Typical gap |
|---|---|---|---|
| Successful achievement of its objectives | Standard 9.1 (understanding governance, risk management and control processes), 9.4 (risk-based plan aligned to objectives) | The plan cites the organization’s strategic objectives and the risks to each; engagements are selected for their bearing on those objectives | A plan built from the audit universe’s org chart rather than from objectives, so support functions are audited on rotation while strategic risks go untouched |
| Governance, risk management, and control processes | The Definition of Internal Auditing (glossary); Standards 9.1 and 9.3; Domain V engagement standards | Engagements evaluate all three, not controls alone; governance engagements appear in the plan | “Governance” appears in the charter and nowhere in the plan |
| Decision-making and oversight | Standards 11.1 to 11.3 (communication), 8.1 (board interaction), the essential conditions in Domain III | Reports are written to inform decisions (the anatomy of a report); the board receives what Standard 11.3 requires, including accepted risks under 11.5 | Findings are reported, but the board never sees the function’s overall conclusion on the state of risk management |
| Reputation and credibility with its stakeholders | Domain II (ethics), Standard 12.1 (external quality assessment), the public-interest clause | Conformance can be demonstrated to a regulator or external auditor; the external assessment is current | No external assessment in more than five years, so the “conforms with the Standards” statement on reports is unsupported |
| Ability to serve the public interest | Domain I itself; Standard 1.1 (integrity), 2.1 (objectivity); the professional courage standard 1.3 | The function has escalated at least one matter it was pressured to drop; the charter names the public interest | The phrase is absent from the charter and the strategy, and nobody can say what it would mean in practice |
Note what is on the list and what is not. “Compliance” is not a separate item; it sits inside governance, risk management and control processes. “Efficiency” is not an item either, although operational audits remain one of the most common engagement types, because efficiency is one way of achieving objectives rather than a purpose of its own. The ordering is deliberate: achievement of objectives comes first, and the public interest comes last but is the one addition that has no precedent in earlier IIA frameworks.
The three conditions for effectiveness
Domain I closes by saying internal auditing is most effective when three conditions hold. Each one is a hook for a later domain, and together they are the argument for why the board must do its part. This matters because the Standards, for the first time, impose requirements on the board (the essential conditions in Domain III), and the justification for that is in Domain I: without these conditions the service cannot deliver what the purpose promises.
| Condition | What it says | The domain that operationalizes it | What to check |
|---|---|---|---|
| 1. Competent professionals, conforming with the Standards set in the public interest | Effectiveness depends on who does the work and how. The Standards themselves are described as set in the public interest, which is why conformance is not optional for a function that claims the title | Domain II (Principle 3 competency, Principle 4 due professional care); Standard 10.2 (human resources); Standard 3.1 | Competency assessments exist for each auditor; the function’s conformance statement is supported by a current quality program (QAIP playbook) |
| 2. Independently positioned, with direct accountability to the board | Positioning is structural. Accountability to the board is direct, not routed through the CFO or general counsel | Domain III, Standard 7.1 (organizational independence) and the essential conditions; Standard 6.1 (mandate) | The CAE reports functionally to the board; the board approves the charter, plan, budget and CAE appointment and remuneration (Domain III guide) |
| 3. Internal auditors free from undue influence, committed to objective assessments | Freedom from influence is a condition at the level of the individual auditor, not only the function | Domain II Principle 2 (objectivity), Standard 2.1 to 2.3; Standard 1.3 (professional courage) | Impairments are disclosed; scope limitations are reported to the board (Standard 9.4 requires the board to be told of limitations) |
The second condition is the one that most often fails in practice and the one Domain I makes non-negotiable. A function whose head reports to the CFO with a dotted line to the audit committee is not “independently positioned with direct accountability to the board”; it is positioned inside management with a courtesy relationship to the board. Domain III turns this into a requirement, but Domain I is where the reason is stated: the service is not effective without it. The independence and objectivity guide works through the reporting-line cases, and the first-90-days CAE plan covers negotiating the line before accepting the role.
What Domain I replaced: Mission, Definition, Core Principles
The 2017 International Professional Practices Framework had three elements that did the work Domain I now does: the Mission of Internal Audit, the Definition of Internal Auditing and the ten Core Principles for the Professional Practice of Internal Auditing. Understanding how each was handled explains some of Domain I’s wording.
| 2017 IPPF element | Text (abridged) | Where it went | What changed |
|---|---|---|---|
| Mission of Internal Audit | To enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight | Absorbed into the Domain I purpose statement | “Enhance and protect” became “create, protect, and sustain”; “independent” was added to “risk-based and objective”; “foresight” was added to the three products; the board and management were named as the recipients |
| Definition of Internal Auditing | An independent, objective assurance and consulting activity designed to add value and improve an organization’s operations… | Retained in the glossary, with “advisory” alongside “consulting” | No longer the headline; the purpose statement sits above it. The Definition still supplies the scope language (governance, risk management and control processes) |
| Core Principles (10) | Demonstrates integrity; demonstrates competence and due professional care; is objective and free from undue influence; aligns with strategies, objectives and risks; is appropriately positioned and adequately resourced; demonstrates quality and continuous improvement; communicates effectively; provides risk-based assurance; is insightful, proactive and future-focused; promotes organizational improvement | Converted into the fifteen principles of Domains II to V | Principles now carry standards beneath them, so they are testable. The mapping table shows each Core Principle’s destination |
| Code of Ethics | Four principles and twelve rules of conduct | Became Domain II | Ethics moved from a separate document into the Standards, with professional courage added as a standard |
The practical consequence for a function that updated its charter in 2017 and has not touched it since: the charter probably quotes the Mission and the Definition. Neither is wrong, but neither is the current purpose statement, and an external assessor working to Standard 6.2 will note that the charter does not reflect the current Standards. The history of the IIA Standards traces every revision from 1947 to GIAS; the what-changed summary covers the 2024 update at the level of the whole document.
The public interest: the clause that is new
The 2017 IPPF did not mention the public interest. The Global Internal Audit Standards mention it twice in Domain I: internal auditing enhances the organization’s ability to serve the public interest, and the Standards themselves are described as set in the public interest. The IIA’s own list of new requirements in the 2024 Standards opens with the Domain I public-interest discussion, which is a signal of how seriously the drafters took it.
What does it mean for a function inside a private company, where the shareholders are the only stakeholders who can vote? Domain I’s answer is that an organization’s ability to serve the public interest is enhanced by internal auditing, which places the clause at the organizational level rather than making the auditor a public official. In practice it has three consequences:
- The scope argument. Matters that affect people outside the organization (product safety, data protection, environmental compliance, the reliability of financial statements relied on by lenders) have a claim on the plan that a purely shareholder-value view would not give them. The data privacy audit program and the ESG auditing guide are examples of engagements justified partly on this clause.
- The courage argument. Standard 1.3 requires professional courage. When a finding is unwelcome because it embarrasses the organization, the public-interest clause is the reason it still has to be reported. The negotiating findings guide shows how far a function can go before the clause is breached.
- The credibility argument. Regulators and external auditors rely on internal audit’s work. That reliance is only justified if the function serves something beyond the executives who fund it, and the clause is the formal statement that it does. The what regulators expect guide describes how supervisors test that reliance.
A function does not have to write a public-interest policy. It does have to be able to say, if asked at an external assessment, where the clause shows up: in the charter, in the risk assessment criteria, or in the escalation rules. A plausible minimum is one sentence in the charter and one criterion in the risk-assessment scoring model (impact on customers, the public or third parties), which is how the worked example at the end handles it.
Assurance, advice, insight, foresight: four services, not one
The purpose statement names four products. The Standards define only two of them as services (assurance and advisory, in the glossary), which leads some readers to treat insight and foresight as adjectives. They are better read as what the two services should produce, and the plan should be able to show all four.
| Product | What it is | Standards that govern it | Example engagement or output | Share of a typical plan |
|---|---|---|---|---|
| Assurance | An objective assessment against criteria, resulting in a conclusion the board can rely on | Domain V in full; 14.1 to 14.6 on findings and conclusions | A process audit with a rating (procure-to-pay); SOX support; a conformance assessment against a Topical Requirement (third-party) | 60 to 80 percent of hours in most functions |
| Advice | Guidance without assurance and without taking on management responsibility; scope agreed with the stakeholder | Glossary definition of advisory services; Standard 9.4 (advisory in the plan); 2.3 (objectivity safeguards); 13.1 (engagement objectives) | Pre-implementation review of a new system; facilitation of a risk and control self-assessment; comments on a draft policy | 10 to 25 percent; higher in young organizations |
| Insight | What the organization learns from the function’s cross-engagement view: patterns, root causes, themes | Standards 11.3 (communicating results to the board), 12.2 (performance measurement), 15.1 (final communication) | An annual themes report: “eleven of fourteen findings this year trace to the same two root causes” (root cause analysis) | A section of every board report, not a separate engagement |
| Foresight | What the function sees coming: emerging risks, control implications of planned change, scenarios | Standard 9.4 (plan considers emerging risks), 9.1 (understanding the organization), 11.3 | A horizon-scanning note to the audit committee; an emerging-risk column in the risk assessment; an advisory review of a change program before go-live | Small in hours, large in board attention; typically one agenda item a quarter |
The word foresight is the one most likely to be challenged by a skeptical executive, because it sounds like prediction. It is not. In Domain I it means the function reports on risks the organization will face because of decisions it has already made or trends already visible: the control implications of a system migration scheduled for next year, the concentration building in a vendor base, the capacity of the close process if a planned acquisition doubles entity count. The fourth-party concentration guide and the pre-IPO SOX readiness plan are foresight engagements in that sense: they describe a future state and what has to be true before it arrives.
Where Domain I shows up: the charter
Standard 6.2 requires an internal audit charter approved by the board, and lists what it must contain: the purpose, the mandate, the position in the organization, the scope, the types of services and the board’s responsibilities toward the function, among other items. The purpose element is where Domain I appears verbatim or nearly so. Three ways to handle it, from weakest to strongest:
- Quote the Definition only. “Internal auditing is an independent, objective assurance and consulting activity designed to add value…” Accurate but dated; it describes the activity rather than the purpose, and omits foresight and the public interest.
- Quote the Domain I purpose statement. The current text, attributed to the Standards. Sufficient for conformance, and the minimum an assessor will expect after January 2025.
- Quote the statement and localize it. The current text, followed by one paragraph that says what “value”, “the board” and “the public interest” mean in this organization: for a hospital system, patient safety and regulatory standing; for a bank, depositor protection and supervisory expectations; for a listed company, the reliability of what investors read. This is what the template below does.
The charter guide covers the remaining 6.2 elements and the approval cycle. What matters for Domain I is that the purpose paragraph be current and be the organization’s own: a charter is a mandate from the board, and a purpose the board has read, discussed and approved is worth more than one pasted from a template.
Where Domain I shows up: the external assessment
An external quality assessment under Standard 8.4 is performed at least once every five years and concludes on conformance with the Standards. Because Domain I has no requirements, an assessor cannot rate it conformant or nonconformant. What assessors do instead is use Domain I as the frame for the overall opinion. The patterns that recur in assessment reports:
| What the assessor observes | Which Domain I element it touches | Where the finding lands | Typical wording in the report |
|---|---|---|---|
| Plan built on rotation, not on risk to objectives | “Successful achievement of its objectives”; “risk-based” | Standard 9.4 partial conformance | “The plan is comprehensive in coverage but does not demonstrate linkage to the organization’s strategic objectives” |
| No advisory work, foresight or insight reporting | “Assurance, advice, insight, and foresight” | Standards 9.2 (strategy) and 11.3 (board communication); usually an improvement opportunity rather than nonconformance | “The function’s services are limited to assurance; the strategy does not address how advice, insight and foresight will be delivered” |
| Functional reporting to the CFO, administrative to the CEO | Condition 2 (independently positioned, direct accountability to the board) | Standard 7.1 nonconformance; a Domain III essential condition unmet | “Organizational independence is impaired; the chief audit executive does not report functionally to the board” |
| Public interest absent from charter, strategy and risk criteria | “Ability to serve the public interest” | Observation, not a rated nonconformance | “The function has not considered how the public-interest expectations in Domain I apply to its scope” |
| Reports state conformance with no external assessment on file | Condition 1 (competent professionals conforming with the Standards) | Standard 8.4 and 12.1; the conformance statement must be removed from reports | “The function may not state that its work conforms with the Standards until an external assessment supports the statement” |
Functions preparing for a first or next assessment should read the EQA preparation guide and build the evidence file described in the QAIP documentation kit. For Domain I specifically, the evidence is modest: the current charter, the strategy under Standard 9.2, the risk assessment criteria, and the last two board reports, each showing the purpose at work.
Where Domain I shows up: board reporting and the strategy
Standard 9.2 requires the chief audit executive to develop a strategy for the function that supports the organization’s strategic objectives and is aligned with the expectations of the board and senior management. Domain I is the natural opening of that strategy document: it states the purpose, and the strategy says how this function will fulfill it over the next three to five years. Standard 11.3 requires the chief audit executive to communicate the results of the function’s work to the board, including the function’s assessment of the effectiveness of governance, risk management and control processes. That assessment is Domain I’s “insight” product delivered on a schedule.
A board report structured around Domain I has a recognizable shape. It opens with the function’s overall conclusion on the state of risk management, not with a list of engagements. It separates assurance results (ratings, findings, status of actions) from advice (what the function was asked to help with), from insight (themes and root causes across the period) and from foresight (what is coming and whether the organization is ready). It names the risks the board has accepted against the function’s advice, as Standard 11.5 requires. And it closes with the function’s own performance against the measures set under Standard 12.2. The presenting to the audit committee guide covers the delivery; the deck template covers the slides.
Five misreadings of Domain I
Because Domain I is short and has no requirements, it gets read quickly and misread often. Five misreadings recur in charters, in training material and in conversations with executives.
| Misreading | Why it is wrong | The correction |
|---|---|---|
| “Domain I has no requirements, so it can be skipped” | The requirements in Domains II to V are interpreted in light of the purpose; an assessor’s overall opinion is framed by it | Treat Domain I as the test of whether the function’s plan and strategy make sense, not as a preface |
| “Create value means internal audit should be a consulting function” | Value creation is one of three verbs and is delivered through assurance as much as advice; advisory work is still bounded by the objectivity safeguards in Standard 2.3 and the independence rules in Domain III | Keep advisory work inside the plan, subject to the same risk assessment, and never let the function take on management responsibility |
| “Foresight means internal audit predicts risks” | Foresight in Domain I is about the consequences of visible decisions and trends, reported early enough to act on | Build an emerging-risk column into the risk assessment and report it quarterly; do not forecast |
| “The public interest clause makes auditors whistleblowers” | The clause is about the organization’s ability to serve the public interest, which internal auditing enhances; it does not create an external reporting duty | Use the clause to justify scope and to support professional courage within the organization’s own escalation routes |
| “Management is a client, so management can direct the plan” | Management is a recipient of assurance and advice; the plan is approved by the board under Standard 9.4, and the board must be told of scope limitations | Take management’s input to the risk assessment; take the plan to the board |
A Domain I self-check for the function
Twelve questions, each answerable yes or no with a document reference. A function that can answer yes to ten or more has its purpose in order; fewer than seven means the strategy and charter need a rewrite before the next assessment. The Self-Assessment Hub carries a fuller Standards readiness assessment covering all fifteen principles.
| # | Question | Evidence that answers it |
|---|---|---|
| 1 | Does the charter state the current Domain I purpose, approved by the board after January 2025? | Charter, board minutes |
| 2 | Does the charter say what value, the board and the public interest mean for this organization? | Charter purpose paragraph |
| 3 | Does the strategy under Standard 9.2 open with the purpose and say how each of the four products will be delivered? | Strategy document |
| 4 | Can every engagement in the plan be traced to a risk to a stated organizational objective? | Risk assessment, plan with objective column (risk assessment playbook) |
| 5 | Does the risk assessment include a criterion for impact on customers, the public or third parties? | Scoring model |
| 6 | Does the plan contain labeled advisory engagements? | Plan |
| 7 | Did the last board report give an overall conclusion on governance, risk management and control, separate from the list of findings? | Board report |
| 8 | Did the last board report contain an insight section (themes, root causes) and a foresight section (emerging risks)? | Board report |
| 9 | Does the CAE report functionally to the board, with the board approving the charter, plan, budget, appointment and remuneration? | Charter, board terms of reference, minutes |
| 10 | Were all accepted risks and scope limitations reported to the board in the period? | Standard 11.5 log, board report |
| 11 | Is the function’s conformance statement supported by an external assessment within five years? | EQA report |
| 12 | Has the function escalated at least one unwelcome matter in the last two years, and can it show the trail? | Escalation records |
Template: the purpose paragraph for a charter or strategy
The template quotes the Standards’ purpose statement and then localizes it in four sentences. Replace the bracketed text; keep the quoted sentence intact and attributed, because an assessor will compare it with the source.
Purpose. The Global Internal Audit Standards state that internal auditing strengthens the organization’s ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight. At [organization], value means [the ability to deliver safe products to customers, to meet the expectations of our regulators and lenders, and to execute the strategy approved by the board]. The board, for the purposes of this charter, is [the audit committee of the board of directors]. The public interest, for the purposes of this charter, includes [the interests of customers, depositors, patients, employees and the communities we operate in], and the internal audit function will give weight to those interests when assessing risk and when deciding what to report. The function provides four kinds of service: assurance on the effectiveness of governance, risk management and control processes; advice to management on request, within the limits set by the objectivity safeguards in this charter; insight on patterns and root causes across its work; and foresight on risks arising from planned change and emerging conditions.
Two drafting notes. The bracketed definition of “the board” should match the body that actually exercises the Domain III essential conditions; in a subsidiary that may be a parent-company committee, and the charter should say so. And the public-interest sentence should name groups the organization genuinely affects; a list copied from another organization’s charter reads as decoration and will be challenged.
Worked example: MidState Beverage rewrites its charter around the purpose
MidState Beverage is a three-state drinks distributor with twelve depots, about 1,400 employees, $221 million in revenue and a six-person internal audit function led by a chief audit executive who reports to the audit committee. Its charter dated from 2019 and had been rewritten in June 2026 as part of the function’s preparation for a first external quality assessment in FY28, described in the Domain III guide. The 2019 charter’s purpose section quoted the 2017 Mission and the Definition of Internal Auditing. The audit committee chair, reading the draft, asked a question the function had not prepared for: what does “the public interest” mean for a privately held beverage distributor?
The chief audit executive’s answer took the form of the localized purpose paragraph above. For MidState, the public interest was defined as the interests of its roughly 4,200 cash and check customers (small retailers who depend on accurate statements), its 300 route drivers (whose safety depends on the fleet and hours controls the function had begun to audit), and the state regulators who license alcohol distribution. That definition then did three pieces of work. In the risk assessment, a sixth scoring criterion was added, “impact on customers, drivers or regulators”, weighted at 15 of 100 points; it moved the fleet and DOT compliance engagement, previously an advisory item, into the FY28 plan as the function’s first assurance engagement on that subject. In the strategy under Standard 9.2, the four products were given explicit shares: assurance 70 percent of hours, advisory 15 percent, with insight and foresight delivered through the board report rather than through separate engagements. And in the board report, a new opening section gave the function’s overall conclusion on risk management for the year, followed by an insight paragraph noting that nine of the year’s fourteen findings traced to two root causes, depot-level controls not redesigned after the 2013 ERP implementation and the two unintegrated acquisitions, and a foresight paragraph on the control implications of the audit management system the function was about to buy.
| Domain I element | Before (2019 charter) | After (June 2026 charter and FY28 strategy) |
|---|---|---|
| Purpose statement | 2017 Mission and Definition quoted | Domain I statement quoted and localized in four sentences |
| Value | Undefined | Accurate customer statements, driver safety, regulatory standing, strategy execution |
| The board | “The audit committee” | “The audit committee of the board of directors”, with the committee’s Domain III responsibilities listed in a schedule |
| Public interest | Absent | Customers, drivers, state regulators; sixth risk criterion at 15 points |
| Four products | Assurance and consulting mentioned | Assurance 70 percent, advisory 15 percent, insight and foresight in every board report |
| Board report | List of completed engagements and open actions | Overall conclusion, then assurance, advice, insight, foresight, accepted risks (11.5), function performance (12.2) |
The committee approved the charter in June 2026. The function’s own Domain I self-check moved from four yes answers to eleven; the one remaining no was question 11, the external assessment, scheduled for FY28. The cost of the exercise was about twenty hours of the chief audit executive’s time and one committee discussion, which is a reasonable price for a purpose the board has now read and owns.
Questions about Domain I
Is Domain I mandatory?
Domain I is part of the Standards and the Standards are mandatory for IIA members and for any function that claims conformance, but Domain I contains no requirements that can be tested individually. Conformance is assessed against the standards in Domains II to V. Domain I governs how those standards are read and is the frame for the assessor’s overall opinion.
Does the Definition of Internal Auditing still exist?
Yes. It is retained in the Standards’ glossary, with “advisory” added alongside “consulting”. It is no longer the headline statement; the Domain I purpose statement sits above it. Charters may quote both, but the purpose statement is the one an assessor expects to see.
What happened to the ten Core Principles?
They were converted into the fifteen principles that head Domains II to V, each now carrying standards with requirements. The IPPF-to-GIAS mapping table shows where each of the ten went; for example, “aligns with the strategies, objectives, and risks of the organization” became Principle 9, Plan Strategically, in Domain IV.
What is the difference between insight and foresight?
Insight looks across work already done and reports what it means: patterns, themes, root causes, the overall state of risk management. Foresight looks at decisions already made and trends already visible and reports their consequences before they arrive: the control implications of a migration, a growing concentration, a capacity constraint. Neither is prediction.
How should a small function handle the public-interest clause?
With one sentence in the charter naming the groups outside the organization whose interests the function will weigh, and one criterion in the risk assessment that scores impact on those groups. That is enough to show the clause was considered, which is what an assessor is looking for; a separate policy is unnecessary.
Can a function report to the CFO and still meet Domain I?
Administratively, yes; functionally, no. Domain I’s second condition is direct accountability to the board, and Standard 7.1 makes functional reporting to the board a requirement. A chief audit executive may report to the CEO or CFO for administrative purposes, but the board must approve the charter, plan, budget and the CAE’s appointment, removal and remuneration, and must receive the function’s communications directly.
Where does Domain I appear on the CIA exam?
Part 1 of the 2025 syllabus covers the Standards’ foundations, including the purpose of internal auditing, the Definition and the structure of the domains. Candidates should be able to recite the purpose statement’s four products and three conditions and explain what replaced the Mission and Core Principles. The CIA exam guide and the practice question bank cover it.
Related guides
- The Global Internal Audit Standards: a complete reference map — all five domains, fifteen principles and fifty-two standards on one page.
- GIAS Domain II: Ethics and Professionalism — the thirteen standards that make condition 1 and condition 3 real.
- GIAS Domain III: Governing the Internal Audit Function — the board’s responsibilities and the essential conditions behind condition 2.
- GIAS Domain IV: Managing the Internal Audit Function — the strategy, plan, resources and communication standards where the purpose is delivered.
- GIAS Domain V: Performing Internal Audit Services — the engagement standards that produce assurance.
- IPPF to GIAS mapping table — where the Mission, Definition and Core Principles went.
- History of the IIA Standards — 1947 to GIAS 2024 and the Topical Requirements.
- GIAS 2024: what changed — the update at document level.
- How to create an internal audit charter — the remaining Standard 6.2 elements.
- Independence and objectivity in internal audit — the reporting-line cases behind condition 2.
- Assurance vs advisory — the two services and their boundaries.
- Building a QAIP from scratch — the quality program that supports a conformance statement.
- Preparing for an external quality assessment — what assessors test, including the Domain I frame.
- The annual internal audit risk assessment — linking the plan to objectives.
- Presenting to the audit committee — delivering insight and foresight to the board.
- Your first 90 days as chief audit executive — negotiating the reporting line Domain I assumes.
- The Three Lines Model explained — roles, principles and the critics.
- What is a chief audit executive — the role, the reporting lines, the first year.
- Types of Internal Audits: 15 Kinds Explained and Compared — fifteen types compared by criteria, evidence, output and when to use each
- Yellow Book vs IIA Standards: GAGAS Mapped for Auditors — GAGAS mapped against the Global Internal Audit Standards.
Leave a Reply