An internal audit methodology manual is the document that tells a function’s auditors how work is done here: how the plan is built, how an engagement is planned, performed, documented, reviewed and reported, how findings are rated, how issues are tracked, and how the function checks its own quality. The Global Internal Audit Standards require it without using the word: Standard 9.3, Methodologies, says the chief audit executive must establish methodologies to guide the internal audit function in conformance with the Standards, in the form of policies, processes and procedures, and must update them as needed. A manual is simply the usual container. A function without one is relying on its auditors to remember how things are done, which an external assessor will test by asking two auditors the same question.
This guide gives a twelve-chapter outline for the manual, with each chapter mapped to the standards it implements and the templates it should reference, and sets a target length for each, because the most common failure is a 300-page manual that nobody opens. It covers what belongs in appendices rather than chapters, the version-control and approval pages an assessor will look for, how the manual relates to the charter and the quality program, and the mistakes that make manuals unread. It ends with a worked example of a six-person function rewriting its 2019 manual for the 2024 Standards using the site’s IPPF-to-GIAS mapping table. The reference map of the Standards is the companion for the chapter mapping.
In this guide
- What the manual is, and what Standard 9.3 requires
- Charter, manual, quality program: three documents, three jobs
- Six principles for a manual people use
- The twelve-chapter outline, mapped to GIAS
- What each chapter must settle
- Appendices: templates, scales and checklists
- Front matter: version control, approval, scope
- What to keep out of the manual
- Maintaining it: triggers, owners, cycle
- Rolling it out: training, attestation, enforcement
- Ten mistakes that make manuals unread
- What an external assessor tests
- Template: the chapter header block
- Worked example: MidState Beverage rewrites its 2019 manual
- Questions about methodology manuals
- Related guides
What the manual is, and what Standard 9.3 requires
Standard 9.3 sits in Domain IV under Principle 9, Plan Strategically. Its requirement is that the chief audit executive establish methodologies in the form of policies, processes and procedures to guide the function in conformance with the Standards, and that the methodologies be updated as needed. The considerations for implementation describe what the methodologies should address: the function’s approach to planning, performing and communicating engagements, the documentation it keeps, the tools it uses, and how it coordinates with other assurance providers. They also say the methodologies should be made available to all internal auditors, and that the chief audit executive should confirm auditors understand and apply them.
Three features of the requirement shape the manual. It is the chief audit executive’s document, approved within the function, not a board document; the board approves the charter, not the manual. It must conform with the Standards, which means every methodology in it should be traceable to a standard or be a deliberate addition. And it must be updated as needed, which makes the version-control page and the review trigger list part of conformance, not administrative extras.
| Term | What it means in the manual | Example |
|---|---|---|
| Policy | A rule the function has adopted; states what must happen | “Every finding is rated using the four-level severity scale in Appendix C before the draft report is issued” |
| Process | The sequence of steps that produce an outcome, with roles | The engagement lifecycle from planning memo to validated closure |
| Procedure | How a specific step is performed, in enough detail to be repeated | How to document a sample selection, including the seed and the population reconciliation |
| Template | A standard document shell the procedure uses | The planning memo, the work program, the report shells |
| Guidance | Advice that helps judgment without binding it | Benchmarks for engagement hours by type; examples of well-written conditions |
Charter, manual, quality program: three documents, three jobs
Functions sometimes try to make one document do three jobs. The charter is the board’s mandate to the function (Standard 6.2): purpose, authority, position, scope, services, the board’s responsibilities. The manual is the function’s instruction to its auditors: how the mandate is executed. The quality assurance and improvement program (Standard 8.3) is the function’s check on itself: internal assessments, external assessment, performance measurement, and the actions taken on what they find. Keeping the three separate keeps each one short and keeps approvals in the right place.
| Document | Standard | Approved by | Audience | Changes when | Length that works |
|---|---|---|---|---|---|
| Charter | 6.2 | The board | Board, senior management, auditors, external parties | Mandate, reporting line, scope or services change; reviewed annually | 4 to 8 pages (charter guide) |
| Methodology manual | 9.3 | Chief audit executive | Auditors; shared with the audit committee on request | Standards, tools, rating scales or process change; reviewed annually | 40 to 80 pages plus appendices |
| QAIP | 8.3, 8.4, 12.1, 12.2 | Chief audit executive; results to the board | Auditors, board, external assessor | After each assessment; annually | 10 to 20 pages plus the evidence file (QAIP playbook) |
Six principles for a manual people use
- Write rules, not restatements. The Standards already say what must be done; the manual says how this function does it. A chapter that paraphrases Standard 13.3 is wasted; a chapter that says “the planning memo in Appendix A is completed and approved by the audit manager before fieldwork, and here is the risk assessment scale we use” is the manual’s job.
- One decision per paragraph. Auditors look things up; they do not read manuals cover to cover. Each paragraph should answer one question an auditor would type into a search box.
- Map every chapter to the standards it implements. A header block (template below) lists them. The mapping is what makes the manual auditable against the Standards and what lets you update it when a standard changes.
- Put the judgment calls in writing. How many deviations fail a test, when a walkthrough is enough, when an engagement is rated Unsatisfactory: these are the questions new auditors ask and senior auditors answer differently. The manual exists to settle them.
- Templates in appendices, rules in chapters. Chapters change rarely; templates change often. Separating them lets you reissue an appendix without reissuing the manual.
- Shorter than you think. Forty to eighty pages of chapters, with appendices as needed. A function of six needs less than a function of sixty, but neither needs three hundred pages.
The twelve-chapter outline, mapped to GIAS
The outline follows the lifecycle of the function’s work: who we are, how we plan, how we perform, how we report, how we follow up, how we check ourselves. The standards column lists the standards each chapter implements; the length column is a target for the chapter text excluding appendices.
| Ch. | Title | Standards implemented | Key contents | Appendices referenced | Pages |
|---|---|---|---|---|---|
| 1 | Purpose, authority and use of this manual | Domain I; 6.1, 6.2, 9.3 | Relationship to the charter; who must follow the manual; how deviations are approved; definitions | Glossary | 3 |
| 2 | Ethics and professional conduct | Domain II: 1.1 to 5.1 | Annual ethics attestation; objectivity declarations per engagement; cooling-off rule for auditing former areas; gifts; confidentiality; professional courage escalation route | Attestation form; objectivity declaration | 5 |
| 3 | Organization, roles and competency | 7.1, 7.2, 10.1, 10.2, 10.3, 3.1, 4.1 | Reporting lines; roles from staff to CAE; competency framework; training minimum; use of co-source and guest auditors; technology resources | Competency matrix; role descriptions | 5 |
| 4 | Strategy, risk assessment and the plan | 9.1, 9.2, 9.4, 9.5 | Audit universe maintenance; risk assessment method and scales; plan construction and approval; mid-year changes; coordination and reliance on other assurance providers | Risk scoring model; plan template; assurance map | 8 |
| 5 | Engagement planning | 13.1 to 13.6; 14.1 (criteria at planning) | Notification; planning memo; engagement risk assessment; objectives, scope, criteria; resource budget; work program approval; communication plan | Planning memo; notification letter; work program; kickoff deck | 8 |
| 6 | Fieldwork and evidence | 14.1, 14.2, 14.6; Topical Requirements | Walkthroughs vs tests; sampling policy and sizes; evidence standards; analytics use; data handling; interviews; exception handling; conformance assessment when a Topical Requirement is triggered | Sampling memo; sample size tables; tick-mark legend; walkthrough template | 10 |
| 7 | Workpapers, review and supervision | 12.3, 14.6, 15.1 | File structure and naming; preparer and reviewer rules; review note protocol; retention; access and confidentiality; electronic workpaper tool rules | File index; review checklist; retention schedule | 6 |
| 8 | Findings, ratings and conclusions | 14.3, 14.4, 14.5 | The five elements of a finding; root cause requirement; severity scale and its calibration rules; engagement rating rule; recommendations vs action plans; management agreement and disagreement | Severity matrix; rating rule; finding template; calibration cases | 7 |
| 9 | Reporting and communication | 11.1 to 11.5; 15.1 | Report structure by engagement type; draft and final cycle with deadlines; closing meeting; distribution; errors and omissions; communicating accepted risks; board reporting content and calendar | Report shells; executive summary rules; distribution matrix | 7 |
| 10 | Issue tracking, validation and escalation | 15.2, 11.5 | Issue log fields; action plan acceptance; validation procedures by severity; extensions; past-due escalation ladder; risk acceptance process | Issue log template; validation checklist; escalation ladder | 5 |
| 11 | Advisory services and special engagements | Glossary (advisory); 2.3; 13.1; 9.4 | When advisory is accepted; objectivity safeguards; scope agreement; documentation lighter than assurance but not absent; investigations and the fraud protocol; reliance on specialists | Advisory engagement letter; fraud allegation protocol | 5 |
| 12 | Quality assurance and improvement | 8.3, 8.4, 12.1, 12.2 | Engagement-level quality reviews; annual self-assessment; external assessment cycle; performance measures; how manual changes are triggered by quality findings | Engagement review checklist; self-assessment workbook; metrics sheet | 5 |
Seventy-four pages of chapters at the targets above, which is the right order of magnitude for a function of ten to forty auditors. A six-person function can cut each chapter by a third; a function of two hundred will add chapters for regional variations, SOX methodology and IT audit specifics, but should still keep the core at this length and push the specifics into supplements.
What each chapter must settle
The outline says what each chapter covers. The table below says what each must decide, because a chapter that describes a topic without deciding anything is the chapter auditors skip. For each, the decision an auditor cannot be left to make alone, and the site guide that works through the options.
| Chapter | The decisions the manual must make | Where the options are worked through |
|---|---|---|
| 2 Ethics | How long an auditor waits before auditing an area they worked in (one year is the common rule); what counts as a gift; who an auditor goes to when pressured to drop a finding | GIAS Domain II; independence and objectivity |
| 4 Plan | The risk scales (impact, likelihood, plus the function’s own factors); how often each tier is audited; who approves a mid-year change; when reliance on second line work is allowed | risk assessment playbook; building the plan; audit universe |
| 5 Planning | What the planning memo must contain before fieldwork starts; who approves the work program; how much time planning gets (a 20/60/20 split between planning, fieldwork and reporting is a common rule) | planning memo template; work program; communication pack |
| 6 Fieldwork | Sample sizes by control frequency; how many deviations fail a test; when a walkthrough is sufficient on its own; what makes evidence sufficient; how analytics results are documented | sample sizes; walkthrough vs test; audit evidence; handling exceptions |
| 7 Workpapers | Who reviews whom; how many days to clear a review note; the file index; retention period; the tick-mark legend | workpaper best practices; review notes; tick marks |
| 8 Findings | The severity matrix and the calibration cases; the rule that converts findings to an engagement rating; whether recommendations or action plans are the default | severity ratings; the five C’s; recommendations |
| 9 Reporting | Days allowed for each stage; who signs the final; the executive summary length; what the board sees quarterly and annually | anatomy of a report; closing meeting; board deck |
| 10 Issues | Which severities are validated by re-testing; the escalation ladder with named recipients; what the risk acceptance record contains | issue validation; risk acceptance; issue log |
| 11 Advisory | The criteria for accepting advisory work; the fraud protocol’s first 48 hours; when specialists are engaged | assurance vs advisory; first 48 hours |
| 12 Quality | Which engagements get a post-engagement review; the self-assessment frequency; the metrics reported | QAIP kit; EQA preparation |
Appendices: templates, scales and checklists
Appendices hold everything that changes more often than the rules: templates, scales, checklists and reference tables. Each appendix carries its own version number so it can be reissued alone. A standard set:
| Appendix | Contents | Chapter it serves | Site template |
|---|---|---|---|
| A | Engagement templates: notification letter, planning memo, work program, kickoff deck, status report | 5 | planning memo, work program, pack |
| B | Sampling: sample size tables by frequency and confidence, the sampling memo, the seed and reproducibility rule | 6 | sampling memo; mySampler |
| C | Severity matrix, engagement rating rule and the calibration case bank | 8 | calibrated matrix |
| D | Report shells: full, short-form, memo, advisory; executive summary rules | 9 | report template set |
| E | Workpaper file index, tick-mark legend, review checklist, retention schedule | 7 | tick marks; workpaper example |
| F | Issue log field definitions, validation checklist, escalation ladder, risk acceptance record | 10 | issue log |
| G | Risk assessment scoring model, audit universe structure, plan template | 4 | plan template; RCM template |
| H | Topical Requirement conformance records (cyber, third-party, organizational behavior, resilience) | 6 | cyber workbook; third-party |
| I | Quality: engagement review checklist, self-assessment workbook, metrics definitions | 12 | QAIP kit |
| J | Fraud allegation protocol and investigation documentation standards | 11 | first 48 hours |
Front matter: version control, approval, scope
The front matter is three pages an assessor reads first. The version-control table lists every issue of the manual with the date, the approver, the chapters changed and the reason. The approval page records the chief audit executive’s sign-off and, where the function chooses, the audit committee’s acknowledgment (not approval; the manual is the CAE’s). The scope statement says who must follow the manual (all internal auditors, co-source staff, guest auditors) and how a deviation is approved (in writing, by the audit manager or CAE, recorded in the engagement file). A manual with no version history is, in an assessor’s eyes, a manual that has never been updated, whatever its content says.
| Version | Date | Approved by | Chapters and appendices changed | Reason |
|---|---|---|---|---|
| 3.0 | 2026-08-01 | CAE | All | Rewrite for the Global Internal Audit Standards (effective 9 January 2025); structure changed from 11 to 12 chapters |
| 3.1 | 2026-09-15 | CAE | Ch. 6, App. H | Third-Party Topical Requirement effective 15 September 2026; conformance record added |
| 3.2 | 2026-11-30 | CAE | App. B, App. E | Audit management system go-live; file index and sampling memo aligned to the system’s fields |
What to keep out of the manual
- The text of the Standards. Reference them by number; do not reproduce them. Reproduction bloats the manual and goes stale when the IIA revises.
- The charter. Reference it. A manual that contains the charter has two documents with different approvers in one binder.
- Audit programs for specific processes. The work program template belongs in Appendix A; the payroll program, the AP program and the IT change program belong in a program library, maintained separately and more often.
- Training material. A manual is a reference, not a course. The first-90-days guide for staff auditors is training; the manual is what it points to.
- Personal names. Roles, not people. Names change and the manual should not.
- Tool user guides. How to use the audit management system is the vendor’s document or a separate internal guide; the manual states the rules the tool must enforce.
- Aspirations. “The function strives for excellence” is not a methodology. Every sentence should be testable: did we do this, or not?
Maintaining it: triggers, owners, cycle
Standard 9.3 requires the methodologies to be updated as needed. “As needed” has to be defined or it means never. Four triggers, an owner and an annual cycle are enough.
| Trigger | Example | What changes | Timing |
|---|---|---|---|
| A standard or Topical Requirement changes or takes effect | Organizational Resilience Topical Requirement effective 30 April 2027 | Chapter 6 and Appendix H | Before the effective date |
| A quality finding | Self-assessment finds walkthroughs undocumented at close (14.6) | Chapter 7 rule and Appendix E checklist | Within the quarter |
| A tool or structure change | Audit management system go-live; co-source arrangement | Chapters 3, 7; Appendices A, E | At go-live |
| A recurring deviation | Three engagements in a year needed a deviation from the sampling policy | The policy itself; deviations that recur are a policy problem | At the annual review |
| Annual review | Every chapter read by its owner; changes consolidated | Any | Fixed month, before the plan is built |
Owner: one person, usually the audit manager, holds the manual and the change log; chapter owners propose; the chief audit executive approves. Changes are communicated at the team meeting, logged, and the attestation (next section) is re-signed when a chapter changes materially.
Rolling it out: training, attestation, enforcement
Standard 9.3’s considerations say the chief audit executive should confirm that auditors understand and apply the methodologies. Three mechanisms do that. A walkthrough of the manual for every new joiner in the first two weeks, with the twelve chapters covered in twelve short sessions rather than one long one. An annual attestation, one page, signed by each auditor, saying they have read the current version and will apply it; it sits with the ethics attestation. And enforcement through the quality review: the engagement review checklist in Appendix I tests conformance with the manual, and a pattern of nonconformance is a performance matter, not a documentation matter. The manual is enforced by the reviewer who sends the workpaper back, not by the page that says it is mandatory.
Ten mistakes that make manuals unread
| Mistake | Why it happens | Fix |
|---|---|---|
| Copying the Standards into the chapters | It feels safe | Reference by number; write the function’s rule |
| No decisions, only descriptions | Avoiding commitment | Each chapter settles the questions in the chapter-detail table |
| Three hundred pages | Every situation anticipated | Core at 40 to 80 pages; the rest in appendices and the program library |
| One monolithic file | Easier to manage, once | Chapters and appendices versioned separately |
| Written by a consultant, never localized | Speed | A borrowed manual is a starting draft; every rule must be the function’s own |
| No version history | Nobody owned it | Name the owner; log every change |
| Templates embedded in chapters | Convenience | Appendices with their own versions |
| Last updated 2019 | The Standards changed and nobody mapped them | Run the clause-by-clause mapping; the worked example shows the hours |
| Not searchable | PDF scanned from print | One question per paragraph; headings that match the questions auditors ask |
| Nobody attests, nobody enforces | Treated as a formality | Annual attestation; quality reviews test against it |
What an external assessor tests
An external quality assessment under Standard 8.4 tests 9.3 in four ways. Existence: is there a documented methodology covering the areas the considerations list? Conformance: does the methodology conform with the Standards, which the assessor tests by sampling chapters against standards (the chapter header block makes this fast)? Currency: is the version history credible, and does the manual reflect the 2024 Standards and the Topical Requirements in effect? Application: do the engagement files follow the manual, which the assessor tests by reading three to five files against the rules? A function can fail the fourth while passing the first three, which is why the quality review in chapter 12 matters more than the manual’s prose. The EQA preparation guide and the QAIP playbook cover the rest of the assessment.
Template: the chapter header block
Every chapter opens with the same block. It makes the manual auditable against the Standards, tells the reader what the chapter decides, and records who owns it.
Chapter 8: Findings, ratings and conclusions. Implements: Standards 14.3 (Evaluate Findings), 14.4 (Recommendations and Action Plans), 14.5 (Engagement Conclusions); supports 15.1. Decides: the elements every finding must contain; the root cause requirement; the four-level severity scale and the calibration cases in Appendix C; the rule that converts findings to the engagement rating; when a recommendation is replaced by management’s action plan; how disagreement is recorded. Appendices: C (severity matrix, rating rule, calibration cases). Owner: Audit manager. Version: 3.0, 2026-08-01. Deviations: require CAE approval in writing, recorded in the engagement file. Related guidance (non-binding): the five C’s masterclass; the finding makeovers.
Worked example: MidState Beverage rewrites its 2019 manual
MidState Beverage’s six-person internal audit function had a methodology manual written in 2019 against the 2017 IPPF: eleven chapters and 168 numbered clauses, 143 of which cited a 2017 standard. When the function mapped it clause by clause to the Global Internal Audit Standards in early 2026, using the IPPF-to-GIAS mapping table, the result was 96 clauses that mapped cleanly, 31 that mapped with a change of substance, 9 that mapped to standards with new requirements the manual did not meet, 7 that had no destination (they cited guidance that no longer exists), and 12 gaps where a 2024 requirement had no clause at all. The mapping took 46 hours of the audit manager’s time plus about 10 hours of the chief audit executive’s review; nine of the twelve gaps were closed within ninety days by adding clauses, and the remaining three (the strategy under 9.2, the performance measures under 12.2 and the escalation of past-due actions under 15.2) became the function’s first three self-assessment partials, described in the Domain IV guide.
The rewrite that followed, issued as version 3.0 on 1 August 2026, restructured the manual into the twelve chapters above. The old manual had been 212 pages, 96 of them reproducing Standards text and templates; the new core is 58 pages with ten appendices. Three decisions the old manual had never made were made: the severity matrix was calibrated with twelve cases drawn from the function’s own findings, the sampling policy adopted the 25/40/60 sizes with a seeded selection rule and mySampler as the tool, and the escalation ladder named the chief audit executive at 30 days past due, the CFO at 60 and the audit committee chair at 90. The Third-Party Topical Requirement, effective 15 September 2026, was added as version 3.1 with a conformance record in Appendix H, and the audit management system the function bought for FY28 triggered version 3.2 when its file index replaced the shared-drive structure.
| Measure | 2019 manual | Version 3.0 (August 2026) |
|---|---|---|
| Basis | 2017 IPPF | Global Internal Audit Standards and Topical Requirements |
| Structure | 11 chapters, 168 clauses, templates inline | 12 chapters, 10 appendices versioned separately |
| Length | 212 pages (96 reproducing Standards and templates) | 58 pages core; appendices about 70 pages |
| Mapping to standards | 143 citations, none to 2024 standards | Header block per chapter; every clause traceable |
| Decisions settled | Severity scale uncalibrated; no sampling policy; no escalation ladder | Twelve calibration cases; 25/40/60 with seeds; named escalation at 30/60/90 days |
| Version history | None (single 2019 issue) | 3.0, 3.1, 3.2 with reasons |
| Attestation | None | Annual, with the ethics attestation |
| Hours | Unknown | Mapping 56; rewrite about 120; rollout 12 sessions |
Questions about methodology manuals
Is a methodology manual required by the Standards?
Methodologies are required by Standard 9.3, in the form of policies, processes and procedures. A manual is the usual way to document them; a well-organized set of separate policy documents also conforms, provided it covers what the standard’s considerations list and is kept current.
Who approves the manual?
The chief audit executive. The board approves the charter (Standard 6.2), not the manual. Some functions share the manual with the audit committee for information or acknowledgment, which is good practice but not a requirement.
How long should it be?
Forty to eighty pages of chapters for most functions, with templates and scales in appendices. A six-person function needs less; a large function adds supplements for specialisms rather than lengthening the core.
Can we buy a manual from a consultant or use an IIA template?
As a starting draft, yes. It conforms with Standard 9.3 only once every rule in it is the function’s own decision, the scales are calibrated to the function’s findings and the templates are the ones actually in use. An assessor reading three engagement files against a borrowed manual finds the mismatch quickly.
How often should it be reviewed?
Annually in full, plus on each trigger: a change in the Standards or a Topical Requirement taking effect, a quality finding, a tool or structure change, or a recurring deviation. The version-control table should show at least one change a year in a living function.
Does a SOX methodology belong in the same manual?
As a supplement, yes, when internal audit performs management’s SOX testing. The supplement implements the PCAOB and SEC requirements the core manual does not, cross-references chapters 6 to 8 for what is shared, and is versioned separately because it changes with the external auditor’s annual expectations.
What is the fastest way to update a pre-2024 manual?
Map every clause to its GIAS destination using the IIA’s two-way mapping (the site’s mapping table reproduces it), classify each clause as clean, changed, new requirement, no destination or gap, close the gaps, then restructure. Budget 40 to 60 hours for the mapping and 100 to 150 for the rewrite in a mid-sized function.
Related guides
- IPPF to GIAS mapping table — the crosswalk and the eight-step manual update procedure.
- The Global Internal Audit Standards reference map — every standard the chapters cite.
- GIAS Domain IV: Managing the function — Standards 9.3, 9.4, 12.2 in context.
- How to create an internal audit charter — the board document the manual sits under.
- Building a QAIP from scratch — chapter 12 and the quality program.
- The QAIP documentation kit — Appendix I’s workbook and metrics sheet.
- Preparing for an external quality assessment — how 9.3 is tested.
- The engagement planning memo template — Appendix A.
- The internal audit work program — Appendix A.
- Audit sample sizes: 25, 40, 60 — Appendix B.
- Finding severity ratings: the calibrated matrix — Appendix C.
- The internal audit report template set — Appendix D.
- Audit workpaper best practices — chapter 7.
- The finding and issue log template — Appendix F.
- IIA Topical Requirements explained — Appendix H and the chapter 6 trigger.
- Your first 90 days as a staff internal auditor — the training the manual is not.
- AI usage policy for internal audit — a model policy, clause by clause.
- Audit fieldwork: the complete guide — from kickoff to closing.
- Monetary unit sampling — the sampling method for overstatement.
- Internal audit KPIs and metrics — measuring the function without gaming it.
- The One-Person Internal Audit Shop: Operating Manual — running a credible function alone: proportionate method, quality without a reviewer, independence and the case for a second person
- The Year-One Internal Audit Plan: What to Audit First — foundation audits, early wins, sizing and sequencing for a new function’s first twelve months, with three example plans
- Types of Internal Audits: 15 Kinds Explained and Compared — fifteen types compared by criteria, evidence, output and when to use each
Leave a Reply