Government internal auditors in the United States work under two sets of standards. The Yellow Book is the common name for Government Auditing Standards, issued by the Comptroller General of the United States through the Government Accountability Office and known by its acronym GAGAS (generally accepted government auditing standards); its 2024 revision applies to audits of periods beginning on or after 15 December 2025, and many public-sector audit organizations are required to follow it by statute, ordinance, charter or the terms of federal funding. The Global Internal Audit Standards, issued by the Institute of Internal Auditors and effective since January 2025, define the internal audit profession and are what a certified internal auditor is examined on. The two agree on most of what matters (independence, competence, evidence, documentation, findings built from criteria and condition, reports that say what was done and what was found) and differ on enough to need a map: how independence is established and documented, how much continuing education is required and in what subjects, how quality is managed and externally reviewed, what a performance audit’s fieldwork and report must include, and how each framework expects to be cited.
This guide maps them: the structure and authority of each, where they coincide, a crosswalk of the Yellow Book’s chapters to the Standards’ domains, independence side by side, CPE and quality compared, performance audit fieldwork and reporting against the Standards’ engagement requirements, how an organization follows both, what the 2024 Yellow Book changed, where the Green Book and the Uniform Guidance fit, and a worked example from Pemberton County’s internal audit office, used in the public-sector examples on this site. The internal audit in government guide covers the environment the standards operate in, the Global Internal Audit Standards guide maps every IIA standard, and the external quality assessment guide covers the IIA side of the external review that GAGAS calls peer review.
In this guide
- Two frameworks: structure and authority
- Who must follow which
- A crosswalk of the Yellow Book’s chapters to the Standards’ domains
- Independence side by side
- Continuing education compared
- Quality management, peer review and external assessment
- Performance audit fieldwork against the engagement standards
- Reporting requirements compared
- Following both at once
- What the 2024 Yellow Book changed
- The Green Book and the Uniform Guidance
- A worked example: Pemberton County’s audit office under both
- Questions about the Yellow Book and the IIA Standards
- Related guides
Two frameworks: structure and authority
The Yellow Book is a government document with the force of law where law adopts it. First issued in 1972 and revised in 1981, 1988, 1994, 2003, 2007, 2011, 2018 and 2024, it is organized in nine chapters: foundation and principles (1), general requirements for complying with GAGAS (2), ethics, independence and professional judgment (3), competence and continuing professional education (4), quality management, engagement quality reviews and peer review (5), standards for financial audits (6), standards for attestation engagements and reviews of financial statements (7), fieldwork standards for performance audits (8) and reporting standards for performance audits (9). It incorporates the AICPA’s auditing and attestation standards for financial audits and attestation engagements and adds requirements of its own; for performance audits (the engagements most like internal audits) it is the complete standard. Requirements are stated as “must” (unconditional) and “should” (presumptively mandatory, departures documented and justified), with application guidance alongside. The Global Internal Audit Standards are a professional body’s standards, mandatory for IIA members and for functions that claim conformance, organized in five domains (purpose; ethics and professionalism; governing the function; managing the function; performing engagements) with fifteen principles and fifty-two standards, each with requirements, considerations for implementation and examples of evidence of conformance, plus Topical Requirements for specific subjects. The Yellow Book is written for any auditor of a government entity or program, external or internal; the Standards are written for an internal audit function and its board.
| Dimension | Yellow Book (GAGAS, 2024 revision) | Global Internal Audit Standards (2024) |
|---|---|---|
| Issuer | Comptroller General of the United States (GAO), with a Comptroller General’s Advisory Council | The Institute of Internal Auditors, through the International Internal Audit Standards Board |
| Authority | Required where statute, regulation, ordinance, charter, contract or funding condition adopts it (federal inspectors general, Single Audits, many state and local audit offices); otherwise voluntary | Mandatory for IIA members and functions claiming conformance; adopted by charter in most functions; referenced by regulators and external assessors |
| Scope of engagements | Financial audits, attestation engagements, reviews of financial statements, performance audits | Assurance and advisory engagements of an internal audit function |
| Structure | Nine chapters; requirements (“must” and “should”) with application guidance | Five domains, fifteen principles, fifty-two standards; requirements, considerations for implementation, examples of evidence; Topical Requirements |
| Effective | 2024 revision: periods beginning on or after 15 December 2025; quality management system designed and implemented by 15 December 2025 and evaluated by 15 December 2026 | 9 January 2025 (published 9 January 2024) |
| Governance model assumed | An audit organization reporting to a legislative body, governing body, elected official or management, with independence assessed by a conceptual framework | A function reporting functionally to a board and administratively to senior management, with Essential Conditions for the board |
| External review | Peer review at least every three years by reviewers external to the organization | External quality assessment at least every five years |
| Citation | Reports state that the engagement was conducted in accordance with GAGAS (or state modified GAGAS compliance with the departures) | Communications may state conformance with the Standards only if the quality program supports it |
Who must follow which
Federal inspectors general follow GAGAS by the Inspector General Act and the quality standards of the Council of the Inspectors General on Integrity and Efficiency; state auditors, legislative auditors and many county and city auditors follow it by statute or charter; auditors performing Single Audits of entities spending federal awards follow it by the Uniform Guidance; and recipients of federal grants often find GAGAS written into the audit requirements of their awards. Internal audit functions inside government agencies, public universities, hospitals, transit authorities and utilities are the mixed case: some are required to follow GAGAS, some follow the IIA Standards by charter, and many follow both because their staff hold IIA certifications, their charters cite the Standards, and their funders or governing bodies cite the Yellow Book. The Yellow Book permits this: its chapter 2 recognizes that auditors may use GAGAS in conjunction with other professional standards (it names the IIA’s standards among them) and may cite both in the report, provided the GAGAS requirements are met. The Standards, for their part, require the function to conform with them where it claims to, and accept that laws and regulations may impose additional requirements. The practical result in most government internal audit shops is a methodology written to GAGAS with the Standards’ governance and management requirements layered on top, which the crosswalk below is designed to support.
A crosswalk of the Yellow Book’s chapters to the Standards’ domains
| Yellow Book | What it requires | Global Internal Audit Standards counterpart | Main difference |
|---|---|---|---|
| Chapter 1: Foundation and principles | Purpose of government auditing; accountability to the public; the role of GAGAS | Domain I: Purpose of internal auditing | GAGAS frames accountability to the public and legislature; the Standards frame value to the organization and its stakeholders |
| Chapter 2: General requirements | Complying with GAGAS; “must” and “should”; using GAGAS with other standards; stating compliance; the engagement types | Standard 4.1 (conformance with the Standards); Standard 15.1 (final communication includes the conformance statement where supported) | GAGAS requires the compliance statement in every report; the Standards permit a conformance statement only when the quality program supports it |
| Chapter 3: Ethics, independence and professional judgment | Ethical principles (public interest, integrity, objectivity, proper use of information and resources, professional behavior); a conceptual framework for independence with threats and safeguards; documentation of independence assessments; professional judgment | Domain II: Ethics and professionalism (Principles 1 to 5: integrity, objectivity, competency, due professional care, confidentiality); Standards 2.1 to 2.3 on objectivity; Standard 7.1 on organizational independence | GAGAS’s independence framework is engagement-level and documented per threat; the Standards establish independence at the function level through the board relationship and address impairments at the engagement level |
| Chapter 4: Competence and CPE | Competence of the engagement team; 80 hours of CPE every two years, 24 in government auditing or the government environment, at least 20 each year; documentation | Principle 3 (competency), Standards 3.1 and 10.2; CIA holders need 40 hours a year (20 for inactive) | GAGAS prescribes hours and subject; the Standards require competency and development without a stated hour count (the IIA’s certification rules supply one) |
| Chapter 5: Quality management, engagement quality reviews and peer review | A system of quality management (risk-based, scalable, with components for governance, ethics, acceptance, engagement performance, resources, information and communication, and monitoring and remediation); optional engagement quality reviews; external peer review at least every three years with a published report | Principle 8 (overseen by the board) Standards 8.3 and 8.4; Principle 12 (enhance quality) Standards 12.1 to 12.3: a quality assurance and improvement program with internal and external assessments, the external one at least every five years | Three-year peer review with a published opinion versus five-year external assessment; GAGAS’s system of quality management is modeled on the AICPA’s and is more prescriptive |
| Chapters 6 and 7: Financial audits; attestation engagements and reviews | AICPA standards incorporated plus GAGAS additions (reporting on internal control and compliance; findings; views of responsible officials; fraud, waste and abuse) | No direct counterpart; internal auditors rarely opine on financial statements | Not applicable to most internal audit work |
| Chapter 8: Fieldwork standards for performance audits | Reasonable assurance; significance; planning (objectives, scope, methodology, criteria, risk, fraud, internal control, information systems, provisions of law, previous work); supervision; evidence (sufficient, appropriate); findings elements (criteria, condition, cause, effect); documentation | Domain V: Performing engagements (Principles 13 to 15): planning (13.1 to 13.6), conducting (14.1 to 14.6), communicating (15.1 to 15.2) | Close alignment; GAGAS is more specific about assessing internal control when significant to the objectives, about information systems controls and about documenting the evidence standard |
| Chapter 9: Reporting standards for performance audits | Report content (objectives, scope, methodology, results, conclusions, recommendations, the GAGAS compliance statement, internal control and compliance deficiencies, fraud, waste and abuse, views of responsible officials); report quality elements; distribution | Standard 15.1 (final communication: objectives, scope, recommendations and action plans, conclusions; conformance statement) and 15.2 (confirming implementation) | GAGAS requires the methodology section, the compliance statement and the responsible officials’ views in the report itself; the Standards leave form to the function’s methodology |
| No GAGAS counterpart | — | Domain III (governing: mandate, charter, board responsibilities, independence, CAE qualifications, board interaction, resources, quality oversight) and Domain IV (managing: strategy, risk-based plan, resources, methodologies, coordination, reporting to the board) | The Standards govern the function as an organization; GAGAS governs engagements and the audit organization’s quality system but not its mandate or strategy |
Independence side by side
Both frameworks require independence of mind and in appearance; they build it differently. The Yellow Book uses a conceptual framework: for each engagement, the auditor identifies threats to independence (self-interest, self-review, bias, familiarity, undue influence, management participation, and structural threats from the audit organization’s placement within the entity), evaluates their significance, applies safeguards to reduce them to an acceptable level or declines the engagement, and documents the evaluation. Nonaudit services (preparing accounting records, designing systems, performing management functions) are a particular focus, with some prohibited outright and others permitted only with safeguards and management’s acceptance of responsibility. For audit organizations inside government entities, GAGAS addresses the structural threat directly: an internal audit organization can be considered organizationally independent for reporting externally if its head reports to and is accountable to a legislative or governing body, or is appointed and removable by such a body, or has statutory protections of that kind, and the audit organization’s placement and reporting are documented. The Standards establish organizational independence at the function level through the board relationship (Standard 7.1: functional reporting to the board, including approval of the charter and plan, the appointment and removal of the chief audit executive, and private sessions) and handle engagement-level objectivity through Standards 2.1 to 2.3 (impairments disclosed, cooling-off for areas of prior responsibility, safeguards for advisory work), with the chief audit executive confirming independence to the board annually. A government function following both documents the GAGAS threat evaluation on every engagement and the Standards’ functional reporting arrangement in its charter; where the head of audit is appointed by a council or board and removable only by it, the two frameworks reach the same conclusion by different routes.
| Independence element | Yellow Book | Global Internal Audit Standards |
|---|---|---|
| Level at which independence is established | The audit organization (structural) and each engagement (conceptual framework) | The function (organizational independence via the board) and each engagement (objectivity) |
| Method | Identify threats, evaluate significance, apply safeguards, document | Charter and reporting lines approved by the board; impairments disclosed and managed; annual confirmation |
| Threat categories | Self-interest, self-review, bias, familiarity, undue influence, management participation, structural | Impairments to objectivity (personal, external, prior responsibility); independence interference |
| Nonaudit or advisory services | Some prohibited; others permitted with safeguards and management’s acknowledgment of responsibility; documented | Advisory permitted where it does not impair; disclosed; identified as advisory |
| Internal audit organizations in government | Considered independent for external reporting when the head reports to and is removable by a legislative or governing body, or has equivalent statutory protection | Independence rests on functional reporting to the board with the listed responsibilities |
| Documentation | Threat evaluation and safeguards documented for each engagement | Charter; annual confirmation to the board; engagement-level disclosures |
| Cooling-off | Addressed through the self-review and management participation threats | Common practice of twelve months for areas of prior responsibility |
Continuing education compared
The Yellow Book prescribes continuing professional education in hours and subject: auditors who plan, direct, perform or report on GAGAS engagements complete at least 80 hours every two years, of which at least 24 hours are in subjects directly related to government auditing, the government environment or the specific environment of the audited entity, with at least 20 hours in each year of the period; the audit organization tracks and documents compliance and may exempt auditors who charge less than a threshold of time to GAGAS work from the 56-hour portion. The Standards require competency (Principle 3 and Standard 3.1) and the chief audit executive’s responsibility for the function’s development (Standard 10.2) without a stated hour count; the hours come from certification rules, with the Certified Internal Auditor requiring 40 hours a year (including ethics), the CISA 20 a year and 120 per three years, and the CFE 20 a year. A government auditor with a CIA working on GAGAS engagements satisfies both by planning 40 hours a year of which 12 or more are government-specific, and the function’s training records should show the GAGAS subject classification, which IIA tracking alone does not. The CIA CPE requirements guide covers the IIA side.
Quality management, peer review and external assessment
Quality is where the 2024 Yellow Book moved furthest. Chapter 5 replaces quality control with a system of quality management modeled on the AICPA’s: the audit organization establishes quality objectives, identifies and assesses quality risks, designs and implements responses, and monitors and remediates, across components covering governance and leadership, ethics and independence, acceptance and continuance of engagements, engagement performance, resources, information and communication, and monitoring; the system must be designed and implemented by 15 December 2025 and evaluated by 15 December 2026, with an annual evaluation thereafter. Engagement quality reviews (a second-partner-style review before the report is issued) are optional. External peer review continues at least every three years by reviewers independent of the organization (through programs run by ALGA for local government auditors, NASACT for state auditors, CIGIE for inspectors general, and the AICPA for firms), with a written report and a rating (pass, pass with deficiencies, fail) that the organization must make public and provide to those contracting for or overseeing its work. The Standards require a quality assurance and improvement program (Standard 12.1) with internal assessments (ongoing monitoring and periodic self-assessment) and an external quality assessment at least every five years (Standard 8.4) by a qualified independent assessor or team, which may take the form of a self-assessment with independent validation; results go to the board. An organization following both runs one quality system that satisfies the more demanding element of each: the GAGAS system of quality management as the structure, with the Standards’ conformance assessment built into its monitoring; a triennial peer review that is scoped to cover the Standards as well (ALGA’s program accommodates this), so that one external review serves both frameworks; and board reporting that satisfies Standards 8.3 and 8.4. The QAIP playbook guide covers the IIA program and the external quality assessment guide the five-year review.
| Quality element | Yellow Book 2024 | Global Internal Audit Standards | Following both |
|---|---|---|---|
| Internal system | System of quality management: objectives, risks, responses, monitoring and remediation across defined components; annual evaluation | Quality assurance and improvement program: ongoing monitoring, periodic self-assessment, performance measurement | One system built on the GAGAS structure with Standards conformance as a quality objective |
| Pre-issuance review | Engagement quality review optional | Supervision and review required (Standard 12.3) | Supervisory review on every engagement; EQR on high-risk reports |
| External review frequency | At least every three years | At least every five years | Three years |
| Who reviews | Reviewers external to the organization through a recognized program | Qualified independent assessor or team; self-assessment with independent validation permitted | A peer review team qualified in both frameworks |
| Output | Written report with a rating (pass, pass with deficiencies, fail), made public | Report of conformance to the board; the function may then state conformance | One report addressing both; published as GAGAS requires; presented to the board as the Standards require |
| Consequence of failure | Cannot state GAGAS compliance; funders and oversight bodies informed | Cannot state conformance; action plan to the board | Both |
Performance audit fieldwork against the engagement standards
A GAGAS performance audit and an IIA assurance engagement are the same kind of work, and chapter 8 of the Yellow Book reads much like Domain V of the Standards with more specificity. Both require planning that defines objectives, scope and methodology and assesses risk; GAGAS adds explicit requirements to assess internal control when it is significant to the objectives (using the Green Book’s components as the frame), to assess information systems controls when they are significant, to identify provisions of laws, regulations, contracts and grant agreements significant to the objectives, to assess fraud risk and to consider previous audits and attestation engagements. Both require sufficient, appropriate evidence; GAGAS defines the terms (sufficiency as quantity, appropriateness as relevance, validity and reliability) and requires the auditor to assess and document the overall sufficiency and appropriateness of the evidence in relation to the findings. Both require findings to be developed from criteria and condition; GAGAS names the four elements (criteria, condition, cause, effect) and requires them to the extent necessary to achieve the objectives, which is the origin of the 5 Cs structure internal auditors use. Both require supervision and documentation sufficient for an experienced auditor to understand the work; GAGAS adds that documentation must support the report before it is issued and be retained, and requires documentation of departures from “should” requirements. The fieldwork and audit evidence guides cover the practice both frameworks describe.
Reporting requirements compared
| Report element | Yellow Book (chapter 9) | Global Internal Audit Standards (15.1) |
|---|---|---|
| Objectives, scope and methodology | Required, with the methodology described in enough detail to understand the evidence and its limitations | Objectives and scope required; methodology at the function’s discretion |
| Results and findings | Findings with their elements; conclusions; recommendations where appropriate; significant internal control deficiencies, noncompliance, fraud, waste and abuse reported | Findings, conclusions and recommendations or action plans; significance stated |
| Compliance or conformance statement | Required: “conducted in accordance with GAGAS” or a modified statement naming departures | Permitted only when the quality program supports it; omitted otherwise |
| Views of responsible officials | Required: management’s written or oral comments and the auditor’s evaluation of them included in the report | Management’s action plans and, where applicable, acceptance of risk; the function’s methodology decides presentation |
| Confidential or sensitive information | Omission permitted with disclosure of the omission and the reason; a separate restricted report where needed | Addressed through the function’s policies and the board |
| Report quality | Accurate, objective, complete, convincing, clear, concise, timely | Accurate, objective, clear, concise, constructive, complete, timely (Standard 11.2) |
| Distribution | To those charged with governance, officials with oversight, those responsible for action, and others authorized; public availability common in government | To the parties the methodology defines; the board receives engagement results |
| Follow-up | Previous recommendations’ status considered in planning; follow-up reporting a common practice | Standard 15.2: confirm implementation or management’s acceptance of risk |
The practical difference is the report’s shape: a GAGAS report carries a methodology section, a compliance statement and a responsible officials’ section that an IIA-style internal audit report may not, and government readers expect them. Functions following both adopt the GAGAS form as their report template and add the Standards’ conformance statement where their quality program supports it. The anatomy of an internal audit report and report examples guides show the IIA form; the evaluating management responses guide covers the responsible officials’ views from the auditor’s side.
Following both at once
An audit organization can follow both frameworks without duplicating anything, if it designs for it. The charter cites both, records the functional reporting arrangement the Standards require and the organizational placement GAGAS requires, and states which engagements are performed under GAGAS (performance audits and any attestation work) and which under the Standards alone (advisory engagements, which GAGAS does not cover as such). The methodology manual is written to GAGAS chapter 8 and 9 for performance audits, with the Standards’ Domain V requirements cross-referenced, so that one set of planning, evidence, documentation and reporting procedures satisfies both; the methodology manual guide gives the structure. Independence is documented at both levels: the GAGAS threat evaluation on each engagement and the Standards’ annual confirmation to the board. CPE is tracked with the GAGAS subject classification. The quality system is one system built on GAGAS chapter 5 with Standards conformance as a quality objective, and the triennial peer review is scoped to both. Reports use the GAGAS form and add the Standards’ conformance statement. The strategy, risk-based plan, resource statement and board reporting of Domain IV are performed because the Standards require them, and they make the GAGAS work better organized. The IPPF to GIAS mapping guide shows the method for mapping a manual to a new standard, which transfers directly to mapping it to two.
What the 2024 Yellow Book changed
GAO issued the 2024 revision (GAO-24-106786) on 1 February 2024, superseding the 2018 revision and its April 2021 technical update. The main change is chapter 5: quality control became quality management, with the risk-based system described above replacing the quality control policies and procedures of the 2018 edition, optional engagement quality reviews introduced, and monitoring made more proactive and tailored; the deadlines (design and implement by 15 December 2025, evaluate by 15 December 2026) arrived during the period this guide was written. Chapter 6 added application guidance on key audit matters for financial audits of government entities. The effective dates for engagements are periods beginning on or after 15 December 2025 for financial audits, attestation engagements, reviews and performance audits, with early implementation permitted. For an internal audit organization, the work in 2025 and 2026 is the quality system: documenting quality objectives and risks, mapping existing procedures to the components, filling gaps (acceptance and continuance decisions, which many internal audit shops never documented; information and communication about quality), and preparing for the first annual evaluation, which the next peer review will test.
The Green Book and the Uniform Guidance
Two other federal documents sit beside the Yellow Book in a government auditor’s library. The Green Book, GAO’s Standards for Internal Control in the Federal Government, is the internal control framework federal agencies must follow and many state and local governments adopt; it adapts COSO’s five components and seventeen principles to government, and the 2025 revision (GAO-25-107721, May 2025, effective for fiscal year 2026) added requirements on fraud risk management, improper payments, information security risk, preventive controls and documentation of risk assessments. GAGAS performance audits assess internal control against the Green Book where control is significant to the objectives, which makes it the criteria document for most control findings in government, in the way COSO is for corporate internal audit (the COSO framework and 17 principles guides cover the corporate version). The Uniform Guidance (2 CFR 200) governs federal grants: its 2024 revision, effective for awards from 1 October 2024, raised the Single Audit threshold from $750,000 to $1,000,000 of federal expenditures in a fiscal year, raised the equipment capitalization threshold to $10,000 and the de minimis indirect cost rate to 15 percent; Single Audits are GAGAS engagements, and internal auditors at grant recipients audit grant compliance against the Uniform Guidance’s requirements (allowable costs, procurement, subrecipient monitoring, reporting) as a standing part of their universe. The higher education and nonprofits guide covers the grant environment where these rules bite hardest.
A worked example: Pemberton County’s audit office under both
Pemberton County, the county government of about 480,000 residents with a $1.6 billion annual budget and 4,200 employees used in the public-sector examples on this site, created its Office of Internal Audit by ordinance in 2014. The county auditor is appointed by the board of county commissioners for a five-year term and removable only by a supermajority vote, reports functionally to the board’s audit committee (three commissioners and two public members with financial expertise) and administratively to the county administrator for budget and personnel matters, and leads a staff of nine, six of whom hold the CIA, CPA or CFE. The ordinance requires GAGAS; the charter, revised in 2025 for the 2024 Standards, cites both frameworks and designates performance audits as GAGAS engagements and advisory work as Standards-only. The office’s methodology was mapped to both in 2025, and its triennial ALGA peer review in 2026 was scoped to GAGAS with the Standards’ Domain III and IV added at the office’s request.
| Area | How Pemberton County satisfies both | 2026 peer review result |
|---|---|---|
| Independence | Ordinance appointment and removal protections documented as the GAGAS structural safeguard; functional reporting to the audit committee documented in the charter per Standard 7.1; a threat evaluation form completed and reviewed on every engagement; annual independence confirmation to the committee | No deficiencies; the reviewers cited the engagement-level documentation as a strength |
| CPE | Each auditor plans 40 hours a year (CIA requirement) with at least 12 classified as government-specific; the office tracks the GAGAS two-year totals and subject split | All nine met the 80/24/20 requirements; two had documented the subject classification late |
| Quality system | System of quality management built in 2025 on GAGAS chapter 5 with quality objectives including Standards conformance; supervisory review on every engagement; engagement quality review on reports rated High or going to the full board; annual self-assessment against both frameworks; first annual evaluation completed in late 2026 | Pass; one recommendation on documenting acceptance and continuance decisions for requested engagements |
| Methodology | Manual written to GAGAS chapters 8 and 9 with Standards Domain V cross-references; Green Book as the internal control criteria; the Uniform Guidance for grant engagements | No deficiencies in the six engagements reviewed |
| Reporting | GAGAS report form (objectives, scope, methodology, findings with four elements, conclusions, recommendations, compliance statement, responsible officials’ views); Standards conformance statement added after the 2026 review; reports published on the county website | One report lacked a statement of the methodology’s limitations; corrected in the template |
| Governance and management (Standards Domains III and IV) | Three-year strategy; risk-based annual plan approved by the committee from a 94-entity universe; resource statement to the committee; quarterly reporting against appetite the committee adopted in 2025 | Conforms; the reviewers noted the plan’s coverage of federal grant programs |
| Advisory work | Performed under the Standards with safeguards documented; not reported as GAGAS engagements; the office declined a request to help design a new permitting system’s controls and offered a post-implementation audit instead | Appropriately distinguished |
The county auditor’s observation to the committee after the review was that following both frameworks had cost the office about 120 hours of mapping in 2025 and nothing since, because the overlap is nearly complete once the methodology is written to the more specific requirement in each area; the GAGAS form made the reports credible to the board and the public, and the Standards’ Domain IV made the office run like a function rather than a sequence of audits. The internal audit in government guide tells the rest of Pemberton County’s story, and the audit charter guide the charter clauses a public-sector function adds.
Questions about the Yellow Book and the IIA Standards
What is the Yellow Book?
Government Auditing Standards, issued by the Comptroller General of the United States through GAO and known as GAGAS. The 2024 revision, effective for periods beginning on or after 15 December 2025, covers ethics and independence, competence and CPE, quality management and peer review, financial audits, attestation engagements and performance audits.
Can an internal audit function follow both the Yellow Book and the IIA Standards?
Yes. GAGAS permits use in conjunction with other professional standards, including the IIA’s, and both may be cited in the report if the GAGAS requirements are met. Most government internal audit functions write their methodology to GAGAS for performance audits and layer the Standards’ governance and management requirements on top.
What are the Yellow Book CPE requirements?
Eighty hours every two years for auditors who plan, direct, perform or report on GAGAS engagements, including at least 24 hours in government auditing, the government environment or the audited entity’s environment, with at least 20 hours in each year. The IIA’s CIA requires 40 hours a year, so a CIA on GAGAS work plans the subject mix to satisfy both.
How does GAGAS peer review differ from the IIA’s external quality assessment?
GAGAS requires an external peer review at least every three years through a recognized program, with a rated report made public. The Standards require an external quality assessment at least every five years, which may be a validated self-assessment, reported to the board. Organizations following both scope one triennial review to cover both frameworks.
What changed in the 2024 Yellow Book?
Quality control became a risk-based system of quality management (designed and implemented by 15 December 2025, evaluated by 15 December 2026), engagement quality reviews became an option, monitoring became more proactive, and chapter 6 added guidance on key audit matters. Effective dates for engagements are periods beginning on or after 15 December 2025.
What is the difference between the Yellow Book and the Green Book?
The Yellow Book sets standards for how audits of government entities are performed and reported. The Green Book, GAO’s Standards for Internal Control in the Federal Government (2025 revision effective fiscal year 2026), is the internal control framework those entities follow, adapted from COSO, and the criteria GAGAS performance audits use when assessing internal control.
Related guides
- Internal audit in government — the environment the two frameworks operate in.
- The Global Internal Audit Standards mapped — every IIA standard.
- IPPF to GIAS mapping — the method for mapping a methodology to a standard.
- The internal audit methodology manual — where the dual-framework procedures live.
- Preparing for an external quality assessment — the IIA’s five-year review.
- The QAIP playbook — the quality program the Standards require.
- Independence and objectivity — the reasoning behind both frameworks’ rules.
- CIA CPE requirements — the IIA side of continuing education.
- The 5 Cs of audit findings — the finding elements GAGAS names.
- Audit evidence — sufficiency and appropriateness in practice.
- Anatomy of an internal audit report — the IIA-style report the GAGAS form extends.
- Evaluating management responses — the responsible officials’ views from the auditor’s side.
- The COSO framework — the corporate counterpart of the Green Book.
- The internal audit charter — the public-sector charter clauses.
- Internal audit in higher education and nonprofits — the grant environment.
Leave a Reply