Internal and Forensic Audit · Practices related to Internal Auditing

Internal Audit Standards and Code of Ethics Explained

Updated 11 October 2026 · Fact-checked

Standards on Internal Audit (SIAs) are ICAI pronouncements that set the minimum professional benchmarks for internal audit work. The IIA's International Standards and Code of Ethics do the same globally. To answer a question, state the standard or principle, apply it to the facts, then conclude with the auditor's action.

Understand Internal Audit Standards and Code of Ethics

An internal auditor gives management and the board an independent view on risks, controls and governance. Because the work affects decisions, it must follow a common benchmark. That benchmark is a set of standards plus an ethical code.

In India, the Institute of Chartered Accountants of India (ICAI) issues the Standards on Internal Audit (SIAs) through its Internal Audit Standards Board. They are grouped into broad areas: standards on general matters, on the audit process (planning, evidence, documentation, reporting), and on specific areas such as risk, internal control, fraud, and use of experts or outsourcing. They apply to internal audit engagements carried out by members of ICAI. Check the current list in your study material, as the ICAI may add or revise standards.

Globally, the Institute of Internal Auditors (IIA) issues the International Professional Practices Framework. It contains the Code of Ethics and the International Standards for the Professional Practice of Internal Auditing. Attribute standards deal with the auditor and the function: purpose, authority, independence, objectivity, proficiency and due professional care. Performance standards deal with managing the function and conducting engagements. Check the latest IIA framework version in your material, as its structure has been updated over time.

The IIA Code of Ethics rests on four principles: integrity, objectivity, confidentiality and competency. Integrity builds trust. Objectivity means an unbiased view, free of conflicts of interest. Confidentiality means protecting information and not using it for personal gain or against the law. Competency means applying the knowledge, skills and experience needed for the work.

Do not confuse internal audit standards with statutory audit standards. Statutory audit follows the Standards on Auditing (SAs), which are mandatory for the auditor reporting to members under the Companies Act. Internal audit follows SIAs, which serve the entity's management and board, with scope set by the engagement terms and the audit committee. The aim also differs: internal audit looks at risk, control and efficiency; statutory audit gives an opinion on the financial statements.

Key rules to remember

IIA Code of Ethics principles: Integrity + Objectivity + Confidentiality + Competency; Four principles. Each comes with rules of conduct in the code. Name all four in any ethics answer.
Source of standards: India: ICAI SIAs | Global: IIA International Standards; Say which framework you are answering from. Do not mix them without saying so.
Two broad IIA standard groups: Attribute standards (who the auditor is) + Performance standards (how work is done); Attribute covers independence, objectivity, proficiency, due care. Performance covers planning, execution, communication.
Standards vs ethics: Standards = how to perform the work | Ethics = how to behave; Use this one-line contrast to frame short notes.

How to solve Internal Audit Standards and Code of Ethics questions

Use the same method for scenario and theory questions on standards and ethics.

1Identify what is asked: a standard, an ethical principle, a comparison, or a scenario needing a conclusion.
2State the framework: ICAI SIA, IIA Standards or the IIA Code of Ethics.
3Write the rule in plain words: what the standard or principle requires.
4Pick the facts that matter: conflict of interest, lack of skill, disclosure of information, or scope limits.
5Link each fact to the relevant standard or principle, using its name.
6Conclude: say whether there is a breach and what the auditor should do, such as disclose, decline, seek expertise or escalate to the audit committee.
7Add one practical point, for example documentation or reporting the matter in writing.

Quickest way: Four-principle scan

When to use it: Use for short scenario questions where you have about five minutes.

Read the facts once and underline the auditor's action.
Test it against integrity, objectivity, confidentiality and competency, in that order.
Write one line per principle that is affected, with the fact beside it.
Finish with the corrective action and name the standard on independence, due care or proficiency if relevant.

Common mistakes in Internal Audit Standards and Code of Ethics

Saying SIAs and Standards on Auditing are the same thing
Both use the word audit and both are issued by ICAI.
Fix: State that SAs govern statutory audit opinions on financial statements, while SIAs guide internal audit work for management and the board.
Listing the IIA principles wrongly, such as adding independence or professional scepticism
Students mix the Code of Ethics with the attribute standards.
Fix: Remember the four: integrity, objectivity, confidentiality, competency. Independence belongs to the standards.
Treating objectivity and independence as identical
They are closely related and often used together.
Fix: Independence is organisational status that allows unbiased work. Objectivity is the auditor's individual mental attitude.
Giving the conclusion without applying facts
Students memorise the list and write it out.
Fix: In case questions, link each fact to a principle and state the breach and the remedy.
Quoting standard numbers from memory with wrong titles
There are many SIAs and numbers are easy to mix up.
Fix: Use a number only if you are sure. Otherwise name the standard by subject, such as the standard on planning or on documentation.
Ignoring confidentiality when sharing findings
Students focus on reporting duty and forget limits on disclosure.
Fix: Say the auditor reports to the authorised parties and does not disclose information to outsiders without legal or professional duty.

Worked examples

Example 1

An internal auditor of Sharma Textiles Ltd is asked to audit the purchase department, where his brother-in-law is the purchase manager. He does not tell the audit committee. Which ethical principle is affected and what should he do?

Show the solution

Framework: IIA Code of Ethics, supported by the SIA requirement of independence and objectivity.
The relationship creates a conflict of interest, so a fair and unbiased assessment is at risk. This affects objectivity.
Not telling the audit committee also affects integrity, because the conflict is concealed.
Action: disclose the relationship in writing to the head of internal audit or the audit committee.
Action: step back from this engagement or have the work assigned to another auditor.

Answer: Objectivity is affected, and integrity as well due to non-disclosure. He should disclose the relationship and not conduct the audit of that department.

Example 2

Distinguish between the standards that govern internal audit and those that govern statutory audit, in four points.

Show the solution

Source: internal audit follows ICAI's Standards on Internal Audit (and the IIA standards globally). Statutory audit follows the Standards on Auditing.
Purpose: SIAs guide work that helps management and the board on risk, control and governance. SAs guide the audit that gives an opinion on the financial statements.
Audience: internal audit reports to management or the audit committee. Statutory audit reports to members.
Scope: internal audit scope is set by engagement terms and can cover operations and compliance. Statutory audit scope is set by law and centres on financial reporting.
Conclusion: both aim at quality and ethics, but they differ in source, purpose, audience and scope.

Answer: SIAs and SAs differ in source, purpose, audience and scope. SIAs support internal governance, while SAs support the statutory opinion on financial statements.

Exam tips

For ethics questions, write the four principles as headings and add one line of explanation under each.
In case studies, always name the principle breached, then give the corrective action. Marks go to application.
For comparison questions, use four or five clear points such as source, purpose, audience and scope.
If you are not sure of a standard number, describe it by subject. A correct description earns marks, a wrong number does not.
Mention documentation and escalation to the audit committee as practical points in conclusions.

Practice questions from Practices related to Internal Auditing

Internal Audit Standards and Code of Ethics in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Standards and Code of Ethics: frequently asked questions

What are the Standards on Internal Audit (SIAs)?

They are standards issued by ICAI that set minimum professional benchmarks for internal audit engagements. They cover areas such as planning, evidence, documentation, reporting and risk. Check the current list in your study material.

What are the principles in the IIA Code of Ethics?

There are four: integrity, objectivity, confidentiality and competency. Each has rules of conduct describing expected behaviour.

What is the difference between internal audit standards and statutory audit standards?

Internal audit follows SIAs and serves management and the board. Statutory audit follows the Standards on Auditing and ends in an opinion for members on the financial statements.

Do I need to memorise every SIA number?

Focus on understanding the subject and purpose of each standard. Quote numbers only when you are certain, and otherwise name the standard by its topic.