Internal Audit Documentation Pack – 2024 IIA Standards Templates

If your audit manual was written for the 2017 framework, it no longer describes what an external assessor will test. The IIA’s Global Internal Audit Standards took effect on 9 January 2025 and added an internal audit strategy, performance measures and duties for the board. This internal audit documentation follows the new structure section by section and includes a workbook for moving across from the old one.

On this page:

• Why internal audit documentation from the 2017 era falls short
• What is inside the internal audit documentation pack
• Topical Requirements: the internal audit documentation assessors check item by item
• From notice to follow-up, on one worked example
• Who the internal audit documentation pack is written for
• What the internal audit documentation pack does not do
• Frequently asked questions
• Related toolkits

Why internal audit documentation from the 2017 era falls short

The 2024 Standards are organised in five domains, fifteen principles and 52 standards. Nine of the Domain III standards carry Essential Conditions: duties for the board and senior management that the chief audit executive cannot perform alone but must discuss, and where one is agreed to be unnecessary, record why and what compensates for it.

Most charter templates stop at the charter. This internal audit documentation carries the board’s commitments into the charter the board approves, an audit committee terms of reference, a RACI with an agreement record for any condition the board decides it does not need, and a board oversight self-assessment. The 2017 IPPF to 2024 Standards transition workbook takes an existing manual across standard by standard.

What is inside the internal audit documentation pack

The internal audit documentation pack is 87 editable templates – 60 Word documents and 27 Excel workbooks – in eight sections that follow the domains of the Standards.

• Start here (4) – guide and roadmap, conformance register, transition gap assessment and the Essential Conditions RACI.
• Ethics and professionalism (13) – code of conduct, objectivity safeguards, impairment disclosure, competency matrix, CPD and the conformance statement procedure.
• Governing the function (12) – mandate paper, charter, public sector charter, audit committee provisions, the quality assurance and improvement program and the external assessment plan.
• Managing the function (23) – strategy, methodology manual, audit universe, annual risk assessment, risk-based plan, assurance map, budget, board reporting and KPIs.
• Performing services (21) – the engagement end to end, from notification letter to follow-up validation.
• Public sector (1) – an implementation guide for the Standards’ public sector chapter.
• Topical Requirements (10) – the applicability assessment plus an audit program and testing workbook for each of the four issued.
• Plan coverage programs (3) – fraud risk, IT governance, and compliance and ethics.

Topical Requirements: the internal audit documentation assessors check item by item

Topical Requirements are mandatory when internal audit gives assurance on the topic. The function has to record, for every item, whether it applies, and write down why for every item it excludes. Four are issued: Cybersecurity, Third-Party, Organizational Behavior and Organizational Resilience, 69 items in all.

The Topical Requirements applicability assessment arrives pre-loaded with all 69, with a live check that counts any exclusion recorded without a rationale. It has to read zero before an assessment. Topical Requirements keep coming, so check theiia.org for any issued after October 2026.

From notice to follow-up, on one worked example

Section 04 of this internal audit documentation runs the whole engagement: notification letter, planning memorandum with the engagement risk assessment, evaluation criteria guide, risk and control matrix, work program, information request list, walkthrough narrative, sampling workbook, test of controls workpaper, finding sheet, rating scale, recommendations and final report.

One worked example runs through them, so you can see how a finding moves from the matrix to the report and into follow-up. Workbooks arrive with live summary formulas, and example rows are shown in grey and never counted in the totals.

Who the internal audit documentation pack is written for

• Chief audit executives preparing for an external quality assessment, or building evidence for one.
• Small and one-person functions. The Standards apply in full whatever the size, and the documents say how to meet them with a peer reviewer, a co-source provider or an external reviewer.
• Public sector functions whose mandate is set in law, with a separate charter for that case.
• Audit teams moving a 2017 manual to the 2024 structure.

What the internal audit documentation pack does not do

It does not make your function conform. Conformance is shown by operating the function and is assessed by an independent external quality assessment at least once every five years. What you get is the external quality assessment evidence that review looks for: the charter, methodology, plans, working papers and quality program.

It is not published by, affiliated with or endorsed by The Institute of Internal Auditors, which owns the trademarks “Global Internal Audit Standards” and “CIA”. It does not reproduce the IIA’s text: requirement descriptions are summaries in our own words, to use alongside the Standards, which the IIA publishes free.

Frequently asked questions

Which edition does it follow?

The 2024 edition, effective 9 January 2025, plus the four issued Topical Requirements. It is not built on the 2017 IPPF.

Does it include an internal audit charter example?

Yes, two: a standard charter and a public sector charter for mandates set in legislation, both carrying the board’s Essential Conditions.

Do we need to buy the Standards?

No. The IIA publishes them and the Topical Requirements free on its website.

What formats are the files in?

Native Microsoft Word and Excel, editable and unprotected, with drop-down validation and frozen headers in the workbooks.

Related toolkits

The Topical Requirements reach into areas other packs cover in depth: the third-party risk pack for the Third-Party requirement, the ISO 22301 toolkit for Organizational Resilience, and the ISO 27001 toolkit for Cybersecurity. Finance functions may also want the SOX toolkit. The IIA publishes the Global Internal Audit Standards on its website.

Implementing for clients? The Consultant Package licenses all 91 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.

Delivery, format and licence

The internal audit documentation pack downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is locked, nothing is a PDF you cannot edit, and no add-on or portal login is needed to open them. Every organisation-specific value is marked as a placeholder so you can see what still has to be decided.

One payment, no subscription and no annual renewal. The source files are yours to adapt for your own organisation for as long as you need them, including future revisions of your own documents.