Category: Internal Audit

Attribute Standards

Simply put

Attribute Standards are one category within the internal audit standards issued by The Institute of Internal Auditors (IIA). They describe the characteristics that internal audit functions and the people who carry out internal audit work are expected to have. They are commonly distinguished from Performance Standards, which instead describe the nature of internal audit activities and how their quality is measured.

Formal definition

Attribute Standards are a component of the IIA's internal auditing standards that address the attributes of organizations and individuals performing internal auditing, that is, the characteristics of the internal audit function and its practitioners rather than the conduct or measurement of the work itself. Within the IIA's standards framework they are paired with Performance Standards, which describe the nature of internal audit activities and criteria against which their performance can be evaluated. Attribute Standards fall within the third line assurance context and should not be confused with the specific controls or management activities being audited; the precise clause structure and current designation of these standards are established by the IIA and may vary across editions of its guidance.

Why it matters

Attribute Standards matter because the credibility of internal audit work depends heavily on the characteristics of the function and the people performing it, not only on the procedures they follow. By setting out expectations for the attributes of internal audit organizations and individuals, these standards help establish the foundation, such as the positioning, independence, objectivity, and competence of the audit function, on which stakeholders can place reliance. Where these attributes are weak or absent, the assurance provided by internal audit may be undermined regardless of how thorough the underlying testing appears.

For boards, audit committees, and senior management who rely on internal audit as a third line assurance function, the distinction embodied in the Attribute Standards is practically important. Attribute Standards describe what the function and its practitioners should be, while Performance Standards describe the nature of the activities and the criteria against which their quality can be measured. Keeping these separate helps organizations diagnose where a shortfall lies, whether in the standing and characteristics of the function itself or in the way individual engagements are conducted and evaluated.

Because the precise clause structure and current designation of these standards are set by the IIA and may vary across editions of its guidance, professionals should refer to the applicable edition rather than assume a fixed structure. This entry does not address the specific requirements within the standards, implementation details, or how any particular internal audit function should be organized.

Who it's relevant to

Internal Auditors

Practitioners performing internal audit work are directly addressed by the Attribute Standards, which describe expected characteristics of the individuals carrying out internal auditing. Understanding how these standards differ from Performance Standards helps auditors distinguish expectations about who they are and how their function is positioned from expectations about how engagements are conducted and measured.

Chief Audit Executives and Audit Function Leaders

Those responsible for leading and structuring an internal audit function rely on the Attribute Standards when considering the characteristics the function and its people are expected to have. Because the clause structure and designation of these standards are set by the IIA and may vary across editions, function leaders typically refer to the applicable version of the IIA's guidance.

Audit Committees and Boards

Boards and audit committees that oversee internal audit as a third line assurance function have an interest in the attributes, such as independence and objectivity, that underpin the reliance they place on internal audit. The Attribute Standards help frame expectations about the standing of the function separately from the quality of individual engagements.

Governance, Risk, and Compliance Professionals

GRC professionals who interact with internal audit benefit from recognizing that Attribute Standards concern the characteristics of the audit function and its practitioners, and should not be confused with the controls or management activities being audited. This distinction supports a clear separation between assurance activities and the processes they assess.

Inside Attribute Standards

Purpose, Authority, and Responsibility

A component addressing the definition of the internal audit activity's mandate, typically formalized in an internal audit charter that establishes its standing, access rights, and scope within the organization.

Independence and Objectivity

A component distinguishing organizational independence (the audit function's positioning and reporting lines that free it from interference) from individual objectivity (the unbiased mental attitude of auditors), including provisions for managing impairments to either.

Proficiency and Due Professional Care

A component addressing the knowledge, skills, and competencies internal auditors are expected to possess or collectively obtain, and the reasonable care and skill expected in performing engagements, noting that due care does not guarantee that all risks or irregularities will be detected.

Quality Assurance and Improvement Program (QAIP)

A component covering the internal and external assessments used to evaluate the internal audit activity's conformance with applicable standards and to identify opportunities for improvement.

Common questions

Answers to the questions practitioners most commonly ask about Attribute Standards.

Are the Attribute Standards the same as the Performance Standards in the internal audit standards?

No. Although both belong to the same body of professional standards issued by the Institute of Internal Auditors (IIA), they address different things. Attribute Standards concern the characteristics of the internal audit function and the individuals performing internal audit work, matters such as purpose, authority, responsibility, independence, objectivity, proficiency, and due professional care. Performance Standards, by contrast, describe the nature of internal audit activities and provide quality criteria for how the work is planned, performed, and reported. Treating the two as interchangeable blurs the distinction between what an internal audit function must be and what it must do.

Do the Attribute Standards apply only to the chief audit executive or audit leadership?

Not exclusively. While certain requirements, such as those relating to the internal audit charter or the internal quality assurance and improvement program, are typically discharged through the chief audit executive, the Attribute Standards address attributes of both the internal audit function as a whole and the individual auditors performing engagements. Requirements concerning individual objectivity, proficiency, and due professional care extend to internal auditors generally, not solely to leadership.

How does an internal audit function demonstrate conformance with the independence and objectivity requirements?

Conformance is commonly evidenced through structural and behavioral arrangements. Organizational independence is often supported by a functional reporting line to the board or audit committee, as reflected in the internal audit charter. Individual objectivity is typically addressed through documented conflict-of-interest disclosures, safeguards where auditors review areas in which they previously worked, and rotation practices in some organizations. The specific arrangements vary by organization, jurisdiction, and sector, and this entry does not prescribe a single method.

What role does the internal audit charter play in relation to the Attribute Standards?

The charter is commonly the vehicle through which several Attribute Standards requirements are formally established, including the internal audit function's purpose, authority, and responsibility, and its position within the organization. It is typically approved by the board or audit committee. The charter is a foundational document rather than a substitute for ongoing conformance; the attributes it records must also be reflected in actual practice.

How can an internal audit function maintain proficiency and due professional care in practice?

Proficiency is generally supported through appropriate knowledge, skills, and competencies within the function, whether held directly or obtained through external resources where specialized expertise is needed. Due professional care commonly involves applying the diligence and skill expected of a reasonably prudent and competent internal auditor, while recognizing that such care does not guarantee that all risks or irregularities will be identified. Continuing professional development is a frequently used means of sustaining these attributes.

How do the Attribute Standards relate to the quality assurance and improvement program?

The Attribute Standards commonly require the internal audit function to develop and maintain a quality assurance and improvement program covering all aspects of the function. This typically includes both internal assessments and periodic external assessments, with results reported to senior management and the board. The program is a mechanism for evaluating conformance with the standards, including the Attribute Standards themselves; the specific frequency and form of assessments may vary by organization and jurisdiction.

Common misconceptions

Attribute Standards describe how to conduct audit engagements step by step.

Attribute Standards address the characteristics of the internal audit function and the individuals performing the work, such as independence, objectivity, and proficiency. Guidance on how engagements are planned and performed generally falls under a separate category of performance-oriented standards rather than Attribute Standards.

Because internal audit is independent, its assurance activities can be treated as a management control.

Attribute Standards emphasize the independence and objectivity of internal audit as an assurance function. Auditing a control is distinct from operating that control; the internal audit activity provides assurance over management's controls but does not own or perform them, and blending these roles can impair objectivity.

Conformance with Attribute Standards guarantees that fraud or material weaknesses will be found.

Due professional care calls for reasonable care and skill, not certainty. Even a function that conforms fully with the standards may not detect every irregularity, and the standards do not promise such outcomes.

Best practices

Establish and periodically review an internal audit charter that clearly documents the function's purpose, authority, and responsibility, and have it approved at an appropriate governance level such as the board or its audit committee.

Distinguish and safeguard both organizational independence and individual objectivity, and put in place a process to identify, disclose, and manage any impairments before or during engagements.

Assess the collective proficiency of the audit team against the risks and areas in scope, and supplement internal capabilities with external or specialist expertise where knowledge gaps exist.

Maintain a quality assurance and improvement program that combines ongoing internal monitoring, periodic internal assessments, and external assessments to evaluate conformance with the applicable standards.

Apply due professional care by planning and documenting work appropriately while communicating clearly that assurance provides reasonable, not absolute, coverage of risks and irregularities.

Keep assurance responsibilities separate from management's control activities, and disclose any situations where auditors previously performed or advised on operations now under review.