Skip to main content
Policy Authority
Category: Internal Audit

Performance Standards

Also known as: Performance Standard
Simply put

A performance standard is a management-approved statement of the threshold, requirement, or expectation that must be met, whether by an employee, a process, or a regulated entity. In regulation, it typically sets a goal or outcome to be achieved rather than prescribing the specific method for achieving it. The term carries different meanings across contexts, including employee appraisal, regulatory compliance, and internal audit practice.

Formal definition

In performance management, a performance standard is a management-approved expression of the performance threshold(s), requirement(s), or expectation(s) that must be met to be appraised, commonly framed around expected behaviors and results (per U.S. Office of Personnel Management guidance). In a regulatory context, a performance standard establishes an outcome or goal that regulated entities must achieve, often characterized by a threshold above or below which compliance is judged, and is typically contrasted with design (or prescriptive) standards, which specify the means or technology to be used; examples include OSHA performance standards for workplace safety and the Head Start Program Performance Standards. The identical term also appears in internal audit practice, where the Institute of Internal Auditors' International Professional Practices Framework historically designated a set of 'Performance Standards' establishing criteria for how internal audit engagements are planned, performed, and communicated; that IIA usage is distinct from the HR and regulatory meanings and is not detailed in the evidence provided here. Applicability, thresholds, and enforcement vary by jurisdiction, sector, and organization, and this entry does not address implementation specifics, tooling, or legal advice.

Why it matters

The term "performance standard" carries materially different meanings across governance, risk, and compliance work, and conflating them can lead practitioners to apply the wrong criteria. In performance management, a performance standard is a management-approved expression of the thresholds, requirements, or expectations an employee must meet to be appraised, framed around expected behaviors and results. In a regulatory context, by contrast, a performance standard establishes an outcome or goal that regulated entities must achieve, commonly defined by a threshold above or below which compliance is judged, rather than prescribing a specific method. This outcome orientation is what distinguishes a performance standard from a design (or prescriptive) standard, which specifies the means or technology to be used. Because the two approaches allocate discretion differently, the choice affects how compliance is demonstrated, how flexibility is granted to regulated parties, and how enforcement is assessed.

The distinction matters in practice because searching for a single definition can obscure important context. The same phrase appears in employee appraisal (for example, in U.S. Office of Personnel Management guidance), in regulatory regimes such as OSHA performance standards for workplace safety and the Head Start Program Performance Standards, and in internal audit practice. In the Institute of Internal Auditors' International Professional Practices Framework, the term "Performance Standards" has historically designated a distinct set of criteria governing how internal audit engagements are planned, performed, and communicated, an assurance-function usage that is separate from both the HR and regulatory meanings. Practitioners who assume one meaning applies universally risk citing the wrong authority or applying inappropriate criteria.

Applicability, thresholds, and enforcement vary by jurisdiction, sector, and organization. A regulatory performance standard applicable in one regime or industry should not be presumed to apply in another, and this variability means that identifying the governing context is a necessary first step before interpreting or relying on any specific performance standard.

Who it's relevant to

Compliance officers and regulatory specialists
Those responsible for demonstrating adherence to regulatory performance standards, such as OSHA workplace safety standards or the Head Start Program Performance Standards, need to identify whether the applicable regime sets an outcome to achieve or prescribes a specific method, as this determines how compliance is evidenced. Because applicability and thresholds vary by jurisdiction and sector, confirming the governing regime is essential.
Human resources and performance management professionals
In appraisal contexts, performance standards express the management-approved thresholds, requirements, or expectations, commonly framed around expected behaviors and results, that an employee must meet to be evaluated. OPM guidance illustrates this usage for developing such standards, though implementation details fall outside this entry.
Internal auditors and assurance professionals
Practitioners working under the IIA's International Professional Practices Framework should note that "Performance Standards" historically designate criteria for how internal audit engagements are planned, performed, and communicated. This assurance-function meaning is distinct from the HR and regulatory usages, and the independence and objectivity of the audit function distinguish these criteria from the controls or activities being audited.
Governance and policy professionals
Those drafting or interpreting internal policies and standards benefit from distinguishing performance (outcome-based) standards from design (prescriptive) standards, since the choice affects how much discretion is granted and how conformance is assessed across the organization.

Inside Performance Standards

IIA Performance Standards (Standards 2000-2600)
In the Institute of Internal Auditors' International Professional Practices Framework (IPPF), the Performance Standards form one of the two principal categories of Standards (alongside the Attribute Standards, numbered in the 1000 series). They set criteria for how internal audit activity is managed and how engagements are planned, performed, and communicated. The scope, terminology, and numbering reflect the IPPF as issued by the IIA and are periodically revised, so practitioners should consult the current version rather than assume a fixed structure.
Managing the internal audit activity (2000 series)
Addresses the chief audit executive's responsibility to manage the internal audit function effectively, commonly including risk-based planning, communication and approval of plans, resource management, policies and procedures, coordination with other assurance providers, and reporting to senior management and the board. This is a management-of-the-function dimension, distinct from the conduct of any single engagement.
Engagement planning, performance, and communication (2200-2600 series)
Covers the lifecycle of individual assurance and consulting engagements: planning considerations and objectives, performing the engagement (identifying, analyzing, evaluating, and documenting information), communicating results, and monitoring the disposition of results and management's acceptance of risk. These provide criteria for engagement work rather than prescribing specific audit techniques or tools.
Distinction from Attribute Standards
Performance Standards describe the nature of internal audit work and the quality against which its performance can be measured, whereas Attribute Standards address the characteristics of the organizations and individuals performing internal audit work, such as purpose, authority, independence, objectivity, proficiency, and due professional care.
Non-audit uses of the term
Outside internal audit, 'performance standards' is also used in human resources to describe the expected level of an employee's job performance, and in regulatory and operational contexts to describe outcome-based requirements that specify a result to be achieved rather than the prescriptive means of achieving it. These meanings are separate from the IIA usage and should not be conflated with it.

Common questions

Answers to the questions practitioners most commonly ask about Performance Standards.

Do 'Performance Standards' always refer to employee or HR performance criteria?
No. The term carries different meanings depending on context, and conflating them is a common source of confusion. In an internal audit context, 'Performance Standards' has a specific meaning within the Institute of Internal Auditors' (IIA) International Professional Practices Framework (IPPF), where the Performance Standards (commonly cited as the 2000-series) set criteria for how internal audit engagements are planned, performed, and communicated. This is distinct from HR performance standards used to evaluate individual employees, and distinct again from regulatory or operational performance standards that specify required output or service levels. When searching or citing the term, identify the domain first, because the governing body and scope differ materially.
Are Performance Standards just guidance that organizations may adopt at their discretion?
Not universally. Within the IIA's IPPF, the Standards are described as mandatory for internal audit functions that state conformance with the Standards, so treating them as purely optional guidance would misstate their status in that context. By contrast, HR-type performance standards are generally internal management instruments set at the organization's discretion, and regulatory performance standards derive their binding force from the specific law or regulator that issues them. Whether a given set of performance standards is mandatory, and for whom, depends on the issuing authority and the jurisdiction or professional context in which it applies.
How do the IIA Performance Standards relate to the Attribute Standards in the IPPF?
In the IPPF, the Attribute Standards address the characteristics of the internal audit function and the individuals performing it, such as independence, objectivity, proficiency, and due professional care. The Performance Standards address the nature and quality of internal audit work itself, including managing the activity, planning engagements, performing engagements, and communicating results. In practice both sets are applied together: the Attribute Standards establish who may perform the work and under what conditions, while the Performance Standards establish how engagements are conducted and reported. This entry does not reproduce individual standard numbers or clause text, which practitioners should confirm against the current IPPF.
How can an internal audit function demonstrate conformance with the Performance Standards?
Conformance is typically evidenced through documented methodology and working papers that trace how engagements were planned, performed, supervised, and communicated in line with the Standards. Many functions rely on a quality assurance and improvement program, including internal assessments and periodic external assessments, to support statements of conformance. The specifics of how assessments are scoped and how results are reported vary by organization, jurisdiction, and the current IPPF requirements, so this entry describes the concept qualitatively rather than prescribing a particular procedure or timetable.
Who is responsible for applying the Performance Standards within an internal audit engagement?
Primary responsibility generally rests with the chief audit executive for the internal audit activity as a whole, and with engagement supervisors and staff for individual engagements. Because internal audit is an assurance function, this responsibility should be kept distinct from management's ownership of the controls and processes being audited. The Performance Standards govern how the audit work is carried out; they do not transfer accountability for the underlying controls to the audit function. Maintaining that independence and objectivity distinction is central to applying the Standards correctly.
What common mistakes should practitioners avoid when applying Performance Standards to engagement communication?
A frequent error is treating communication of results as an afterthought rather than an element governed by the Standards, which address the quality, accuracy, objectivity, and timeliness of what is reported. Another is blurring the line between reporting audit findings and directing management's remediation, since the audit function should communicate results and follow up on their disposition without assuming management's decision-making role. Practitioners should also avoid presenting engagement-level conclusions as broader assurance than the scope supports. This entry does not cover specific report formats, tooling, or wording, which vary by organization and should be aligned with the current IPPF.

Common misconceptions

"Performance Standards" in internal audit is a generic phrase for any benchmark of audit quality.
Within the IIA's IPPF it is a defined category of the Standards with a specific numbering convention, sitting alongside the Attribute Standards. Using the phrase loosely can obscure the mandatory, structured nature of the IPPF criteria.
Performance Standards and Attribute Standards cover the same ground.
They are complementary but distinct. Attribute Standards concern the characteristics of the audit function and its people, such as independence, objectivity, and proficiency; Performance Standards concern how the activity is managed and how engagements are planned, performed, and communicated.
The internal audit meaning is interchangeable with HR or regulatory 'performance standards.'
The term carries different meanings across contexts. In HR it describes expected employee performance levels; in regulatory settings it often describes outcome-based requirements; in the IPPF it denotes a specific category of internal audit Standards. Practitioners should confirm which sense is intended.

Best practices

When citing Performance Standards in an internal audit context, reference the current version of the IIA's IPPF rather than relying on remembered numbering, as the framework is periodically revised.
Clearly signal which meaning of 'performance standards' is intended, IIA internal audit, HR, or regulatory, since the term spans distinct domains and audiences.
Read Performance Standards together with the Attribute Standards, recognizing that the two categories address different but complementary aspects of internal audit quality.
Anchor engagement planning, performance, and communication practices to the relevant Performance Standards criteria, while treating specific audit techniques and tooling as implementation choices outside the Standards themselves.
Maintain the independence and objectivity of the internal audit activity as addressed in the Attribute Standards, and avoid describing Performance Standards as if they supplant those independence requirements.
Verify jurisdictional and organizational context before presenting any single 'performance standards' requirement as applicable, since HR and regulatory usages in particular vary by setting.
Promotional banner for the Penetration Report Template Kit