What is the IPPF?

The International Professional Practices Framework® (IPPF®) is a structure that organizes the authoritative body of knowledge, promulgated by The IIA, for the professional practice of internal auditing.

The IPPF includes:

• Global Internal Audit Standards, which guide the worldwide professional practice of internal auditing and serve as a basis for evaluating and elevating the quality of the internal audit function. At the heart of the Standards are 15 guiding principles that enable effective internal auditing. Each principle is supported by standards that contain requirements, considerations for implementation, and examples of evidence of conformance. Together, these elements help internal auditors achieve the principles and fulfill the Purpose of Internal Auditing 
• Topical Requirements, designed to enhance the consistency and quality of internal audit services related to specific audit subjects and to support internal auditors performing engagements in those risk areas. Internal auditors must conform with the relevant requirements when the scope of an engagement includes one of the identified topics. Topical Requirements strengthen the ongoing relevance of internal auditing in addressing the evolving risk landscape across industries and sectors.
• Global Guidance supports the Standards by providing nonmandatory information, advice, and best practices for performing internal audit services. It is endorsed by The IIA through formal review and approval processes.
• Global Practice Guides provide detailed approaches, step-by-step processes, and examples on subjects including:
  • Assurance and advisory services.
  • Engagement planning, performance, and communication.
  • Financial services.
  • Fraud and other pervasive risks.
  • Strategy and management of the internal audit function.
  • Public sector.
  • Sustainability.
  • Global Technology Audit Guides (GTAG®) provide auditors with the knowledge to perform assurance or consulting services related to an organization’s information technology and information security risks and controls.