The Design/Effectiveness Split Is Not a Requirement of the Internal Audit Standards

Every internal audit methodology distinguishes between a control that is badly designed and one that is well designed but not operating. It is the distinction the whole discipline of control testing rests on. It appears in the Global Internal Audit Standards exactly once, and not in a requirement.

What the Standards actually mandate

The Global Internal Audit Standards were published on 9 January 2024 and took effect on 9 January 2025 — a specific day rather than "sometime in 2025". Internal audit functions were required to adopt them as of that date, replacing the previous International Professional Practices Framework standards.

The structure matters for reading them correctly. There are five Domains: Purpose of Internal Auditing; Ethics and Professionalism; Governing the Internal Audit Function; Managing the Internal Audit Function; and Performing Internal Audit Services. Domains II through V contain Principles, and under those, Standards. Each Standard then separates Requirements from Considerations for Implementation. Only the first is mandatory, and a great deal of the practical "how" sits in the second.

The design-versus-effectiveness distinction lives in the optional layer

Searching the full 120-page document, the phrase "operating effectiveness" occurs once. Every statement about design adequacy versus operation appears in Considerations for Implementation rather than in a Requirement.

The fullest treatment is in the Considerations to Standard 13.6: "Evaluating the adequacy of the control design may be completed as part of engagement planning, because it helps internal auditors clearly identify key controls to be further tested for effectiveness ... However, the most appropriate time to perform this evaluation depends on the nature of the engagement."

The Considerations to Standard 13.2 give the sequencing logic: "For the most significant risks, assessing the adequacy of the design of the controls helps internal auditors determine which controls to continue testing for operating effectiveness."

And the Considerations to Standard 4.2 give the economic argument, which is the most quotable line in the set: "if the controls in an activity under review are not adequately designed, the benefits of fully evaluating the effectiveness of those controls are not likely to be worth the costs."

So the Standards endorse the distinction and explain why it is useful. What they do not do is require it. An internal audit function that tested only operating effectiveness, without a documented design evaluation, would not be in breach of a Requirement — it would simply be doing expensive and probably pointless work, which is the Standards' own point.

That has a practical consequence for anyone writing a methodology. If you cite the Standards as the authority for your design-then-effectiveness approach, cite the Considerations and say so. The distinction is drawn more firmly elsewhere, in the internal control frameworks, than in the internal audit Standards themselves.

What is mandatory is the plan, and the board's approval of it

Where the Standards are prescriptive is upstream. Standard 9.4 requires that the chief audit executive "must create an internal audit plan that supports the achievement of the organization's objectives", and must "base the internal audit plan on a documented assessment of the organization's strategies, objectives, and risks", informed by input from the board and senior management. That assessment "must be performed at least annually".

The plan must consider information technology governance, fraud risk and the effectiveness of compliance and ethics programmes among other high-risk areas, must identify the resources needed to deliver it, and must "be dynamic and updated timely" in response to change.

Two requirements in that Standard are worth flagging because they shift power. The plan "and significant changes to the plan must be approved by the board". And the chief audit executive must communicate to the board and senior management "the rationale for not including an assurance engagement in a high-risk area or activity in the plan", along with the impact of any resource limitations and any restrictions on access to information.

That second one is the quiet teeth of the Standards. A function that is under-resourced cannot simply narrow its plan; it has to tell the board which high-risk areas it is leaving uncovered and why.

And what the final report must contain

Standard 15.1 is mandatory and unusually specific. The final communication must include the engagement's objectives, scope, recommendations or action plans where applicable, and conclusions. For assurance engagements it must also include "the findings and their significance and prioritization", an explanation of any scope limitations, and "a conclusion regarding the effectiveness of the governance, risk management, and control processes of the activity reviewed".

Then the requirement that turns a report into action: it "must specify the individuals responsible for addressing the findings and the planned date by which the actions should be completed". Not a recommendation with a general owner — a named individual and a date.

It must also acknowledge actions management has already taken before the report is issued, be reviewed and approved by the chief audit executive before it goes out, and, if the engagement was not conducted in conformance with the Standards, disclose which Standards, why, and the impact on the findings and conclusions.

The seven qualities a communication must have — accurate, objective, clear, concise, constructive, complete and timely — are themselves mandatory under Standard 11.2, though their definitions sit in Considerations.

Where this fits

On the fraud side of the same work, the auditing standards treat the three conditions generally present when fraud exists in a similarly layered way — see our piece on ISA 240 and the fraud triangle, and on the changeover coming in December, the two live versions of ISA 240. For a practical half-day treatment of risk-based planning, test design and writing findings that land, see our internal audit fundamentals CPD course.

The Standards are published in full by The Institute of Internal Auditors. Check the Requirement and Considerations layers before citing any passage as mandatory, because the distinction is easy to lose and most secondary summaries do.