Generally Conforms
The highest conformity rating in external quality assessments, indicating that the internal audit activity has a charter, policies, and processes judged to be in conformance with the IIA Standards. This rating reflects full compliance without material deviations.
Source: IIA Quality Assessment Manual 2024
Generally conforms is the highest of the three conformance ratings awarded in an External Quality Assessment (EQA). It means that the internal audit function's charter, policies and processes are judged to be in conformance with the Global Internal Audit Standards (GIAS) 2024 issued by the Institute of Internal Auditors (IIA). Minor observations may exist, but there are no material deviations that undermine compliance with the Standards.
For the board, the supervisory board and the audit committee, this is the rating they want to see, because it confirms the reliability and professionalism of the audit function. A generally conforms rating gives the oversight body confidence that it can rely on the assurance the function provides. It is also evidence that the function has successfully undergone the mandatory external assessment at least once every five years (Standard 8.4 of the Global Internal Audit Standards 2024).
In practice, an external assessor weighs, for each requirement of the Standards, whether the function structurally achieves both its intent and its operation. The rating is given at the level of the function as a whole, not for individual requirements: generally conforms means the function complies with the Standards in design and operation, without deviations that materially affect its performance. The other two ratings are partially conforms and does not conform. The highest rating does not relieve the function of ongoing quality assurance between two assessments.
ONE Risk Advisory assesses against this rating and shows which steps are needed to achieve or maintain it. Generally conforms confirms that the audit function structurally complies with the IIA standards; it is the rating audit committees want to see, because it underpins the reliability of the function.
Last updated:
Related service External Quality Assessment (EQA)
Frequently asked questions
What exactly does generally conforms mean?
It means the internal audit function's charter, policies and processes are in conformance with the Global Internal Audit Standards (GIAS) 2024, without material deviations. It is the highest of the three conformance ratings in an EQA.
Does generally conforms mean everything is perfect?
No. There may be minor improvement points, but no deviations that materially affect compliance with the Standards. The rating confirms structural compliance, not the absence of every observation.
What do we need to do to maintain this rating?
Between two external assessments, maintain an ongoing quality assurance programme with periodic internal reviews. This keeps the function demonstrably aligned with the Standards and makes the next external assessment less risky.