{"id":7475,"date":"2026-08-17T14:25:05","date_gmt":"2026-08-17T12:25:05","guid":{"rendered":"https:\/\/arcad.lu\/?p=7475"},"modified":"2026-08-17T14:43:11","modified_gmt":"2026-08-17T12:43:11","slug":"code-pratique-ciia-audit-interne","status":"publish","type":"post","link":"https:\/\/arcad.lu\/en\/code-pratique-ciia-audit-interne\/","title":{"rendered":"IIA Code of Practice: a new benchmark for internal audit"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"7475\" class=\"elementor elementor-7475\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-6db90f4 elementor-section-full_width elementor-section-height-default elementor-section-height-default\" data-id=\"6db90f4\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ebfbb07\" data-id=\"ebfbb07\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b898738 elementor-widget elementor-widget-html\" data-id=\"b898738\" data-element_type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<style>\n\/* =========================================================\n   ARCAD \u2014 CODE DE PRATIQUE CIIA\n   Version Elementor\n   Styles encapsul\u00e9s dans .arcad-ciia\n   ========================================================= *\/\n\n.arcad-ciia {\n    --arcad-navy: #182a49;\n    --arcad-navy-light: #2c4774;\n    --arcad-gold: #d2bc76;\n    --arcad-gold-soft: #f0e8cf;\n    --arcad-cream: #f7f4ed;\n    --arcad-white: #ffffff;\n    --arcad-ink: #24303c;\n    --arcad-muted: #667180;\n    --arcad-line: #e3ded2;\n\n    width: 100%;\n    color: var(--arcad-ink);\n    font-family: inherit;\n    font-size: 17px;\n    line-height: 1.72;\n}\n\n.arcad-ciia,\n.arcad-ciia * {\n    box-sizing: border-box;\n}\n\n.arcad-ciia a {\n    color: var(--arcad-navy-light);\n    text-decoration-thickness: 1px;\n    text-underline-offset: 3px;\n}\n\n.arcad-ciia a:hover {\n    color: var(--arcad-navy);\n}\n\n.arcad-ciia .arcad-shell {\n    width: 100%;\n    max-width: 1160px;\n    margin: 0 auto;\n}\n\n\/* =========================================================\n   HERO\n   ========================================================= *\/\n\n.arcad-ciia .arcad-hero {\n    position: relative;\n    overflow: hidden;\n    padding: clamp(44px, 7vw, 88px);\n    color: var(--arcad-white);\n    background:\n        linear-gradient(\n            125deg,\n            rgba(24, 42, 73, 0.99),\n            rgba(44, 71, 116, 0.95)\n        );\n    border-radius: 4px;\n    box-shadow: 0 24px 60px rgba(24, 42, 73, 0.16);\n}\n\n.arcad-ciia .arcad-hero::before,\n.arcad-ciia .arcad-hero::after {\n    content: \"\";\n    position: absolute;\n    pointer-events: none;\n    transform: rotate(35deg);\n}\n\n.arcad-ciia .arcad-hero::before {\n    width: 260px;\n    height: 260px;\n    right: -115px;\n    top: -120px;\n    border: 1px solid rgba(210, 188, 118, 0.45);\n}\n\n.arcad-ciia .arcad-hero::after {\n    width: 190px;\n    height: 190px;\n    right: 35px;\n    bottom: -130px;\n    background: rgba(210, 188, 118, 0.13);\n}\n\n.arcad-ciia .arcad-hero-content {\n    position: relative;\n    z-index: 1;\n    max-width: 930px;\n}\n\n.arcad-ciia .arcad-eyebrow {\n    margin: 0 0 18px;\n    color: var(--arcad-gold);\n    font-size: 13px;\n    font-weight: 700;\n    line-height: 1.4;\n    letter-spacing: 0.14em;\n    text-transform: uppercase;\n}\n\n.arcad-ciia .arcad-title {\n    margin: 0;\n    max-width: 950px;\n    color: var(--arcad-white);\n    font-size: clamp(36px, 5.5vw, 66px);\n    font-weight: 700;\n    line-height: 1.06;\n    letter-spacing: -0.035em;\n}\n\n.arcad-ciia .arcad-lead {\n    max-width: 850px;\n    margin: 25px 0 0;\n    color: rgba(255, 255, 255, 0.88);\n    font-size: clamp(19px, 2.2vw, 24px);\n    line-height: 1.55;\n}\n\n.arcad-ciia .arcad-meta {\n    display: flex;\n    flex-wrap: wrap;\n    gap: 10px 22px;\n    margin-top: 30px;\n    color: rgba(255, 255, 255, 0.72);\n    font-size: 14px;\n}\n\n\/* =========================================================\n   CONTENU\n   ========================================================= *\/\n\n.arcad-ciia .arcad-content {\n    max-width: 960px;\n    margin: 0 auto;\n    padding: clamp(48px, 7vw, 82px) 24px;\n}\n\n.arcad-ciia .arcad-intro {\n    margin: 0 0 38px;\n    font-size: 20px;\n    line-height: 1.7;\n}\n\n\/* =========================================================\n   REP\u00c8RES\n   ========================================================= *\/\n\n.arcad-ciia .arcad-facts {\n    display: grid;\n    grid-template-columns: repeat(2, minmax(0, 1fr));\n    gap: 18px;\n    margin: 38px 0 62px;\n}\n\n.arcad-ciia .arcad-fact {\n    padding: 25px;\n    background: var(--arcad-cream);\n    border-top: 3px solid var(--arcad-gold);\n}\n\n.arcad-ciia .arcad-fact p {\n    margin: 0;\n    color: var(--arcad-muted);\n    font-size: 15px;\n    line-height: 1.6;\n}\n\n.arcad-ciia .arcad-fact strong {\n    color: var(--arcad-navy);\n}\n\n\/* =========================================================\n   SECTIONS\n   ========================================================= *\/\n\n.arcad-ciia .arcad-section {\n    display: grid;\n    grid-template-columns: 58px minmax(0, 1fr);\n    gap: 22px;\n    padding: 44px 0;\n    border-top: 1px solid var(--arcad-line);\n}\n\n.arcad-ciia .arcad-number {\n    color: var(--arcad-gold);\n    font-size: 15px;\n    font-weight: 700;\n    letter-spacing: 0.08em;\n}\n\n.arcad-ciia h2 {\n    margin: -7px 0 20px;\n    color: var(--arcad-navy);\n    font-size: clamp(27px, 3.5vw, 38px);\n    font-weight: 700;\n    line-height: 1.18;\n    letter-spacing: -0.025em;\n}\n\n.arcad-ciia h3 {\n    margin: 28px 0 10px;\n    color: var(--arcad-navy);\n    font-size: 21px;\n    line-height: 1.35;\n}\n\n.arcad-ciia p {\n    margin: 0 0 18px;\n}\n\n.arcad-ciia ul {\n    margin: 20px 0;\n    padding: 0;\n    list-style: none;\n}\n\n.arcad-ciia li {\n    position: relative;\n    margin: 11px 0;\n    padding-left: 27px;\n}\n\n.arcad-ciia li::before {\n    content: \"\";\n    position: absolute;\n    top: 0.72em;\n    left: 0;\n    width: 8px;\n    height: 8px;\n    background: var(--arcad-gold);\n    transform: rotate(45deg);\n}\n\n\/* =========================================================\n   ENCARTS\n   ========================================================= *\/\n\n.arcad-ciia .arcad-callout {\n    margin: 28px 0;\n    padding: 24px 28px;\n    background: var(--arcad-gold-soft);\n    border-left: 4px solid var(--arcad-gold);\n}\n\n.arcad-ciia .arcad-callout strong:first-child {\n    color: var(--arcad-navy);\n}\n\n\/* =========================================================\n   \u00c0 RETENIR\n   ========================================================= *\/\n\n.arcad-ciia .arcad-takeaway {\n    margin: 50px 0;\n    padding: clamp(30px, 5vw, 48px);\n    color: var(--arcad-white);\n    background: var(--arcad-navy);\n}\n\n.arcad-ciia .arcad-takeaway-label {\n    display: block;\n    margin: 0 0 12px;\n    color: var(--arcad-gold);\n    font-size: 13px;\n    font-weight: 700;\n    letter-spacing: 0.14em;\n    text-transform: uppercase;\n}\n\n.arcad-ciia .arcad-takeaway p {\n    margin: 0;\n    color: var(--arcad-white);\n    font-size: 18px;\n    line-height: 1.7;\n}\n\n\/* =========================================================\n   CTA\n   ========================================================= *\/\n\n.arcad-ciia .arcad-cta {\n    display: grid;\n    grid-template-columns: minmax(0, 1fr) auto;\n    align-items: center;\n    gap: 30px;\n    margin-top: 56px;\n    padding: clamp(30px, 5vw, 48px);\n    background: var(--arcad-cream);\n    border-top: 3px solid var(--arcad-gold);\n}\n\n.arcad-ciia .arcad-cta-title {\n    margin: 0 0 10px;\n    color: var(--arcad-navy);\n    font-size: clamp(25px, 3vw, 34px);\n    font-weight: 700;\n    line-height: 1.2;\n}\n\n.arcad-ciia .arcad-cta p {\n    margin: 0;\n    color: var(--arcad-muted);\n}\n\n.arcad-ciia .arcad-button {\n    display: inline-flex;\n    align-items: center;\n    justify-content: center;\n    min-height: 52px;\n    padding: 13px 22px;\n    color: var(--arcad-white) !important;\n    background: var(--arcad-navy);\n    border: 1px solid var(--arcad-navy);\n    text-decoration: none !important;\n    font-size: 15px;\n    font-weight: 700;\n    line-height: 1.4;\n    white-space: nowrap;\n    transition:\n        background-color 0.2s ease,\n        color 0.2s ease;\n}\n\n.arcad-ciia .arcad-button:hover {\n    color: var(--arcad-navy) !important;\n    background: transparent;\n}\n\n\/* =========================================================\n   SOURCES\n   ========================================================= *\/\n\n.arcad-ciia .arcad-sources {\n    margin-top: 60px;\n    padding-top: 34px;\n    border-top: 1px solid var(--arcad-line);\n}\n\n.arcad-ciia .arcad-sources h3 {\n    margin: 0 0 20px;\n    color: var(--arcad-navy);\n    font-size: 27px;\n    font-weight: 700;\n    line-height: 1.25;\n}\n\n.arcad-ciia .arcad-sources ul {\n    margin: 18px 0;\n    padding: 0;\n    list-style: none;\n}\n\n.arcad-ciia .arcad-sources li {\n    margin: 12px 0;\n    padding-left: 27px;\n    color: var(--arcad-muted);\n    font-size: 15px;\n    line-height: 1.6;\n}\n\n.arcad-ciia .arcad-scope {\n    margin-top: 24px;\n    padding: 18px 20px;\n    color: var(--arcad-muted);\n    background: #faf9f6;\n    font-size: 14px;\n    line-height: 1.6;\n}\n\n\/* =========================================================\n   RESPONSIVE\n   ========================================================= *\/\n\n@media (max-width: 767px) {\n\n    .arcad-ciia {\n        font-size: 16px;\n    }\n\n    .arcad-ciia .arcad-hero {\n        padding: 38px 24px 42px;\n    }\n\n    .arcad-ciia .arcad-title {\n        font-size: clamp(34px, 11vw, 48px);\n    }\n\n    .arcad-ciia .arcad-content {\n        padding-left: 20px;\n        padding-right: 20px;\n    }\n\n    .arcad-ciia .arcad-facts,\n    .arcad-ciia .arcad-cta {\n        grid-template-columns: 1fr;\n    }\n\n    .arcad-ciia .arcad-section {\n        grid-template-columns: 1fr;\n        gap: 8px;\n        padding: 36px 0;\n    }\n\n    .arcad-ciia .arcad-number {\n        margin-bottom: 3px;\n    }\n\n    .arcad-ciia .arcad-button {\n        width: 100%;\n        white-space: normal;\n        text-align: center;\n    }\n}\n<\/style>\n\n\n<article class=\"arcad-ciia\" lang=\"fr\">\n\n    <div class=\"arcad-shell\">\n\n\n        <!-- HERO -->\n        <header class=\"arcad-hero\">\n\n            <div class=\"arcad-hero-content\">\n\n                <p class=\"arcad-eyebrow\">\n                    Internal Audit \u00b7 Governance \u00b7 Frameworks\n                <\/p>\n\n                <h1 class=\"arcad-title\">\n                    IIA Code of Practice: a new benchmark for internal audit\n                <\/h1>\n\n                <p class=\"arcad-lead\">\n                    In September 2024, the Chartered Institute of Internal Auditors (CIIA) published a revised Code of Practice, applicable from January 2025. Designed for the UK and Ireland, this text has no regulatory scope in Luxembourg \u2013 but it serves as a useful maturity benchmark for any internal audit function wishing to measure and enhance its impact.\n                <\/p>\n\n                <div class=\"arcad-meta\">\n                    <span>Category: Internal audit<\/span>\n                    <span>Reading time: 6 minutes<\/span>\n                <\/div>\n\n            <\/div>\n\n        <\/header>\n\n\n        <div class=\"arcad-content\">\n\n\n            <!-- INTRODUCTION -->\n            <div class=\"arcad-intro\">\n\n                <p>\n                    The CIIA, the UK and Irish branch of the Institute of Internal Auditors (IIA), published a revised version of its on 11 September 2024 <em>Internal Audit Code of Practice<\/em>, applicable from the 1st<sup>er<\/sup> January 2025. The text merges the two pre-existing codes \u2014 one dedicated to financial services, the other to the private and non-profit sectors \u2014 into a single reference framework.\n                <\/p>\n\n            <\/div>\n\n\n            <!-- REP\u00c8RES -->\n            <div class=\"arcad-facts\">\n\n                <div class=\"arcad-fact\">\n                    <p>\n                        CIIA Internal Audit Code of Practice, published on <strong>11 September 2024<\/strong>, applicable from the <strong>1<sup>er<\/sup> January 2025<\/strong>.\n                    <\/p>\n                <\/div>\n\n                <div class=\"arcad-fact\">\n                    <p>\n                        <strong>37 principles<\/strong> grouped into <strong>nine areas<\/strong> ; principles-based text, to be applied proportionally.\n                    <\/p>\n                <\/div>\n\n                <div class=\"arcad-fact\">\n                    <p>\n                        Aligned with the International Professional Practices Framework (IPPF) and the Global Internal Audit Standards (GIAS).\n                    <\/p>\n                <\/div>\n\n                <div class=\"arcad-fact\">\n                    <p>\n                        Merge the two old codes into a single document: financial services on the one hand, and the private and non-profit sectors on the other.\n                    <\/p>\n                <\/div>\n\n            <\/div>\n\n\n            <!-- 01 -->\n            <section class=\"arcad-section\">\n\n                <div class=\"arcad-number\" aria-hidden=\"true\">\n                    01\n                <\/div>\n\n                <div>\n\n                    <h2>Refactored code, aligned with the new standards<\/h2>\n\n                    <p>\n                        It is explicitly designed to articulate with the new GSRs, which came into effect in January 2025, with the IIA's IPPF, and with the revised version of the <em>UK Corporate Governance Code<\/em> (UK Corporate Governance Code). The Code is based on principles \u2014 37 principles divided into nine areas \u2014 and applies with proportionality, according to the size, risk profile and complexity of the organisation. It is not a binding standard: it is a benchmark of good practice, which External Quality Assessment (EQA) providers use as a reference.\n                    <\/p>\n\n                <\/div>\n\n            <\/section>\n\n\n            <!-- 02 -->\n            <section class=\"arcad-section\">\n\n                <div class=\"arcad-number\" aria-hidden=\"true\">\n                    02\n                <\/div>\n\n                <div>\n\n                    <h2>What the Code Carries: From Cover to Impact<\/h2>\n\n                    <p>\n                        The Code shifts the focus from compliance to impact. Several guidelines are worth noting:\n                    <\/p>\n\n                    <ul>\n\n                        <li>\n                            <strong>A scope defined by enterprise risks.<\/strong> Internal audit forms its own judgement on the relevant coverage, based on the strategy and risk profile; its point of view is informed, but not determined, by that of management, the risk function or regulators.\n                        <\/li>\n\n                        <li>\n                            <strong>A dynamic audit plan.<\/strong> The plan, approved by the audit committee, is continuously reviewed to incorporate emerging risks and unforeseen events.\n                        <\/li>\n\n                        <li>\n                            <strong>A consolidated report and an annual opinion.<\/strong> At least once a year, internal audit provides an overall opinion on the effectiveness of the governance, risk management and control framework \u2014 as well as compliance with risk appetite \u2014 accompanied by a root cause analysis of significant weaknesses.\n                        <\/li>\n\n                        <li>\n                            <strong>Enhanced independence of the head of internal audit.<\/strong> The Code entrusts the chair of the audit committee with the appointment, target-setting, appraisal, remuneration and, where applicable, dismissal of the head of internal audit (Chief Audit Executive, CAE); after seven years of service, an annual review of their independence is expected.\n                        <\/li>\n\n                        <li>\n                            <strong>Resources matching the scale of the risks.<\/strong> The CAE reports regularly on the adequacy of skills and the budget; the audit committee approves this budget and states in the annual report whether it considers it sufficient.\n                        <\/li>\n\n                    <\/ul>\n\n                <\/div>\n\n            <\/section>\n\n\n            <!-- 03 -->\n            <section class=\"arcad-section\">\n\n                <div class=\"arcad-number\" aria-hidden=\"true\">\n                    03\n                <\/div>\n\n                <div>\n\n                    <h2>Protecting value \u2014 and helping to create it<\/h2>\n\n                    <p>\n                        The purpose assigned to internal audit deserves to be clarified. According to the Code, it consists primarily in helping the board of directors and management protect the organisation's assets, reputation and long-term viability. The GIAS adopt a broader formulation: internal audit enhances the organisation's ability to <em>create, protect and sustainably grow<\/em> value.\n                    <\/p>\n\n                    <div class=\"arcad-callout\">\n                        <strong>Scope of this award:<\/strong> a function limited to protection intervenes principally a posteriori; a function that also contributes to value creation informs decisions, projects and strategy. ARCAD adopts this second approach.\n                    <\/div>\n\n                <\/div>\n\n            <\/section>\n\n\n            <!-- 04 -->\n            <section class=\"arcad-section\">\n\n                <div class=\"arcad-number\" aria-hidden=\"true\">\n                    04\n                <\/div>\n\n                <div>\n\n                    <h2>From entity-based coverage to risk-based coverage<\/h2>\n\n                    <p>\n                        The Code reinforces a fundamental methodological shift: moving from a plan that systematically covers all auditable entities to one driven by the company's most significant risks. Internal audit does not need to cover its entire remit every year; it focuses its work where the risk is highest and designs its plan to support the overall annual opinion. This approach, which aligns audit work with the level and evolution of risks, requires a continuously updated plan and a regularly refreshed risk map.\n                    <\/p>\n\n                <\/div>\n\n            <\/section>\n\n\n            <!-- 05 -->\n            <section class=\"arcad-section\">\n\n                <div class=\"arcad-number\" aria-hidden=\"true\">\n                    05\n                <\/div>\n\n                <div>\n\n                    <h2>What is the scope of a Luxembourgish internal audit function?<\/h2>\n\n                    <p>\n                        The Code targets the UK and Ireland; it has no regulatory status in Luxembourg. Nevertheless, three reasons make it a useful reference point for market participants:\n                    <\/p>\n\n                    <ul>\n\n                        <li>\n                            The IPPF, upon which the Code is based, is mandatory for internal auditors affiliated with the IIA worldwide, including in Luxembourg.\n                        <\/li>\n\n                        <li>\n                            The Commission de Surveillance du Secteur Financier (CSSF) already requires an internal audit function for certain of the entities it regulates \u2014 credit institutions and investment firms, alternative investment fund managers (AIFMs), professionals of the financial sector (PFS), payment institutions \u2014 with requirements regarding independence, reporting to the governing body or audit committee, and risk-based planning.\n                        <\/li>\n\n                        <li>\n                            The Code provides a common vocabulary and maturity model that can be used as a self-assessment mirror, without replacing local obligations.\n                        <\/li>\n\n                    <\/ul>\n\n                    <p>\n                        The Code therefore constitutes a benchmark of good practice, rather than an additional obligation.\n                    <\/p>\n\n                <\/div>\n\n            <\/section>\n\n\n            <!-- 06 -->\n            <section class=\"arcad-section\">\n\n                <div class=\"arcad-number\" aria-hidden=\"true\">\n                    06\n                <\/div>\n\n                <div>\n\n                    <h2>How to use it in practice<\/h2>\n\n                    <ul>\n\n                        <li>\n                            Map current practices against the nine areas of the Code to identify maturity gaps.\n                        <\/li>\n\n                        <li>\n                            Review the internal audit charter: mandate, independence, reporting lines, and potential responsibilities for other control functions.\n                        <\/li>\n\n                        <li>\n                            Objectify the audit plan: starting point \u00abbusiness risks\u00bb, continuous review, validation by the audit committee.\n                        <\/li>\n\n                        <li>\n                            Structure the reporting towards an overall annual opinion, supported by a root-cause analysis.\n                        <\/li>\n\n                        <li>\n                            Document the adequacy of resources and skills for the most significant risks.\n                        <\/li>\n\n                    <\/ul>\n\n                <\/div>\n\n            <\/section>\n\n\n            <!-- 07 -->\n            <section class=\"arcad-section\">\n\n                <div class=\"arcad-number\" aria-hidden=\"true\">\n                    07\n                <\/div>\n\n                <div>\n\n                    <h2>Common pitfalls<\/h2>\n\n                    <ul>\n\n                        <li>\n                            Treating the Code as a mere compliance checklist, when it calls for professional judgement applied with proportionality.\n                        <\/li>\n\n                        <li>\n                            Confusing it with a binding standard \u2014 or, conversely, dismissing it on the grounds that it is not locally applicable.\n                        <\/li>\n\n                        <li>\n                            Maintaining an entity-based plan that dilutes the effort instead of focusing on major risks.\n                        <\/li>\n\n                        <li>\n                            Reducing the purpose of internal audit to mere protection alone, while neglecting its contribution to decision-making and value creation.\n                        <\/li>\n\n                    <\/ul>\n\n                <\/div>\n\n            <\/section>\n\n\n            <!-- 08 -->\n            <section class=\"arcad-section\">\n\n                <div class=\"arcad-number\" aria-hidden=\"true\">\n                    08\n                <\/div>\n\n                <div>\n\n                    <h2>The ARCAD approach<\/h2>\n\n                    <p>\n                        ARCAD supports internal audit functions \u2014 through establishment, assistance or outsourcing \u2014 to turn these frameworks into practical tools: maturity assessment, redesign of the charter and risk-based plan, structuring of reporting and the annual opinion, and quality assessment. ARCAD's approach favours independent and pragmatic internal audit, which protects value as much as it informs decision-making.\n                    <\/p>\n\n                <\/div>\n\n            <\/section>\n\n\n            <!-- \u00c0 RETENIR -->\n            <aside class=\"arcad-takeaway\">\n\n                <span class=\"arcad-takeaway-label\">\n                    To remember\n                <\/span>\n\n                <p>\n                    The CIIA Code of Practice is not binding on Luxembourg entities, but it sets a clear direction: enterprise risk-driven internal audit, equipped with an overall annual opinion and enhanced independence. Combined with the Global Internal Audit Standards (GIAS) and the CSSF framework, it offers a valuable maturity grid to strengthen the impact of the function.\n                <\/p>\n\n            <\/aside>\n\n\n            <!-- CTA -->\n            <section class=\"arcad-cta\">\n\n                <div>\n\n                    <div class=\"arcad-cta-title\">\n                        Position your internal audit function with regard to these reference frameworks.\n                    <\/div>\n\n                    <p>\n                        A targeted and pragmatic maturity assessment to identify your priority gaps.\n                    <\/p>\n\n                <\/div>\n\n                <a\n                    class=\"arcad-button\"\n                    href=\"mailto:administration@arcad.lu?subject=Demande%20d'\u00e9change%20-%20Code%20CIIA%20%26%20audit%20interne\"\n                >\n                    Schedule an exchange \u2192\n                <\/a>\n\n            <\/section>\n\n\n            <!-- SOURCES -->\n            <section class=\"arcad-sources\">\n\n                <h3>References &amp; further reading<\/h3>\n\n                <ul>\n\n                    <li>\n                        <em>Internal Audit Code of Practice<\/em>, Chartered Institute of Internal Auditors, September 2024 (applicable from January 2025).\n                    <\/li>\n\n                    <li>\n                        Global Internal Audit Standards (GIAS) and International Professional Practices Framework (IPPF), Institute of Internal Auditors.\n                    <\/li>\n\n                    <li>\n                        CSSF internal audit requirements applicable to concerned regulated entities (credit institutions and investment firms, AIFMs, professionals of the financial sector (PFS), payment institutions).\n                    <\/li>\n\n                <\/ul>\n\n                <p class=\"arcad-scope\">\n                    Note: good practice to be adapted to the profile, size and regulatory framework specific to each organisation. ARCAD illuminates and structures the approach; it does not replace the client's own analysis.\n                <\/p>\n\n            <\/section>\n\n\n        <\/div>\n\n    <\/div>\n\n<\/article>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>The cyber audit must articulate an approach based on business risks, the requirements of the IIA cybersecurity framework and the DORA regulatory baseline applicable to regulated entities.<\/p>","protected":false},"author":2,"featured_media":7485,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[1],"tags":[28],"class_list":["post-7475","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-audit-interne"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.3.1 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Code de pratique du CIIA : rep\u00e8re pour l\u2019audit interne<\/title>\n<meta name=\"description\" content=\"D\u00e9couvrez le Code de pratique du CIIA et ses apports pour l\u2019audit interne : risques, ind\u00e9pendance, opinion annuelle et application au Luxembourg.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/arcad.lu\/en\/code-pratique-ciia-audit-interne\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Code de pratique du CIIA : rep\u00e8re pour l\u2019audit interne\" \/>\n<meta property=\"og:description\" content=\"D\u00e9couvrez le Code de pratique du CIIA et ses apports pour l\u2019audit interne : risques, ind\u00e9pendance, opinion annuelle et application au Luxembourg.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/arcad.lu\/en\/code-pratique-ciia-audit-interne\/\" \/>\n<meta property=\"og:site_name\" content=\"ARCAD\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-17T12:25:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-17T12:43:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/ciia.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1155\" \/>\n\t<meta property=\"og:image:height\" content=\"681\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Bastien Decerfou\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Bastien Decerfou\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/\",\"url\":\"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/\",\"name\":\"Code de pratique du CIIA : rep\u00e8re pour l\u2019audit interne\",\"isPartOf\":{\"@id\":\"https:\/\/arcad.lu\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/ciia.png\",\"datePublished\":\"2026-08-17T12:25:05+00:00\",\"dateModified\":\"2026-08-17T12:43:11+00:00\",\"author\":{\"@id\":\"https:\/\/arcad.lu\/#\/schema\/person\/a087acd8a15d5a534096ac1bf3efc524\"},\"description\":\"D\u00e9couvrez le Code de pratique du CIIA et ses apports pour l\u2019audit interne : risques, ind\u00e9pendance, opinion annuelle et application au Luxembourg.\",\"breadcrumb\":{\"@id\":\"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/#primaryimage\",\"url\":\"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/ciia.png\",\"contentUrl\":\"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/ciia.png\",\"width\":1155,\"height\":681},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/arcad.lu\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Code de pratique du CIIA : un nouveau rep\u00e8re pour l&rsquo;audit interne\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/arcad.lu\/#website\",\"url\":\"https:\/\/arcad.lu\/\",\"name\":\"ARCAD\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/arcad.lu\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/arcad.lu\/#\/schema\/person\/a087acd8a15d5a534096ac1bf3efc524\",\"name\":\"Bastien Decerfou\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/arcad.lu\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2a433ec2c9f0bf45bb4133ffe92fc6404b0bb82145096ad97e743c259599c627?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2a433ec2c9f0bf45bb4133ffe92fc6404b0bb82145096ad97e743c259599c627?s=96&d=mm&r=g\",\"caption\":\"Bastien Decerfou\"},\"url\":\"https:\/\/arcad.lu\/en\/author\/bdecerf\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"IIA Code of Ethics: A benchmark for internal auditing","description":"Discover the IIA Code of Ethics and its benefits for internal audit: risks, independence, annual opinion and application in Luxembourg.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/arcad.lu\/en\/code-pratique-ciia-audit-interne\/","og_locale":"en_GB","og_type":"article","og_title":"Code de pratique du CIIA : rep\u00e8re pour l\u2019audit interne","og_description":"D\u00e9couvrez le Code de pratique du CIIA et ses apports pour l\u2019audit interne : risques, ind\u00e9pendance, opinion annuelle et application au Luxembourg.","og_url":"https:\/\/arcad.lu\/en\/code-pratique-ciia-audit-interne\/","og_site_name":"ARCAD","article_published_time":"2026-08-17T12:25:05+00:00","article_modified_time":"2026-08-17T12:43:11+00:00","og_image":[{"width":1155,"height":681,"url":"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/ciia.png","type":"image\/png"}],"author":"Bastien Decerfou","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Bastien Decerfou","Estimated reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/","url":"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/","name":"IIA Code of Ethics: A benchmark for internal auditing","isPartOf":{"@id":"https:\/\/arcad.lu\/#website"},"primaryImageOfPage":{"@id":"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/#primaryimage"},"image":{"@id":"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/#primaryimage"},"thumbnailUrl":"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/ciia.png","datePublished":"2026-08-17T12:25:05+00:00","dateModified":"2026-08-17T12:43:11+00:00","author":{"@id":"https:\/\/arcad.lu\/#\/schema\/person\/a087acd8a15d5a534096ac1bf3efc524"},"description":"Discover the IIA Code of Ethics and its benefits for internal audit: risks, independence, annual opinion and application in Luxembourg.","breadcrumb":{"@id":"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/#primaryimage","url":"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/ciia.png","contentUrl":"https:\/\/arcad.lu\/wp-content\/uploads\/2026\/08\/ciia.png","width":1155,"height":681},{"@type":"BreadcrumbList","@id":"https:\/\/arcad.lu\/code-pratique-ciia-audit-interne\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/arcad.lu\/"},{"@type":"ListItem","position":2,"name":"Code de pratique du CIIA : un nouveau rep\u00e8re pour l&rsquo;audit interne"}]},{"@type":"WebSite","@id":"https:\/\/arcad.lu\/#website","url":"https:\/\/arcad.lu\/","name":"ARCAD","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/arcad.lu\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/arcad.lu\/#\/schema\/person\/a087acd8a15d5a534096ac1bf3efc524","name":"Bastien Decerfou","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/arcad.lu\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/2a433ec2c9f0bf45bb4133ffe92fc6404b0bb82145096ad97e743c259599c627?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2a433ec2c9f0bf45bb4133ffe92fc6404b0bb82145096ad97e743c259599c627?s=96&d=mm&r=g","caption":"Bastien Decerfou"},"url":"https:\/\/arcad.lu\/en\/author\/bdecerf\/"}]}},"_links":{"self":[{"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/posts\/7475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/comments?post=7475"}],"version-history":[{"count":8,"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/posts\/7475\/revisions"}],"predecessor-version":[{"id":7486,"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/posts\/7475\/revisions\/7486"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/media\/7485"}],"wp:attachment":[{"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/media?parent=7475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/categories?post=7475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/arcad.lu\/en\/wp-json\/wp\/v2\/tags?post=7475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}