The IIA's Artificial Intelligence Auditing Framework
The IIA's AI Auditing Framework gives internal auditors principles-based guidance for assessing an organization's AI governance, risk management, and controls. It covers AI risk from strategy and governance through model development, deployment, and monitoring, including generative AI and large language models. It is intended for internal audit functions, chief audit executives, and audit committees performing assurance or advisory engagements on AI use, and it is explicitly structured around the IIA's Three Lines Model.
The IIA's AI Auditing Framework gives internal auditors principles-based guidance for assessing AI governance, risk, and controls, structured around the IIA's Three Lines Model. First issued in 2017 and substantially updated in 2023 and 2024, it covers generative AI risk and is voluntary professional guidance, not law.
- Issuing body
- The Institute of Internal Auditors (IIA)
- Official reference
- www.theiia.org/en/content/tools/professional/2023/the-iias-u
What it covers
- Organizes AI oversight into three domains aligned to the Three Lines Model: governance (setting AI policies, expectations, and ethical boundaries), management (building and using AI responsibly), and internal audit (independent assurance and advisory)
- Covers generative AI and large language model risks alongside traditional AI/ML risk
- Includes a practitioner's guide and checklist internal auditors can use to begin assessing how an organization approaches, uses, manages, and reports on AI
- Addresses data governance, algorithm, and cybersecurity controls as part of AI risk coverage
- Aligns with the IIA's International Professional Practices Framework (IPPF) and references external frameworks such as the NIST AI RMF
- First issued in 2017 as a three-part Global Perspectives and Insights series, then substantially updated in 2023 and again in September 2024 to reflect generative AI and evolving regulatory expectations
Adoption status
Issued by the IIA, a global professional association for internal auditors, most recently updated September 2024. It is voluntary professional guidance, not law or regulation, used internationally by internal audit functions rather than mandated by any government, and following it does not constitute or guarantee compliance with any legal or regulatory requirement.
Reference only. This page explains what IIA AI Auditing Framework covers; it is not a claim that Model Governance Index or any listed vendor satisfies it. Verify alignment directly against the issuing body's own current text before relying on it.
Sources. source 1 · source 2 · source 3. Data as of 2026-07-13. See methodology.