The IIA Style Guide
(Revised July 2016)
The IIA Style Guide was developed after careful consideration of The Institute’s editorial needs and is
intended to ensure consistency of editorial style and usage across Institute publications. It applies to all IIA
print and online publications, as well as social media — though in light of length restrictions on some
platforms (e.g., Twitter) and other factors, adhering to the Style Guide may not always be feasible with
social media content. A separate document will be available shortly with guidance specific to social media
usage.
Appendix sections of this guide are designed to meet the specific needs of The IIA’s Standards and
Guidance, Curriculum Development, and Conferences materials. In some cases, these sections include
exceptions to the main IIA guide. Note that the appendices apply only to their respective areas.
The IIA recognizes the Associated Press (AP) Stylebook as its primary reference for grammar and style
issues. The IIA Style Guide is intended to show exceptions to AP style or address areas not covered by AP.
For items not covered in either reference, refer to Webster’s New World College Dictionary. The AP
Stylebook is available online — many IIA employees have subscribed to the web-based version. Webster’s
New World College Dictionary is also available through AP as a bundled subscription with the AP
Stylebook. To order an online subscription, visit www.apstylebook.com.
Use references in this order:
• The IIA Style Guide
• AP Stylebook
• Webster’s New World College Dictionary
For items not covered in the above listed references, contact Style Committee Chair David Salierno
Table of Contents
Main IIA Guide
Acronyms and Abbreviations
• Common Abbreviations and Acronyms
• Exceptions
• Plurals
• Sarbanes-Oxley
• Dodd-Frank
Bullets
Capitalization
• Big Four
• Boards, Committees, and Departments
• Hyphenated Words
• The IIA
• IIA Qualification and Certifications
• Job Title
• Normally Lowercased Words
Commas
COSO
Credentials/Degrees
Dates
• Months
• Years
Footnotes
Hyphens and Dashes
• Common Hyphenated (and
Nonhyphenated) Words
• En Dashes
• Em Dashes
IIA References
• IIA Chapters and Institutes
IIA Specialty Audit Centers
• Center Members
• EHSAC Note
• IIA-Canada Note
Internal Audit
• Audit Department
• Internal Audit vs. Internal Auditing
IPPF and Related Documents
• Core Principles for the Professional
Practice of Internal Auditing
• Global Technology Audit Guide (GTAG)
• Guide to the Assessment of IT Risk
(GAIT)
• Implementation Guides and Practice
Advisories
• International Professional Practices
Framework (IPPF)
• Position Papers
• Practice Guides
• Standards
IT Terms and Usage
Italicized Terms
Measurements and Currency
Phone Numbers
Preferred Words and Phrases
• Big Four
• Listed vs. Public Companies
• Sensitivity to Global Audience
Spacing
Times
Trademarks and Registration Marks
Web References
Appendix A: Standards and Guidance
Implementation Guides/Implementation
Guidance
• Content
• “Must” and “Should”
• Referencing
Supplemental Guidance/Practice Guides
• Content
• Dates
Standards
• “Must”
• Number and Title
• Dates
Preferred Terminology
• Audit Activity
• CAE
• Charter
• Governing Body
• Government
• U.S. States
Technical Writing Guidelines for All IPPF
Guidance
• Global Considerations
• Paragraph and Sentence Length
• Standard Font
• Third-person Perspective
• Writing Voice: Active vs. Passive
Appendix B: Curriculum Development
Facilitator and Participant Guides
• Appendices
• Copyright
• Facilitator Guide
• Facilitator Notes
• Participant Guide
• Participants
• References
General
• Complete Sentences
• Expected Responses
• Tables, Diagrams, Images, and
Flowcharts
Appendix C: Conferences
Abstracts
Biographies
• General
• Speaker’s Name
• Job Title
• Company Name
• Education and Designations
• IIA Membership
• Other
Brochure Matrix
• Program Guide Matrix
Dates and Times
Session Titles
• Two-part Sessions
Main IIA Guide
ACRONYMS AND ABBREVIATIONS
In general, try to avoid overuse of abbreviations and acronyms (i.e., avoid alphabet soup). Instead of
introducing an acronym or abbreviation, a generic word such as agency, commission, or company is often
more appropriate and less jarring to the reader.
Spell out most acronyms and abbreviations on first reference, followed by the abbreviation in parentheses.
Use only the abbreviation on subsequent references.
EXAMPLE:
The chief information officer (CIO) called a meeting. Everyone invited gathered in the CIO’s
office.
If a term/phrase is used only once in the document, do not use an acronym or abbreviation — spell it out
the one time it appears. (See Exceptions below for terms that do not need to be spelled out, even on first
reference.)
Common Abbreviations and Acronyms
Below is a list of commonly used abbreviations that must be spelled out on first reference.
• ACL – access control list (Note: Do not spell out when referring to the audit software product)
• CAE - chief audit executive
• CFO – chief financial officer
• CIA – Certified Internal Auditor (however, do not spell out if listed as a credential after someone’s
name)
• CIO – chief information officer
• CIPFA – Chartered Institute of Public Finance and Accountancy
• COO – chief operating officer
• COSO – The Committee of Sponsoring Organizations of the Treadway Commission (See “COSO”
for further guidance)
• CPD – continuing professional development
• CPE – continuing professional education
• CSO – chief security officer
• DOS – denial-of-service (attack)
• GAAP – Generally Accepted Accounting Principles
• GTAG – Global Technology Audit Guide
• ID – identification
• IFAC – International Federation of Accountants
• IIA (See “IIA References” for further guidance)
• IM – instant messaging
• INTOSAI – The International Organization of Supreme Audit Institutions
• IP – internet protocol
• ISO – International Organization for Standardization (e.g., The International Organization for
Standardization (ISO) 17799 Standard)
• ITIL – IT infrastructure library
• LAN – local area network
• NIST – National Institute of Standards and Technology
• PCAOB – U.S. Public Company Accounting Oversight Board
• SDLC – systems development life cycle
• SEC – U.S. Securities and Exchange Commission
• SLA – service-level agreement
• SQL – structured query language
• SSID – service set identifier
• TCP – transmission control protocol
• US-CERT – U.S. Computer Emergency Readiness Team
• VoIP – voice over internet protocol
• WAN – wide area network
• WiMax – Worldwide Interoperability for Microwave Access
Exceptions
There is no need to spell out the following terms, even on first reference.
• CEO
• COBIT (Note: ISACA states that COBIT is the official name of the framework — do not spell out,
even on first reference. Always just use COBIT. Do not italicize.)
• C-suite
• FTP – File Transfer Protocol
• HTTP (lowercase in Web addresses)
• IT
• PC
• plc (plc stands for public limited company, similar to Inc. or Ltd., and should be written in
lowercase letters with no period following the company name)
• TV
• U.K. (See U.S. below)
• URL
• U.S. (only when used as an adjective — e.g., the U.S. president saluted the flag). Spell it out when
used as a noun (e.g., he traveled to the United States.) Same with U.K.
• USA (when used as part of an address)
• User ID (no need to spell out ID when used with user ID)
• Wi-Fi
Plurals
If an abbreviation is used in plural form when first introduced, add a lowercase “s” to the end of it.
Thereafter, continue to use the lowercase “s” as applicable.
EXAMPLE:
More than 100 chief audit executives (CAEs) responded to the recent survey. Only one CAE
offered a complaint. The other CAEs posted positive comments.
Sarbanes-Oxley and Dodd-Frank
U.S. Sarbanes-Oxley Act of 2002 on first reference, Sarbanes-Oxley thereafter. Do not use abbreviations
such as SOX or SARBOX.
Sarbanes-Oxley Section 404 (no comma)
Dodd-Frank
Spell out in full on first reference: U.S. Dodd-Frank Wall Street Reform and Consumer Protection Act. Use
Dodd-Frank thereafter.
BULLETS
Always capitalize the first word in a bulleted item, and always place a period at the end of each bulleted
item.
EXAMPLE:
We used many tactics to calm the dog:
• Shelli gave him a bone.
• Dave sang to him.
• Christina brushed his fur.
EXAMPLE:
At the picnic, we will need:
• Paper plates.
• Colorful napkins.
• Styrofoam cups.
Avoid ending the sentence preceding a bulleted list with the following.
(See Appendix B for Curriculum Development’s alternate treatment of bulleted lists.)
CAPITALIZATION
In general, avoid unnecessary capitals.
Big Four
Big Four is capitalized when referring to the Big Four accounting firms.
(See “Preferred Words and Phrases” below for more information on referring to Big Four accounting
firms.)
Boards, Committees, and Departments
Committees, task forces, boards, and departments are not capitalized when they are used generically.
EXAMPLES:
This book is marketed toward audit committee members.
The board of directors helps govern company operations.
The new company needs to establish an accounts payable department.
Audit Committee and Board of Directors are capitalized when they refer to a specific organization’s
committee or board.
EXAMPLES:
The General Motors Audit Committee
The Board of Directors for Xerox
The Professional Certifications Board approved the new Certified Internal Auditor exam syllabus.
Do not capitalize abbreviated references, such as the board or the committee, even if they refer to a specific
organization’s committee or board.
EXAMPLE:
The board at General Motors
Capitalize the full department name, including the word Department, when referring to the formal title of a
department at a specific company.
EXAMPLE:
Google’s Human Resources Department
(See “Internal Audit” below for information on how to refer to an internal audit department.)
Hyphenated Words
For hyphenated words in a title, or when part of a proper noun in regular text, lowercase the word after the
hyphen. (Note: “Certification in Control Self-Assessment” is an exception to this rule, as it is a registered
name.)
EXAMPLE:
Knowledge-sharing Process
The IIA
Capitalize IIA conference and seminar titles.
(See “IIA References” for rules regarding capitalization of “The” and when to abbreviate “IIA”)
(See “IIA Guidance and Related Documents” for document capitalization rules as well as information on
Implementation Guides, Practice Advisories, Position Papers, and Practice Guides.)
IIA Qualification and Certifications
IIA designations have registered names and should be capitalized as such:
Certified Internal Auditor (CIA)
Qualification in Internal Audit Leadership (QIAL)
Certification in Control Self-Assessment (CCSA)
Certification in Risk Management Assurance (CRMA)
Certified Financial Services Auditor (CFSA)
Certified Government Auditing Professional (CGAP)
Certified Professional Environmental Auditor (CPEA)
Certified Process Safety Auditor (CPSA)
Capitalize references to the certification or qualification itself and to those who possess it.
EXAMPLES:
Certified Internal Auditor exam
Certified Internal Auditor designation
John is a Certified Internal Auditor.
Generic references to someone who possesses an internal audit certification should be lowercased (e.g.,
John holds an internal audit certification).
(See “Credentials/Degrees” below for information on how to list IIA and other designations after an
individual’s name.)
Job Title
Capitalize a person’s title if it is a line item (stands alone on a line).
EXAMPLE:
John Smith
Internal Audit Manager
Jefferson Wells Inc.
Within regular body copy, however, follow AP, which says to capitalize titles only if they appear directly
before a person’s name.
EXAMPLE:
Internal Audit Director John Smith led the meeting.
Do not capitalize job titles after a person’s name.
EXAMPLE:
John Smith, internal audit director for Dow Chemical, gave a presentation.
Do not capitalize internal auditor unless it’s used as part of a formal title preceding someone’s name.
Normally Lowercased Words
For company names that are all lowercase, capitalize the first letter of the name only if it falls at the
beginning of a sentence or headline.
EXAMPLE:
EBay is an e-commerce company.
COMMAS
Always use a comma before and in a series.
Right: I have dogs, cats, and mice.
Wrong: I have dogs, cats and mice.
(See “EHSAC Note” regarding an exception to this rule when referring to environmental, health and
safety.)
COSO
When referring to one of the COSO frameworks, spell out everything in full on first reference (abbreviate
committee name as “COSO” in parentheses immediately afterward if subsequent references appear and
then just use “the framework” or “the COSO framework” thereafter). Use italics for framework title.
EXAMPLE:
Our methodology was based on The Committee of Sponsoring Organizations of the Treadway
Commission’s (COSO’s) Internal Control–Integrated Framework (2013).
CREDENTIALS/DEGREES
Limit credentials to no more than five, total, for each individual.
Do not list masters- or undergraduate-level designations (e.g., MBA, BA).
When listing credentials after someone’s name, always place doctoral titles (e.g., PhD, JD) first. IIA
designations should appear second (CIA followed by QIAL, and then other IIA designations in alphabetical
order). Non-IIA credentials should always appear last (CPA should be listed first among non-IIA
designations).
EXAMPLE:
John Smith, PhD, CIA, QIAL, CRMA, CPA
Registration symbols (
®
,
TM
) should not be used in credentials that appear with an individual’s name. Refer
to The IIA’s Brand Standards Manual for information on how and when registration symbols should be
used.
(See Appendix C for treatment of credentials in Conferences materials.)
DATES
Months
Abbreviate months rather than using numerals.
EXAMPLE:
Nov. 4 instead of 11-4 (11-4 could be confused with April 11 in some countries).
Spell out months when used alone, or when just year/month appear.
Avoid seasonal references (geographically speaking, one person’s winter is another’s summer). Use names
of specific months, or quarters, instead.
(See Appendix A for the IPPF’s exception to AP style regarding months.)
Years
Use all four digits when referring to years, or to a span of years.
EXAMPLE:
From 2015 to 2016
However, when referencing a span of years separated by a dash, use only the last two digits at the end of
the span.
EXAMPLE:
2015–16
FOOTNOTES
To give general credit to the original source of an idea, cite basic identifying information within the
document text (instead of using a footnote) wherever possible.
EXAMPLE:
Operational managers are part of the first line of defense, according to The IIA Position Paper “The
Three Lines of Defense in Effective Risk Management and Control,” published in 2013.
Where a detailed citation is needed, such as quotations or terms listed in guidance and CBOK reports,
follow The Chicago Manual of Style and include full details in a footnote at first mention of cited work
(examples of Chicago style applied to different publication types appear below).
Book
Author (first name followed by last name, or name of issuing body), Book Title in Italics (Publisher city:
Publisher name, date), page numbers.
EXAMPLE: Kurt F. Reding, et al. Internal Auditing: Assurance and Advisory Services
(Altamonte Springs: The Institute of Internal Auditors Research Foundation, 2013), 5-16–5-17.
Journal, Magazine, or Newspaper Article
Author (first name followed by last name, or name of issuing body), “Article Title in Quotation Marks.”
Title of Magazine/Journal Italicized, volume number (if applicable), publication date, page number(s).
Note: If retrieved online, also add website after the date, followed by date accessed in parentheses.
EXAMPLE: Ruth Prickett, “Billion Dollar Questions,” Audit & Risk, January/February 2014,
15–17, http://auditandrisk.org.uk/features/billion--dollar--questions (accessed June 20, 2016).
Website
Author (first name followed by last name, or name of issuing body), “Article Title in Quotation Marks,”
Title of Website Italicized, website address (access date).
EXAMPLE: ISACA, “ISACA Glossary of Terms,” ISACA, 2015, 29.
http://www.isaca.org/Knowledge-Center/Documents/Glossary/glossary.pdf (accessed June 20,
2016).
HYPHENS AND DASHES
Common Hyphenated (and Nonhyphenated) Words
anti-spam
anti-spyware
agreed-upon (adj.)
client-server
cosource (not co-source)
co-sponsor (hyphenate when it refers to a person), cosponsored by health care
counter-party (derivatives term)
decision-making (adj., noun); decision-maker
e-commerce
eLearning (when referring to IIA online learning)
enterprise risk management (not hyphenated)
enterprisewide
eSeminars (when referring to IIA online courses)
flowchart (noun), flow-chart (verb)
health care (noun), health-care (adj.)
industrywide
Institute-wide (only when referring to IIA Global Headquarters)
interest rate (not hyphenated as a noun or adj.)
internal control (not hyphenated as a noun or adj.)
investment-contract language
non-interest-bearing (adj.)
on site (noun), on-site meeting (adj.)
organizationwide
public sector auditors
risk management (not hyphenated as a noun or adj.)
stale-dated checks
up-to-date (adj.)
whistleblower
workpapers
year-to-date (adj.)
En Dashes
Use an en dash (–) for durations (to separate numbers), and do not put a space before or after (4:00–5:00
p.m.)
EXAMPLE:
Right: The committee will meet on January 3–4, 2016.
Wrong: The committee will meet on January 3-4, 2016.
(Note: The en dash can be generated automatically in MS Word by typing a hyphen between two words,
with a space before and after the hyphen. MS Word will convert the hyphen to an en dash. Remove the
spaces before and after the dash. Alternatively, the en dash can be found under Insert /symbol/more
symbols/special characters/en dash; on the Mac — Insert/symbol/advanced symbol/special characters/en
dash
(See Appendix C for a Conferences exception regarding use of en dashes to separate numbers.)
Em Dashes
Use an em dash (—) to separate parts of a sentence, not hyphens or en dashes. There should be one space
on either side of the em dash.
EXAMPLE:
The internal auditor should — unless directed otherwise by the management — confer directly with
those responsible for processes and procedures.
Do not begin a line with an em dash.
EXAMPLE:
Right: He listed the qualities —
intelligence, humor, and
independence — that he
liked.
Wrong: He listed the qualities
— intelligence, humor,
and independence —
that he liked.
(Note: The em dash can be generated automatically in MS Word by typing two consecutive hyphens
between the words you’re looking to separate, without any spaces between the hyphens or the words. MS
Word will convert the hyphens to an em dash and place a space before and after it. Alternatively, the em
dash can be found under Insert/symbol/more symbols/special characters/em dash; on the Mac —
Insert/symbol/advanced symbol/special characters/em dash.)
IIA REFERENCES
The is capitalized in the following instances.
• The Institute
• The IIA
• The IIA Research Foundation (OK to abbreviate as The Research Foundation, The Foundation,
or The IIARF on subsequent references)
• The Foundation
• The IIA’s members
The is not capitalized when it is not used as part of The IIA’s name.
EXAMPLES:
Many of the IIA chapter members joined the conference.
IIA Global Headquarters
Write out The Institute of Internal Auditors when used in any nonmember communication, such as news
releases, thought-leadership papers, or Research Foundation publications targeted to nonmember
audiences. Place abbreviation (IIA) in parentheses immediately afterward if subsequent references appear
and then just use The IIA or The Institute thereafter.
For member communications/publications, there is no need to write out The Institute of Internal Auditors in
full, unless it is for copyright or other legal purposes. Use The IIA, even on first reference.
IIA Institutes and Chapters
When referring to IIA bodies outside North America collectively, use institutes. Refer to North American
IIA bodies as chapters.
Upon first mention, use IIA to specify that the groups are affiliated with The IIA.
EXAMPLES:
The IIA’s chapters and institutes
IIA chapters and institutes
For subsequent references, it’s OK to drop the IIA.
EXAMPLE:
The chapters and institutes have been working together consistently for a year.
Refer to a specific institute or international chapter as IIA–[Name] (use en dash instead of hyphen)
EXAMPLE:
IIA–Australia
Refer to a specific chapter as IIA–[Name of chapter] (use en dash instead of hyphen)
EXAMPLES:
IIA–Chicago Chapter
The IIA’s Chicago Chapter
As appropriate, refer to IIA chapters in North America or IIA North American chapters.
IIA SPECIALTY AUDIT CENTERS
As of May 2016, The IIA has four specialty audit centers and one specialty group.
• American Center for Government Auditing (ACGA)
• Audit Executive Center (AEC)
• Environmental, Health & Safety Audit Center (EHSAC)
• Financial Services Audit Center (FSAC)
• Gaming Audit Group
Upon first mention in copy, each should be preceded by The IIA’s and spelled out.
EXAMPLE:
The IIA’s American Center for Government Auditing (ACGA) was launched in 2014.
On subsequent references, either its acronym or “the Center” may be used.
Each center and its acronym carries trademark symbols, outlined in The IIA’s Brand Standards Manual.
The appropriate symbols should be used at the first mention in any marketing collateral being developed.
Subsequent mentions do not require the marks. This does not pertain to the website for each because each
is branded appropriately.
Center Members
Members of the Audit Executive Center, the Financial Services Audit Center, and the Gaming Audit Group
are referred to as internal auditors. Members of the American Center for Government Auditing and the
Environmental, Health & Safety Audit Center refer to themselves simply as auditors. Marketing collateral
should follow this nomenclature to relate to the members on a personal, familiar level.
EHSAC Note
The name of the center uses an acronym; however, when referring to the subject or profession itself, the
phrase should be “environmental, health and safety…” omitting the serial comma that is typical of IIA
style.
IIA‒Canada Note
IIA–Canada now also has a specialty audit center available in two languages (English and French). In
English, it’s the Canadian Public Sector Audit Centre (CPSAC); OK to use abbreviation or the Centre after
first reference. In French: Centre de l’audit – Secteur public canadien (le Centre). In Canada, the Centre’s
members are referred to as internal auditors.
INTERNAL AUDIT
Audit Department
When referring to a department, use internal audit department, audit department, department of internal
auditing, internal audit activity, internal audit group, audit group, internal audit function, audit function,
or internal audit. Do not use internal audit shop. Capitalize the full department name (including the word
Department) if it’s referring to the audit department at a specific company.
EXAMPLE:
Mary was director of the Internal Audit Department at General Electric.
Internal Audit vs. Internal Auditing*
Internal auditing and internal audit should always be spelled out, not abbreviated as IA.
When talking about the profession or discipline — used as a noun — use internal auditing.
EXAMPLES:
The practice of internal auditing . . .
The challenges associated with internal auditing . . .
The nature of internal auditing . . .
The profession of internal auditing …
Many students major in internal auditing.
When modifying another word — used as an adjective — use internal audit.
EXAMPLES:
internal audit department
internal audit function
internal audit profession
internal audit activity (This is how the audit function is referred to in the Standards. See Appendix
A for IPPF-specific usage of this term.)
*Exception: Use internal audit, not internal auditing, to refer to the function or department in an
organization:
EXAMPLES:
Mary worked with internal audit to identify her department's control weaknesses.
We need to confer with internal audit.
I work in internal audit.
When performed, it is an internal audit.
EXAMPLE:
She will conduct an audit of payroll.
Defer to individual company usage for formal department names/titles:
EXAMPLE:
John Smith is vice president of internal audit at ABC Corp.
IPPF AND RELATED DOCUMENTS
Core Principles for the Professional Practice of Internal Auditing
May abbreviate as Core Principles after first reference. Whenever possible, avoid the awkward construction
of using Core Principles (whether abbreviated or written out in full) as the subject of the sentence followed
by a verb. If using Core Principles as the subject of the sentence cannot be avoided, treat it as plural:
Preferred: The IIA released the Core Principles in 2015.
Avoid: The Core Principles were released in 2015.
Wrong: The Core Principles was released in 2015.
Global Technology Audit Guide (GTAG)
Spell out on first reference. Only use quotation marks around the complete title of each publication.
EXAMPLES:
The Global Technology Audit Guide (GTAG) series addresses IT issues.
“GTAG 17: Auditing IT Governance” provides guidance on IT governance.
GTAG 17 is a popular guide.
Guide to the Assessment of IT Risk (GAIT)
Spell out on first reference. Only use quotation marks around the complete title of each publication.
EXAMPLES:
Published in 2009, “The GAIT Methodology” is a guide to assessing the scope of IT general
controls using a top-down and risk-based approach.
“GAIT for IT General Control Deficiency Assessment”
The GAIT series
When referring to methodology itself, not a publication, lowercase and do not use quotation marks (the
GAIT methodology.)
Implementation Guides and Practice Advisories
(Note: As of July 2015, Practice Advisories are being transitioned to, and will eventually be replaced by,
Implementation Guides.)
Lowercase when referring to one or more nonspecifically, and capitalize when referring to the entire group
as a whole:
EXAMPLES:
I read two practice advisories yesterday.
Implementation Guides are replacing the Practice Advisories.
On first mention when referring to a specific practice advisory or implementation guide, include the full
name, number, and title and place in quotation marks.
EXAMPLES:
“Implementation Guide 1000: Purpose, Authority, and Responsibility”
“Practice Advisory 1000-1: Internal Audit Charter”
On subsequent references, drop the quotation marks.
EXAMPLES:
Practice Advisory 1000-1
Implementation Guide 1000
The implementation guide
For a large listing, such as on the website or in a chart, it is acceptable to abbreviate as IG 1000, IG 2000,
IG 3000, etc.
International Professional Practices Framework (IPPF)
Capitalize framework title, no italics. If just framework is used in subsequent references, it should be
lowercased.
Exception: When referring specifically to the book title, use italics (e.g., To purchase a copy of the
International Professional Practices Framework (IPPF) 2013 Edition, visit The IIA Research
Foundation Bookstore.)
Upon first occurrence, references to framework components (as well as the framework itself) generally
should be preceded by The IIA’s, except where obvious or redundant.
EXAMPLE:
The IIA’s International Professional Practices Framework
Capitalize, no italics, for the following IPPF components: Code of Ethics, Mandatory Guidance,
Recommended Guidance, Implementation Guidance, Supplemental Guidance, Code of Ethics, Definition
of Internal Auditing, Mission of Internal Audit, Core Principles for the Professional Practice of Internal
Auditing.
Position Papers
(Note: As of 2015, Position Papers are no longer part of the IPPF.)
Lowercase when referring to one or more nonspecifically, and capitalize when referring to the entire group
as a whole:
EXAMPLES:
The IIA Position Paper “The Three Lines of Defense in Effective Risk Management and Control”
Position Papers are no longer part of the IPPF.
The IIA plans to issue a new position paper in 2017.
Practice Guides
Lowercase when referring to one or more nonspecifically, capitalize when referring to the entire group as a
whole:
EXAMPLES:
I read two practice guides yesterday.
The IIA released a practice guide on the topic of fraud.
GAIT and GTAG are considered Practice Guides.
On first mention when referring to a specific practice guide, include the full name and the title in quotation
marks.
EXAMPLE:
The IIA Practice Guide “Formulating and Expressing Internal Audit Opinions” (On subsequent
references, use just the title in quotation marks or “the practice guide.”)
(Note: The abbreviation PG may be used internally, but it is not appropriate for publication.)
Standards
Write out and italicize the complete title, International Standards for the Professional Practice of Internal
Auditing, upon first reference. Use just Standards for subsequent references. Do not include Standards in
parentheses after the first reference.
Whenever possible, avoid the awkward construction of using Standards (whether abbreviated or written
out in full) as the subject of the sentence followed by a verb. If using Standards as the subject of the
sentence cannot be avoided, treat it as plural:
Preferred: The IIA updates the Standards periodically.
Avoid: The Standards are updated periodically.
Wrong: The Standards is updated periodically.
When referring nonspecifically to standards within the International Standards for the Professional
Practice of Internal Auditing, the word “standards” must be lowercased and unitalicized, and then it may
be treated as plural where appropriate.
EXAMPLES:
Many standards use the term must to specify an unconditional requirement.
He pointed to one standard that uses the term should.
Capitalize “Standard” and include the entire name of the standard when referencing a specific standard.
EXAMPLE:
IIA Standard 1300: Quality Assurance and Improvement Program (On subsequent references, use
“Standard 1300” or “the standard.”)
IT TERMS AND USAGE
anti-spam
anti-spyware
client-server
Cracking vs. hacking – Try to avoid using cracking; hacking is the preferred term.
Cyber – Per AP, try to avoid “cutesy” coinages using “cyber” as a prefix. It’s okay to use cybercrime,
cybercriminal, cyberattack, and cybersecurity. Treat the following as two words: cyber insurance, cyber
solutions, cyber resilience, cyber literacy, cyber awareness., cyber risk, cyber threat.
Downloadable – Avoid saying information is “downloadable” from the web, unless there is an actual
document for users to download. When referencing non-downloadable online content, you can say that
the content is “viewable” or “available” on the web.
Spam – Avoid using SPIM (spam over instant messaging) or SPIT (spam over internet telephony), unless
necessary.
Unix, not UNIX
user, not end user or end-user
username – Do not use username and user ID interchangeably. Username is what you use to login (e.g.,
username and password); user ID is the username and password combination.
viruses, worms, and Trojans – Capitalize when referring to their formal name (e.g., Mydoom).
work-around procedure
ITALICIZED TERMS
When a word or term is referred to as the word or term itself, it should be italicized.
EXAMPLES:
The term critical mass has come to be used metaphorically in many contexts.
Correctness and justness are not synonyms.
MEASUREMENTS AND CURRENCY
US$100
US$100 million
(To avoid confusion, use this format even for text intended for a North American/U.S.-based audience.)
When discussing U.S. measurements (inches, miles, gallons, etc.), provide metric equivalents in
parentheses, if possible. For temperatures, provide Celsius equivalent in parentheses after Fahrenheit temp.
PHONE NUMBERS
For phone numbers, use hyphens, not parentheses, for both national and international numbers.
EXAMPLES:
+1-407-830-7600, Ext. 1
+27-11-797-5338
(Note: The “+” symbol stands for the number anyone must dial for an international call (011 in the USA,
but differs by country). Always include “+” before phone numbers.)
When listing toll-free numbers, remember to include a direct number for overseas callers.
PREFERRED WORDS AND PHRASES
organization instead of company
résumé (to get the letter é on a PC, hold down CTRL and type the apostrophe key, then release CTRL and
type “e”; on a Macintosh, type option + e followed by the “e” key alone)
whistleblower
workpapers
Big Four
Always refer to the Big Four firms as follows:
EY
Deloitte
PricewaterhouseCoopers (It’s okay to use PwC on subsequent references.)
KPMG
Use alternate versions of these company names only if specified by an author, source, speaker, or press
release from a Big Four firm.
Listed vs. Public Companies
When referring to listed companies, do not say public companies, as readers may confuse this with
government organizations. Instead, use publicly held, publicly listed, or publicly traded.
Sensitivity to Global Audience
In light of The IIA’s global membership, avoid using idiomatic language. An idiom is generally a
colloquial metaphor specific to a certain culture or region, often requiring knowledge of cultural references.
Therefore, certain idioms used in the United States may not be recognized by readers outside North
America.
EXAMPLES:
back in the day
bent out of shape
early bird rates
get out of hand
jump the gun
(See “Months” and “Phone Numbers” for more information regarding sensitivity to a global audience.)
SPACING
Use one space between sentences.
TIMES
4:00 p.m. instead of 4 p.m.
Do not refer to Eastern Standard Time, as this may be confusing to readers outside North America; use
Eastern Time instead. (The meeting will be held at 10:30 a.m. ET.)
(See “Hyphens and Dashes” for date range style.)
TRADEMARKS AND REGISTRATION MARKS
The Marketing Department uses trademarks and registration marks on first reference (see The IA’s Brand
Standards Manual for further guidance on Marketing trademark symbol use). The Publications Department
includes a blanket statement about licensed trademarks in each periodical. Any other departments requiring
the use of trademarks and registration marks should consult the Brand Standards Manual.
WEB REFERENCES
Use “The IIA’s website” or “the IIA website.” Do not use “The IIA website”
Printed Content
When referring to an IIA website home page, write out the home page address in full. When referring to a
main (first-tier) landing page for one of the sites, write out the full home page address, followed by the link
for the specific page referenced.
EXAMPLES:
Visit The IIA’s website at www.theiia.org and click on “Certifications & Qualifications.”
For more information on Internal Auditor magazine, visit www.InternalAuditor.org.
To learn more about the CIA exam, visit “Certifications & Qualifications” at www.theiia.org.
If the IIA page referred to features a lengthy URL (i.e., deeper than one of the site’s first-tier landing
pages), consult The IIA’s GoToURLs spreadsheet, which includes a list of shortened URLs for IIA website
pages. If the page you’re citing appears in the listing, use the shortened URL provided. Otherwise, request
a shortened URL from Web Ops by submitting a Service Desk ticket.
When citing non-IIA websites, URLs should not exceed one line. For URLs beyond this length, a link
shortener such as Bit.ly can be used.
Online Content
If the document will appear on The IIA’s website or other online publication, provide an embedded link to
the specific location of any Web citations — it is not necessary to include navigation instructions for
readers in text. If the document will appear in Adobe Portable Document Format, place PDF in parentheses
directly after the link.
EXAMPLE:
The IIA’s brochure Adding Value Across the Board (PDF) explains how internal auditors
contribute to strong corporate governance.
Appendix A: Standards and Guidance
The International Professional Practices Framework (IPPF) is the conceptual framework that organizes
authoritative guidance promulgated by The IIA into the categories of Mandatory Guidance and
Recommended Guidance.
Mandatory Guidance is developed following an established due diligence process, which includes a period
of public exposure for stakeholder input. The mandatory elements of the IPPF are:
• Core Principles for the Professional Practice of Internal Auditing
• Definition of Internal Auditing
• Code of Ethics
• International Standards for the Professional Practice of Internal Auditing (Standards)
The Mission of Internal Audit describes internal audit’s primary purpose and overarching goal.
Achievement of the mission is supported by the entire IPPF, including the mandatory elements of the
Definition, Core Principles for the Professional Practice of Internal Auditing, the Code of Ethics, and the
Standards, as well as all Recommended Guidance.
Recommended Guidance is endorsed by The IIA through a formal approval process. It comprises
Implementation Guidance and Supplemental Guidance.
IMPLEMENTATION GUIDES/IMPLEMENTATION GUIDANCE
Implementation Guides assist internal auditors in achieving conformance with the Standards in a general
way. There is one IG per standard.
Content
Each Implementation Guide contains three sections: Getting Started, Considerations for Implementation,
and Considerations for Demonstrating Conformance.
“Must” and “Should”
Because Implementation Guidance is recommended, not mandatory, the term should is avoided and the
term must is not permitted.
Referencing
Implementation Guides may reference the Standards and other Implementation Guides, but informal
resources such as reference surveys or web pages are avoided.
SUPPLEMENTAL GUIDANCE/PRACTICE GUIDES
Practice Guides are Supplemental Guidance. Subcategories of Practice Guides include Practice Guides‒
Financial Services, Practice Guides‒Public Sector, Global Audit Technology Guides, and Guides to the
Assessment of IT Risks.
Content
Practice Guides contain detailed guidance for conducting internal audit activities. Content may include
detailed processes and procedures, such as tools and techniques, programs, and step-by-step approaches,
including examples and templates of deliverables, which are typically presented as part of an appendix.
Dates
At the end of every practice guide, the month and year of publication is listed.
STANDARDS
“Must”
As the Standards represents mandatory components of the IPPF, use must when describing requirements.
Use of the term must is limited to the Standards.
Number and Title
When citing a standard and its title, capitalize the word “standard,” followed by the number and an en dash
(–) with one space before and after it. Use title caps for the title.
EXAMPLE:
Standard 1010 – Recognition of Code of Ethics and the Standards in the Internal Audit Charter
(Note: This style varies somewhat from the main IIA style guide, which uses a colon to reference
individual standards)
Dates
Do not abbreviate the month.
EXAMPLE: January (not Jan.)
PREFERRED TERMINOLOGY
Audit Activity
When referring to the audit activity, be sure to identify internal or external.
EXAMPLE:
The internal audit activity performs the interview.
The external audit activity completes the report.
When referring to a generic department, use internal audit activity. Do not use internal audit department
or internal audit function.
EXAMPLE:
The internal audit activity should be independent.
CAE
Use chief audit executive to refer to the senior position within the organization responsible for internal
audit activities.
Charter
When referring to a charter, specify the type of charter.
EXAMPLE:
Internal Audit Charter
Audit Committee Charter
Governing Body
Use senior management and board when referring to an organization’s governing body.
Government
Use public sector instead of government
U.S. States
When referring to U.S. states, include the country name afterward on first reference.
EXAMPLE:
Florida, United States
TECHNICAL WRITING GUIDELINES FOR ALL IPPF GUIDANCE
Global Considerations
• Guidance should be written with a global audience in mind and should avoid the use of slang and
jargon words, country-specific phrases, multiple prepositional phrases in a row, and so on. The
purpose of guidance is to explain complex issues in a clear and simple way that can be easily
understood by the whole target audience, including those whose first language is not English.
Sentences and paragraphs should be concise, direct, and easily translatable, using active subject-
verb construction and third-person point-of-view.
• Abbreviations and acronyms should also be kept to a minimum for ease and clarity in translation.
• Any technical words or jargon that cannot be avoided should be defined within the text of the
guidance. Some types of guidance may include a glossary.
• Be cognizant of referencing and aging; do not use words that could become outdated (e.g., recent,
currently).
• Where there is a conflict in spelling of words between the North American and International
versions (e.g., defense and defence; check and cheque), the International English spelling is
preferable unless an alternate word can be used that does not introduce confusion to an international
audience.
Paragraph and Sentence Length
In general, paragraphs should be five sentences or less. Sentences should be as concise as possible,
generally 20 words or less. Writing sentences in active voice helps keep them concise. Break long
sentences into two; break long paragraphs into multiple smaller paragraphs.
Standard Font
Use Arial 12 font when creating guidance.
Third-person Perspective
EXAMPLES:
First person: The subject narrates the story (e.g., “I recommend ….”).
Second person: The subject is being spoken to (e.g., “You need to recommend ….”).
Third person: The subject is being spoken about. (“He, she, or they need(s) to recommend(s) ….”
“The internal auditor recommends ….”)
Writing Voice: Active vs. Passive
Choosing to use active or passive voice may depend upon the content and context of a sentence. Wherever
possible, favor using an active (A) voice, rather than a passive (P) one:
EXAMPLES:
A – The internal auditor recommends …..
P – It is recommended that ….
A – John hammered the nail into the sign.
P – The nail was hammered by John into the sign.
Appendix B: Curriculum Development
To see a comprehensive list of style preferences for training materials developed by the Learning Solutions
team, please contact Curriculum Development for a copy of their style guide.
FACILITATOR AND PARTICIPANT GUIDES
Appendices
Some courses will require additional text and/or external materials; these items should be placed in an
appendix. The appendix should be treated like it is another unit of the course as far as page numbering, font
treatment, spacing, etc. Any articles or external materials included in the appendix should be placed after
the supplemental text.
Copyright
A blanket legal statement regarding copyright is included in each printed publication produced by
Curriculum Development.
Facilitator Guide
References to the facilitator guide should be lowercase and spelled out upon first reference,* followed by
FG in parentheses. Abbreviate to FG after first reference.
(Note: facilitator’s guide is incorrect.)
Facilitator Notes
In the FG, notes for the facilitator will appear in boxes below the text to which each box applies. These
boxes are removed in the participant guide.
Participant Guide
References to the participant guide should be lowercase and spelled out upon first reference,* followed by
PG in parentheses. Abbreviate to PG after first reference.
(Note: participants’ guide is incorrect.)
Participants
Do not include “the” with references to participants.
EXAMPLE:
Right: Direct participants in a discussion of continuous auditing.
Wrong: Ask the participants what questions they may have.
References
Use the Publication Manual of the American Psychological Association, Sixth Edition, format for all
citations. Citations should be inserted as footnotes on the bottom of the pages on which the references
appear.
GENERAL
Complete Sentences
All curriculum material should be written in complete sentences. Do not use sentence fragments or
shorthand symbols.
EXAMPLES:
Wrong: The # of participants will directly affect …
Discuss question. Possibilities — endless.
Coordinate groups + promote discussion.
(Note: Incomplete sentences can be used in bulleted and numbered lists.)
Expected Responses
Expected response lists should be bulleted. The items can either be all complete sentences (with a period)
or all incomplete sentences, but must be consistent within each heading.
EXAMPLES:
Expected Responses:
• Not very often
• Occasionally
• Too infrequent to count
Expected Responses:
• The auditor should know the difference.
• The auditor should inform management.
• There is no right or wrong answer.
If there is only one answer, use the following format.
EXAMPLE:
Expected Response: The chief audit executive
Tables, Diagrams, Images, and Flowcharts
When possible, these items should use the IIA colors and font. They should be labeled according to unit
(when applicable) and table/diagram/image/flowchart number.
*“First reference” refers to content only. It does not refer to titles, headings, or learning objectives.
Appendix C: Conferences
ABSTRACTS
As of 2016, web pages for conference sessions will include an abstract — a paragraph summarizing the
session from a high-level perspective — which should precede the bullets or learning objectives of the
session. This paragraph should be engaging, dynamic, and creative to attract attendee interest and should be
approximately 65 words, or four lines of text — about the length of this paragraph, which is 65 words.
GOOD EXAMPLE: Many trends, technological advancements, and new ideas that have an impact on
internal auditors the private sector and private enterprise also affect auditors in the public sector. With
budget and resource restraints often greater than their private enterprise counterparts, public sector auditors
must be aware of these trends and grasp their potential implications, to add value to their services now, and
build qualified leaders for tomorrow.
BAD EXAMPLE: Chris Smith from LMNO Enterprises will discuss auditing third-party contracts, how to
audit culture, how to meet stakeholder demands, and the differences between internal audit and internal
auditing. This session will provide attendees an opportunity to learn about Smith’s 30 years of experience
and his company, which has annual sales of $30 billion, producing widgets used by every country around
the world.
Always use a bulleted list beginning with a verb in response to the lead-in statement: “In this session,
participants will:” and end each bullet with a period.
EXAMPLE:
In this session, participants will:
• Learn about Sarbanes-Oxley and how it affects an organization.
• Find out about how Sarbanes-Oxley can help with enterprise risk management (ERM) planning.
• Practice with the information shared with regard to Sarbanes-Oxley and ERM.
• Share best practices with colleagues in a question and answer session.
Try to keep the list at four bullets for consistency.
Always spell out terms on first reference in each abstract. Because the abstracts are posted online
individually, it is not acceptable to abbreviate only the first reference for the entire document.
If the abstract includes multiple parts, use the following format.
EXAMPLE:
• Get an insider’s look into how you can benefit from this program when you:
o Excel at learning about it.
o Master your technique for performing it.
o Remind others to use it daily.
NASBA Fields of Study must be listed in the pocket guide and on the website as applicable.
BIOGRAPHIES
General
Biographies should be approximately 100 words. Exclude education background unless speaker is a
faculty member. Do not repeat speaker’s job in bio’s first sentence; rather explain their responsibilities in
general terms or areas of oversight. Lowercase job titles. Unless it serves to clarify, omit years of service
(“Smith worked at XYZ Consultants for six years prior to joining ABC Corporation” is preferred over
“Smith worked at XYZ Consultants from 2009‒15 before joining ABC Corporation.”)
Do not place the words “Panel” or “Moderator” in all caps.
EXAMPLE:
Right: Panel
Wrong: PANEL
Alternate loosely between using the speaker’s last name and he/she through the bio.
EXAMPLE:
Joseph D. Smith Jr., Ph.D., CIA, CCSA, CPA, CISA
Director, Internal Audit and Vice President
Legg and Mason Inc.
Moderator: Peter D. Jacobs III, CIA, CPA
Internal Audit Manager
Anywhere and Co., LLP
Joe Smith oversees and directs a comprehensive internal audit function for Legg Mason Inc. and its
subsidiaries. Prior to joining Legg Mason, Smith was an audit director for the Financial Services
Group, where he was responsible for the execution of internal audits for Sarbanes-Oxley; the trust
and investment advisory subsidiary of PNC; and Hilliard Lyons, the wholly-owned broker dealer of
PNC. Previously, he was vice president of internal audit for the Swiss Bank Corp., where he was
responsible for audits of private banking. Smith was former chairman of the Audit Committee for
National Bank, is a professor emeritus at Yale University, serves on the Board of Directors for
Piggly Wiggly, and serves on The IIA’s Professional Issues Committee.
Speaker’s Name
Boldface the first reference to the name in the bio — removing the middle initials.
If the presenter prefers to include “Dr.” before his/her name, then include it in the bio.
Do not use the speaker’s middle initial unless it is included on the speaker’s badge.
Use the speaker’s familiar name in the bio (Joe vs. Joseph) if that is what is indicated on the speaker’s
badge.
Job Title
Do not repeat the job title in the first sentence.
On the matrix and where possible, spell out job titles: Chief Audit Executive, Senior Vice President.
Use a comma (not the word “of”) in the position title; however, within the bio itself in reference to
previous positions, using “of” is acceptable.
EXAMPLE (job title listing):
Right: Director, Internal Audit
Wrong: Director of Internal Audit
EXAMPLE (within biography): Johnson served as director of internal audit for 13 years for XYZ
Company.
Company Name
Only use an ampersand (&) in the company name if the company website confirms it is the company’s
official usage.
Education and Designations
Only include college/university information if the speaker serves on a faculty.
EXAMPLE:
“He is a professor emeritus at Yale University” versus “Professor Brown is a member of the staff at
Yale University.”
Do not spell out designations in bios. Instead, list them in the first reference/job title posting.
IIA credentials should begin with CIA, followed by QIAL (if the speaker has that one), and the remainder
of IIA creds should be in alpha order before listing any non-IIA credentials. Educational credentials
(excluding MBA), however, come first. For example: Pat W. Smith, Ph.D., CIA, QIAL, CCSA, CPA,
CRISC.
IIA Membership
Only include a reference to IIA membership if the speaker serves or served the organization at the
global/international level.
Do not list chapter/affiliate information for any organization.
Other
Refrain from listing affiliations that do not support the speaker’s expertise or personal information. Serving
as treasurer for the local Girl Scout troop or being married and living in Paducah are irrelevant. Awards
won can be included if they support the speaker’s topic or expertise. Use judgment. Being published and
appearing on media can be included but can usually be heavily edited: “Schwartz has been published in
major trade publications and quoted extensively in broadcast media.”
BROCHURE MATRIX
List speaker(s) name(s), title(s), and organization(s).
If there is more than one person from the same organization, list names and titles with the company name
following the last speaker name only*.
EXAMPLE:
Lisa M. Krist, APR
Account Manager, Marketing
Kristi Coombs
Manager, Conference Programs
The IIA
Use a comma (not the word of) in the position title.
EXAMPLE:
Right: Director, Internal Audit
Wrong: Director of Internal Audit
Do not place the words Panel or Moderator in all caps.
EXAMPLE:
Right: Panel
Wrong: PANEL
Only use ampersand (&) in the company name if the company website confirms it is the company’s official
usage.
Practitioners should be listed first and then service providers, when applicable.
If an unknown speaker will be added, include as Plus a Practitioner or Plus an XXXX Practitioner.
Include the NASBA Field of Study and Learning Level (Beginner, Intermediate, Advanced).
Pocket Guide Matrix
Elements used in a Pocket Guide Matrix include:
1. Track Title and/or Icon(s).
2. Session Abbreviation (CS X-X or GS 1).
3. Session Title.
4. Speaker(s) Name(s).
5. Speaker(s) Title(s).
6. Speaker(s) Organization(s).*
7. NASBA Field of Study.
8. Room Location.
9. Learning Level (Beginning, Intermediate, Advanced)
*If more than one speaker in a session represents the same company, list the company name only once,
but make sure there is a space between the last speaker’s title and the company name.
DATES AND TIMES
Exclude space on each side of the en dash for dates AND times.
EXAMPLES:
4:00–6:00 p.m.
July 5–7, 2016
Aug. 31–Sept. 1, 2016
12:00 p.m. should be written as noon.
If a session or event begins and ends either a.m. or p.m., only list it once: 4:00‒6:00 p.m. If an event spans
both, list accordingly: 10:15 a.m.‒5:30 p.m.
Abbreviate months – or not – accordingly: Jan., Feb., March, April, May, June, July, Aug., Sept., Oct.,
Nov., and Dec.
Typically, the year does not need to be repeated throughout the matrix on a daily basis. It’s on the cover
and one or two other places throughout so listing the day and date is sufficient: Thursday, Sept. 10.
SESSION TITLES
Include spaces in session descriptions:
EXAMPLES:
Right: CS 1-1
Wrong: CS1-1
Right: GS 1
Wrong: GS1
Right: RT 1
Wrong: RT1
Do not change session titles without confirming with the client conference coordinator (unless it is simply a
typo).
Do not use ampersand (&) in titles; always change to and.
Do not use hyphens, en dashes, or em dashes in session titles; use colons. Also, use Oxford commas as
warranted in series. Capitalize all verbs and all words four letters or more
EXAMPLES:
“What Is an Internal Auditor’s Role From an External Auditor’s Perspective?”
“Collaborating With Third-Party Providers: The Rules Are Clear as Mud”
Two-part Sessions
For two-part sessions, list as “Title of the Session, Part 1” and “Title of the Session, Part 2.”
Be sure to include: “This is a 2-part session. You must attend part 1 to be admitted to part 2.”
