Online Exclusive: 6 Obstacles to Conformance

In April, The IIA released How to Implement the Global Internal Audit Standards in the Public Sector, a tool designed to aid public sector internal auditors. The tool can help these internal audit functions overcome the unique challenges to conforming with the Standards.

1. Politics

In the public sector, the term “politics” is multifaceted. It often refers to the political party in power, where auditors must consider how party priorities and expectations can change. However, thinking politically also means thinking more about context, says Sandra Ilewicki, an internal auditor in the General Auditor’s Office for the city of Buenos Aires and a member of the Public Sector Knowledge Group.

“The public sector is about relationships and negotiations,” Ilewicki says. “In the private sector, a manager can say something and people just do it. In the public sector, however, interactions for certain things depend heavily on the stakeholders.”

 The path to building necessary stakeholder relationships can be hindered by confusion regarding governance structures, which further complicates issues, says Deborah Moorhouse, deputy director of the Government Internal Audit Agency in the U.K. and one of the authors of The IIA’s new public sector tool.

Moorhouse says small audit functions are particularly susceptible to this issue. “When you’ve got small teams, it’s harder for them, especially if they haven’t got a board framework to work with in terms of how they can develop key relationships,” she says. “Understanding the governance arrangements — which can range from really complex to not being there at all — is really crucial.”

2. The Legal/Regulatory Landscape

Organizations in all industries must conform to legislation and regulation, but the depth and complexity of these can be amplified in the public sector, which is often the regulation-setting body. Without planning, this can make conforming with the Standards complicated.

This challenge was one of the main factors that led to the drafting of the public sector tool, says Jens Motel, CAE of the Hessian Ministry of Science and Research, Arts, and Culture in Wiesbaden, Germany, and one of the tool’s authors. “European states, for example, have legislation for their internal audit units,” he says. “As the legislation continues to change, internal audit functions have to consider what this may mean. Is there anything new they must consider? Is there more bureaucracy or financial burdens? It is important that we have a tool to point this out.”

The public sector tool notes legal challenges can take a few common forms:

• The internal audit function may not have unrestricted access to records, information, personnel, or facilities.
• Internal audit does not report to a “board” or governing body. Instead, the CAE may need to “identify the party in the organization that would have the authority to provide input to and approve the internal audit charter.” According to the tool, this can complicate basic reporting lines significantly.
• Legal and regulatory frameworks can place additional requirements on the audit function that not only complicate in-house reporting relationships but also coordination with external oversight bodies and assurance providers. While these challenges exist, it is important to note that the new tool is intended to be globally applicable, Moorhouse says. “While being a global document, it obviously can’t necessarily go down into the detail on what your unique internal audit function is facing,” she says. “But it can kind of give you a framework for overcoming the challenge.”

3. Methodology Limitations 

Laws and regulations can hinder Standards conformance and the abilities of the internal audit function, if not addressed. The public sector tool notes that laws or regulations currently in place can either limit the roles and responsibilities of internal audit or require the function to operate in specific and inefficient ways that hinder productivity.

In these situations, Ilewicki says, internal audit should explain why such shortcomings may exist. “For certain situations or events when you couldn’t do something, you have to express that situation,” she says. “For example, if a person you are auditing refuses to give you information even though he normally would be obliged to do it, then you have to report to the governing body that you couldn’t do it.”

4. Budget 

Public sector agencies typically struggle with budget limitations. According to the 2025 North American Pulse of Internal Audit, 36% of public sector internal audit leaders report that their funding is generally insufficient or not at all sufficient, compared to 22% in 2024. This is the highest percentage of any sector represented in the survey. Insufficient budgets can impact Standards conformance, hiring, internal audit’s mandate, audit plan scope, and outsourcing and cosourcing options.

The public sector tool indicates that in some cases public sector CAEs, boards, and audit committees do not have the authority to set the internal audit budget “because it may be part of the organization’s comprehensive budget or set by law or regulation.” The resources CAEs have today are often what they are going to get, and public sector internal audit functions have to adapt to this reality, Ilewicki says.

5. Staffing

Budget and staffing go hand-in-hand. Without sufficient resources, public sector organizations may find hiring and maintaining qualified talent challenging — especially competing with the private sector for the same talent. The tool states, “Not having sufficient staff or the appropriate competencies may prevent the internal audit function from being able to fulfill its mandate, achieve the internal audit plan, and/or conform with the Standards.”

Additionally, even in cases when an internal auditor is present in the role, the likelihood that an individual remains there for an extended period is limited. This creates issues in several ways, Motel says.

“In the public sector, it’s likely that an individual’s career path — an individual that likely was not originally trained to be an internal auditor — will not end in internal audit,” he says. “They will be there for a couple of years, and then when they want to move forward in their career, they change position, which makes it difficult to fulfill obligations like acquiring a Certified Internal Auditor certification.”

6. Technology Limitations

Public sector internal audit functions often lag behind private sector entities for numerous reasons. In addition to simply lacking the funding to acquire innovative, audit-specific software, there can be laws and regulations in place that limit technology usage to what is already approved, the paper notes. New technology approvals can take years, which can leave internal audit lagging behind the risk landscape.

What Does All This Mean?

While these challenges may not be overcome in a traditional sense, Ilewicki says internal audit leaders can increase awareness and educate stakeholders on why the internal audit function cannot do something, such as conform to the letter of a specific standard.

Moorhouse says one way this can be done is through deliberate use of the internal audit charter. Within the charter, internal audit can clearly define the scope of its role, as well as any information that is critical to its success in that role. “Using something like the audit charter can really set out, for example, how governance arrangements work, how those roles and responsibilities work,” she says. “Use the charter as a tool to reset relationships and really make sure it's clear for everyone what the roles and responsibilities are.”

Regardless of what strategy public sector internal audit functions use to succeed, they all have a common theme: communication. “A lot of these issues come back to just communicating with your stakeholders and making sure that they are clear on why you’ve done what you’ve done and what changes there have been,” Moorhouse says.

Public sector internal audit functions, in many aspects, may be at a natural disadvantage compared to their private sector counterparts. However, by following the Standards and helpful tips included in this tool, these audit functions still have the power to provide significant value to the organization’s stakeholders.