Which IIA standards changes affect audit-management platforms?

The implementation requirement is engagement-level applicability and evidence, not merely adding new audit-universe labels. IIA Topical Requirements are mandatory within its professional framework for applicable assurance work; they are recommended rather than mandatory for advisory services. Applicability decisions and the rationale for excluding individual requirements must be documented and retained. (theiia.org)

These are professional requirements, not a universal US statute requiring every organisation to audit every topic annually. Their application is risk-based within the professional framework. (theiia.org)

What should internal audit test in a shared GRC platform?

Recommended demonstration: give the supplier an assurance engagement in which only part of a topical requirement applies. Ask it to retain:

• The assessment of every requirement’s applicability.
• The exclusion rationale and reviewer.
• The engagement-specific testing programme.
• Links to supporting evidence and findings.
• Auditor conclusions separately from management’s control assertions.
• The version of the methodology used at the time.

Then ask a management control owner to edit the underlying control record. The historical audit conclusion should remain identifiable and attributable.

For audit-management software requirements, insist on controlled methodology updates and reviewer permissions. Reusing evidence is a useful design objective; merging management ownership and independent assurance is not the objective.