There is a comfortable belief circulating in boardrooms across the Caribbean, and it deserves to be retired: the belief that the Global Internal Audit Standards are still “bedding in,” that everyone is in the same boat, and that conformance is a project for next year. None of that is true. The Standards took effect on 9 January 2025. The transition period the profession was given ran through 2024. Since the effective date, every internal audit function — in-house, co-sourced, or outsourced — has been measured against the new framework whenever its quality is assessed. The deadline did not move. It passed.

What has changed in the eighteen months since is the arrival of consequences. External quality assessments conducted under the new Standards are now reaching Caribbean organizations. Regulators shaped by Jamaica’s Twin Peaks transition are asking sharper questions about assurance arrangements. And audit committees — alert to the region’s recent, very public control failures — are asking their chief audit executives a question many cannot yet answer with evidence: are we conformant? This third article in The Internal Audit Imperative™ explains what conformance now means, what assessors are actually finding, and how to close the gap before someone else measures it for you.

What “Conformance” Now Means

Under the old framework, conformance was often treated as a tone — a general fidelity to professional practice. The new Standards make it an evidence question. A conformant function can produce, on request: a board-approved charter aligned to the new Standards; a documented internal audit strategy; written methodologies applied consistently across engagements; a quality assurance and improvement programme (QAIP) with both internal monitoring and periodic external assessment; a resource sufficiency statement presented to the board; and records showing that engagement findings are tracked to resolution. If those artefacts do not exist, the function is not conformant — however capable its people may be. Conformance is no longer about intentions; it is about paper, process, and proof.

The Mechanism With Teeth: The External Quality Assessment

The reason the deadline matters is that the Standards come with an enforcement mechanism built in. Every internal audit function must undergo an external quality assessment at least once every five years, performed by a qualified, independent assessor — and the results go to the board, not just to management. The assessment concludes with a conformance rating, and “partially conforms” or “does not conform” is not a private grade. It appears in board papers. It surfaces in regulatory examinations. In due diligence for a transaction or a listing, it can surface at precisely the wrong moment.

Two implications follow. First, any function whose last external assessment predates the new Standards is now measured against a framework it was never assessed under — the clock is running toward an assessment on rules it may not yet meet. Second, the assessment is only a threat to the unprepared. For a function that has done the work, the EQA is the cheapest credibility an assurance function can acquire: independent confirmation, delivered to the board, that the organization’s early warning system actually works.

What Assessments Are Finding

Across the region, early assessments and gap reviews under the new framework are surfacing a consistent pattern of findings — familiar from Article 2’s “ten off-guard requirements,” but now written into reports with ratings attached:

• Stale charters. Charters still citing the 2017 IPPF — the fastest way to signal, on page one, that the function has not transitioned.
• No internal audit strategy. Annual plans exist; the mandated multi-year strategy aligned to organizational objectives does not.
• Compromised reporting lines. Functional reporting to the CFO or an operations executive, with the board’s role limited to receiving summaries.
• No QAIP. No internal quality monitoring, no external assessment ever performed, and no plan for one.
• Undocumented methodology. Engagement practices carried in experienced heads rather than written methodologies — unassessable, and fragile to staff turnover.
• Technology gaps. Sampling-only approaches where full-population analytics are feasible, and no roadmap toward data-enabled auditing.

None of these findings says the auditors are not able. Every one of them says the function has not been positioned, resourced, and documented the way the Standards — and the board’s own interests — now require.

Who Is Asking the Conformance Question

It is tempting to treat conformance as an internal matter between the CAE and the audit committee. In 2026, at least four external audiences are asking the question independently. Regulators: as Jamaica’s supervisory architecture consolidates under the Twin Peaks reform, examiners increasingly test whether governance functions — internal audit among them — meet international standards, particularly in deposit-taking institutions, insurers, securities dealers, and credit unions. External auditors: the quality of internal audit shapes the external auditor’s risk assessment and, in some engagements, the extent of reliance placed on internal work. Investors and lenders: after the market events of the past two years, sophisticated capital providers have added assurance arrangements to their diligence checklists. Courts of public opinion: when a control failure becomes a headline, “was the internal audit function conformant with international standards?” is among the first questions asked — and the answer is discoverable.

A 12-Month Conformance Roadmap

For most Caribbean organizations, full conformance is a four-quarter programme, not a five-year one. A practical sequence:

1. Quarter 1 — Diagnose and re-charter. Commission a gap assessment against the Standards; redraft the charter and mandate; put both to the board with a corrected reporting line and a board-approved CAE arrangement.
2. Quarter 2 — Strategy and methodology. Develop the internal audit strategy with board input; document engagement methodologies; map assurance coverage with the second line and the external auditor.
3. Quarter 3 — Quality and technology. Stand up the QAIP with internal monitoring measures; introduce data analytics into at least two engagements; present the resource sufficiency statement to the board.
4. Quarter 4 — Validate. Conduct a readiness review or self-assessment with independent validation, remediate residual gaps, and schedule the full external quality assessment from a position of strength.

One caution on the final step: the Standards permit a self-assessment with independent external validation as an alternative to a full external assessment — a cost-effective route for smaller functions, but only if the validator is genuinely independent and the self-assessment is honest. A generous self-grade that fails validation costs more credibility than it saves in fees.

The Dawgen Perspective

Deadlines reveal culture. Organizations that treat the past conformance date as an inconvenience will do the minimum, late; organizations that treat it as the board-level signal it will emerge with an assurance function that regulators trust, external auditors rely on, and directors can defend in public. The gap between those two postures is rarely money — most conformance work is documentation, positioning, and discipline. The gap is intent.

Dawgen Global works on both sides of this equation across 15+ Caribbean territories: preparing functions for assessment — gap assessments, charters, strategies, methodologies, and QAIP design under our D·ASSURE™ framework — and performing independent external quality assessments and validations for organizations whose functions we do not otherwise serve. Our integrated model adds the cyber, IT, data analytics, and actuarial depth that assessments under the Topical Requirements increasingly demand.

Next in the series: “From Watchdog to Strategist: The Binding Requirement for an Internal Audit Strategy” — a practical guide to the document most Caribbean functions are missing, and how to build one the board will actually use.

 

Schedule Your External Quality Assessment — or Get Ready for One Dawgen Global performs independent External Quality Assessments and validations of internal audit functions against the Global Internal Audit Standards — and, for functions preparing for assessment, delivers a 12-month conformance programme covering charter, strategy, methodology, QAIP, and technology enablement. Know your rating before anyone else assigns you one. Big Firm Capabilities. Caribbean Understanding.