Framework crosswalk
One map across the frameworks you use.
See how the IIA Standards, COSO, ISO 37001 and the COSO/ACFE Fraud Risk Management Guide cover the same ground — theme by theme.
| Theme | IIA GIAS | COSO IC | ISO 37001 | COSO/ACFE FRM |
|---|---|---|---|---|
| Governance & oversightWho is accountable, and how does the board oversee it? | Domain III — Governing the internal audit function | Control environment — board independence and oversight | Leadership — governing body, top management and the compliance function | Principle 1 — Fraud risk governance |
| Ethics & tone at the topIs integrity set and shown from the top? | Domain II — Ethics and professionalism | Control environment — commitment to integrity and ethical values | Leadership — anti-bribery policy and commitment | Principle 1 — Fraud risk governance |
| Risk assessmentAre the right risks, including fraud, identified and assessed? | Domain IV — Risk-based internal audit planning | Risk assessment — including assessing the potential for fraud | Bribery risk assessment | Principle 2 — Fraud risk assessment |
| Preventive & detective controlsAre controls in place to stop and spot problems? | Domain V — Performing internal audit services (evaluating controls) | Control activities | Operation — financial and non-financial controls | Principle 3 — Fraud control activities |
| Third parties & due diligenceAre suppliers, agents and partners checked? | Domain V — engagement scope can cover third-party risk | Control activities and risk assessment, including outsourced processes | Operation — due diligence on business associates | Principle 3 — Fraud control activities |
| Speaking up & investigationCan people raise concerns, and are they investigated? | Not a primary focus — internal audit may support investigations | Information & communication — separate reporting channels | Operation — raising concerns; investigating and dealing with bribery | Principle 4 — Fraud investigation and corrective action |
| Monitoring & improvementIs the program checked and improved over time? | Domain IV — Quality assurance and improvement | Monitoring activities | Performance evaluation and improvement | Principle 5 — Fraud risk management monitoring |
This is an indicative, theme-level mapping written in our own words to help you navigate. It is not a substitute for the official texts — always check the source standard. Each framework belongs to its publisher.
- IIA GIAS — IIA Global Internal Audit Standards
- COSO IC — COSO Internal Control — Integrated Framework (2013)
- ISO 37001 — ISO 37001 Anti-bribery management systems
- COSO/ACFE FRM — COSO / ACFE Fraud Risk Management Guide