What evidence should an internal audit function retain to show conformance with the IIA Standards?

Evidence depends on the requirement. Function-level evidence may include the approved charter, board minutes, annual plan, resource assessment, audit strategy, methodology manual, QAIP results, and performance reporting. Engagement-level evidence may include planning risk assessment, objectives and scope, criteria, approved work program, workpapers, review notes, final communication, and follow-up records.

The key is that evidence should be retained where the work naturally occurs. A quality reviewer should be able to trace a requirement to a policy, template, workpaper, approval, or QAIP test. A standalone statement that the department follows the standards is not enough.