The IIA Cookies Policy
Effective Date: September 4, 2026 Last Updated: September 4, 2026
This Cookies Policy explains how The Institute of Internal Auditors ("The IIA," "we," "us," or "our") uses cookies and similar technologies on our websites, mobile applications, portals, and other digital properties (collectively, the "Digital Properties"). As an international not-for-profit professional association, The IIA uses these technologies to operate and improve these services, support members and certification candidates, deliver education and professional resources, facilitate events and transactions, communicate with stakeholders, and understand engagement with The IIA programs and content. This Policy should be read together with our Privacy Notice. You may manage your Cookie preferences as described in the How to Manage Cookies and Your Choices sections below.
1. What Are Cookies?
Cookies are small text files stored on your device when you visit a website. This Policy also covers similar technologies, including pixels, tags, software development kits, local storage, and other device or online identifiers (collectively, “Cookies”). Cookies can recognize a device, remember preferences, enable features, measure usage, and support content or advertising. A Cookie is “first-party” when placed by The IIA and “third-party” when placed by another organization through our Digital Properties. Third-party cookies are managed independently by the third party, and those providers may process information under their own privacy or cookie notices in addition to any commitments they make to The IIA.
2. Types of Cookies We Use
We use Cookies to improve the user experience, and only for disclosed purposes, seeking to apply privacy by design, data minimization, proportionate retention, and appropriate safeguards. Depending on the Digital Property and your choices, we use the following categories: strictly necessary, functional and preference, analytics and performance, and advertising and targeting Cookies.
a. Strictly Necessary Cookies
These cookies are essential for the operation of our Digital Properties and cannot be switched off in our systems. They are typically set in response to actions you take, such as logging in, completing forms, setting privacy preferences, or maintaining security.
b. Functional and Preference Cookies
These cookies enable us to remember choices you make, such as language settings, region selection, account preferences, and other customized features, in order to provide an enhanced and personalized experience.
c. Analytics and Performance Cookies
These cookies help us understand how visitors interact with our Digital Properties by collecting information such as pages visited, time spent on pages, navigation paths, referral sources, and system performance metrics. The information collected may be aggregated and used to improve the functionality and effectiveness of our Digital Properties.
d. Advertising and Targeting Cookies
These cookies may be used by us or our advertising partners to collect information about browsing activity over time and across different websites, applications, or devices. Where used, they help The IIA measure and improve outreach related to membership, certifications, education, events, publications, research, advocacy initiatives, and other mission-related activities, and may support delivery of content or advertising that is more relevant to users. Their use is subject to applicable legal requirements and the choices made available through the Cookie Settings tool.
e. IIA Program, Membership, Certification, and Event Services
The IIA uses Cookies in connection with member services, certification and examination services, educational programs, event registration, e-commerce transactions, publication access, learning platforms, surveys, and related communications. These Cookies are classified under the standard categories described above based on their purpose. For example, some may be strictly necessary to provide a service you request, while others may be functional and preference, analytics and performance, or advertising and targeting Cookies depending on the context and your choices.
f. Legal Basis for Processing Cookie Information
Where required by applicable law, The IIA relies on an appropriate legal basis to process information collected through Cookies. Strictly Necessary Cookies are used to provide and secure the Digital Properties and may be processed based on our legitimate interests, contractual obligations, or another applicable legal basis. Functional and Preference, Analytics and Performance, and Advertising and Targeting Cookies are used only with consent where required by law. You may withdraw or update consent through the Cookie Settings or preference-management tool described in Section 3 below.
3. How to Manage Cookies
You can manage non-essential Cookies through the Cookie Settings or preference-management tool made available on the Digital Properties. Where required by law, we will ask for your consent before placing or activating Functional and Preference, Analytics and Performance, or Advertising and Targeting Cookies. You may withdraw consent as easily as you provided it by returning to that tool. You can also adjust browser settings to block or delete Cookies, but some features may not work properly if Strictly Necessary Cookies are disabled or unavailable.
For additional details regarding the specific Cookies identified on the Digital Properties, please see Appendix A.
4. Information Collected Through Cookies
Depending on the type of cookie used, we may collect:
- Browsing and search history on our Digital Properties;
- Device information, browser type, operating system, and network information;
- IP address and other online identifiers;
- Account settings and default preferences;
- Marketing and purchasing preferences;
- Information about interactions with our content, advertisements, communications, and Digital Properties; and
- Usage and performance information relating to our services.
Depending on the technology, these data may be linked or reasonably linkable to you, your household, or your device. We retain Cookie information only for as long as reasonably necessary for the disclosed purpose, subject to the specific lifespan listed in the Cookie Inventory and applicable legal, security, and recordkeeping requirements.
5. Third-Party Cookies
Some Cookies are placed by third parties that provide analytics, advertising, communications, payment processing, security, social media, or other functionality services. Depending on the provider and service, these parties may receive identifiers, device and browser information, IP addresses, pages viewed, interactions with Digital Properties, referral information, and transaction-related activity. They may process information on The IIA's behalf or, where disclosed and permitted by law, for their own purposes. Additional information regarding providers, purposes, and retention periods is available in Appendix A.
Because The IIA operates internationally and works with chapters, national institutes, affiliates, service providers, and technology platforms, cookie-related information may be processed in jurisdictions other than your own. These parties may support membership administration, certification candidate management, learning management, events, webinars, email communications, payments, analytics, security, customer support, and similar activities. Where personal information is transferred internationally, The IIA implements appropriate safeguards as required by applicable law, which may include contractual protections, adequacy determinations, or other approved transfer mechanisms.
IIA national institutes, chapters, affiliates, and third-party platforms may maintain their own privacy notices or cookie practices. When you interact with those separate websites, portals, or services, their notices may apply in addition to or instead of this Cookies Policy.
6. Your Choices
You can manage nonessential Cookies and, where applicable, opt out of sale, sharing, targeted advertising, or cross-context behavioral advertising through these methods:
-
Use the “Cookie Settings” link on our webpage
- Submit a request by email to privacy@theiia.org
- Write to us at The Institute of Internal Auditors, 1035 Greenwood Blvd., Suite 401, Lake Mary, FL 32746.
- Adjust your browser settings to block or delete Cookies. Browser controls may not prevent all similar technologies or opt you out of all disclosures treated as sale or sharing.
- Use an applicable industry opt-out mechanism for interest-based advertising.
Residents of certain states may have the right to opt out of the sale of personal information, sharing of personal information for cross-context behavioral advertising, or processing of personal information for targeted advertising. Where these rights apply, The IIA provides mechanisms for submitting such requests through the methods identified above and, where required by law, through recognized opt-out preference signals. Please note that disabling certain cookies may impact the functionality, features, or performance of our Digital Properties.
Where required by law, The IIA will request your consent before placing or activating nonessential Cookies. You may provide, refuse, modify, or withdraw your consent at any time through the Cookie Settings or preference-management tool available on the applicable Digital Property. Changes to your preferences will apply prospectively and will not affect the lawfulness of any processing that occurred before your preferences were updated. You may also delete existing Cookies through your browser settings, although doing so may affect the functionality of certain features or services. Depending on applicable law, you may also have rights to know or access, correct, delete, or obtain information about personal information collected through Cookies, and to opt out of its sale, sharing, or use for targeted advertising. Authentication requirements, authorized-agent procedures, and any available appeal process are described in The IIA’s Privacy Notice. The IIA will not discriminate against you for exercising applicable privacy rights.
7. Do Not Track
Some browsers offer a “Do Not Track” setting. Because there is no universally accepted technical standard for these signals, The IIA does not respond to ordinary Do Not Track signals unless required by applicable law.
Opt-out preference signals, such as Global Privacy Control, are distinct from ordinary Do Not Track signals. Where legally required and technically recognized, The IIA will treat a valid signal as a request to opt out of sale or sharing for the browser or device from which the signal is sent.
8. California Disclosures
California residents may have rights regarding personal information collected through Cookies and similar technologies. Depending on the specific Cookies used, The IIA may collect categories of personal information that include identifiers, internet or other electronic network activity information, commercial information, approximate geolocation data, and inferences drawn from such information.
We use this information to operate, maintain, secure, and improve our Digital Properties; administer memberships, certifications, educational programs, and events; process transactions; communicate with users; analyze engagement and performance; and, where permitted, support marketing and outreach activities.
Certain disclosures of personal information to analytics providers, advertising networks, social media platforms, or similar partners may constitute a "sale," "sharing," or use of personal information for targeted advertising under California law. The IIA will align the choices offered through its Cookie Settings or preference-management tool with the final classification of Cookies in Appendix A and the technical configuration of the Digital Properties.
Service providers, contractors, and third parties that support The IIA's operations may process information collected through Cookies on our behalf and pursuant to contractual restrictions designed to protect personal information and limit its use to authorized purposes.
9. Changes to This Cookies Policy
The IIA will review this Cookies Policy and the underlying Cookie Inventory at least annually and update them when its practices or legal obligations materially change. The “Last Updated” date above shows when this Policy was most recently revised. If a change is material, The IIA will provide notice through an appropriate method, such as a prominent notice on the relevant Digital Property, an update in the consent or preference-management tool, or another direct communication where appropriate. Any change becomes effective on the date stated in the revised Policy.
10. Contact Us
Please address questions regarding this Cookies Policy to: privacy@theiia.org
Alternatively, you can write to us at:
The Institute of Internal Auditors
1035 Greenwood Blvd., Suite 401
Lake Mary, FL 32746
www.theiia.org
Appendix A: Cookie Inventory
Note: This inventory uses standardized cookie categories consistent with the policy. It reflects Cookies and similar technologies identified on the Digital Properties at the time of review and may change as Digital Properties, vendors, configurations, and technologies are updated. The “Internal Business Owner” field identifies the IIA function currently associated with the cookie or technology and should be validated against the applicable vendor configuration, consent-management platform, and implementation records before publication.
| Cookie Name | Internal Business Owner | Domain | Vendor / Provider | Cookie Category |
|---|---|---|---|---|
| __cf_bm | Marketing | .hubspot.com | HubSpot | Necessary |
| __cf_bm | Marketing | .hsforms.com | HubSpot | Necessary |
| __cf_bm | Marketing | .hs-analytics.net | HubSpot | Necessary |
| __cf_bm | Marketing | .linkedin.com | Necessary | |
| __cf_bm | Marketing | .hs-scripts.com | HubSpot | Necessary |
| __cf_bm | Marketing | .hs-banner.com | HubSpot | Necessary |
| _hs_cookie_cat_pref | Marketing | .hubspot.com | HubSpot | Functional and Preference |
| _hssc | Marketing | .theiia.org | HubSpot | Analytics and Performance |
| _hssrc | Marketing | .theiia.org | HubSpot | Analytics and Performance |
| _hstc | Marketing | .hubspot.com | HubSpot | Analytics and Performance |
| _hstc | Marketing | .theiia.org | HubSpot | Analytics and Performance |
| _q_state_gPqkxcJvBXJV... | Foundation | .feathr.co | Feathr | Advertising and Targeting |
| __Secure-1PAPISID | Marketing | .google.com | Advertising and Targeting | |
| __Secure-1PSID | Marketing | .google.com | Advertising and Targeting | |
| __Secure-1PSIDCC | Marketing | .google.com | Advertising and Targeting | |
| __Secure-1PSIDRTS | Marketing | .google.com | Advertising and Targeting | |
| __Secure-1PSIDTS | Marketing | .google.com | Advertising and Targeting | |
| __Secure-3PAPISID | Marketing | .google.com | Advertising and Targeting | |
| __Secure-3PSID | Marketing | .google.com | Advertising and Targeting | |
| __Secure-3PSIDCC | Marketing | .google.com | Advertising and Targeting | |
| __Secure-3PSIDRTS | Marketing | .google.com | Advertising and Targeting | |
| __Secure-3PSIDTS | Marketing | .google.com | Advertising and Targeting | |
| __Secure-BUCKET | Marketing | .google.com | Functional and Preference | |
| _ab_csid | Advertising Services | .servedbyadbutler.com | AdButler | Advertising and Targeting |
| _adbc | Advertising Services | .servedbyadbutler.com | AdButler | Advertising and Targeting |
| _BEAMER_FIRST_VISIT_z... | Marketing | .hotjar.com | Hotjar | Analytics and Performance |
| _BEAMER_USER_ID_zeKL... | Marketing | .hotjar.com | Hotjar | Analytics and Performance |
| _clck | Marketing | .theiia.org | Microsoft Clarity | Analytics and Performance |
| _clsk | Marketing | .theiia.org | Microsoft Clarity | Analytics and Performance |
| _conv_r | Marketing | .hubspot.com | HubSpot | Advertising and Targeting |
| _conv_v | Marketing | .hubspot.com | HubSpot | Advertising and Targeting |
| _cq_duid | Marketing | .hubspot.com | HubSpot | Advertising and Targeting |
| _cq_session | Marketing | .hubspot.com | HubSpot | Advertising and Targeting |
| _cs_c | Marketing | .hotjar.com | Hotjar | Analytics and Performance |
| _cs_id | Marketing | .hotjar.com | Hotjar | Analytics and Performance |
| _fbp | Marketing | .hubspot.com | Meta/Facebook (via HubSpot) | Advertising and Targeting |
| _ga | Marketing | .theiia.org | Google Analytics | Analytics and Performance |
| _ga | Marketing | .hubspot.com | Google Analytics | Analytics and Performance |
| _ga | Marketing | .hotjar.com | Google Analytics | Analytics and Performance |
| _ga | Marketing | .feathr.co | Google Analytics | Analytics and Performance |
| _ga_4M564CJ8L8 | Marketing | .theiia.org | Google Analytics | Analytics and Performance |
| _ga_4M564CJ8L8 | Marketing | www.theiia.org | Google Analytics | Analytics and Performance |
| _ga_BY4EGTPHRR | Marketing | .hotjar.com | Google Analytics | Analytics and Performance |
| _ga_KNDFS1XWFR | Marketing | .hotjar.com | Google Analytics | Analytics and Performance |
| _ga_LXTM6CQ0XK | Marketing | .hubspot.com | Google Analytics | Analytics and Performance |
| _ga_MLS8R7Z9DZ | Marketing | .theiia.org | Google Analytics | Analytics and Performance |
| _ga_TWSB775G46 | Marketing | .feathr.co | Google Analytics | Analytics and Performance |
| _ga_X | Marketing | .hubspot.com | Google Analytics | Analytics and Performance |
| _ga_XLH5ZCNTVQ | Marketing | .theiia.org | Google Analytics | Analytics and Performance |
| _gac_UA-73664271-30 | Marketing | .theiia.org | Google Ads (via GA) | Advertising and Targeting |
| _gcl_au | Marketing | .linkedin.com | Google Ads | Advertising and Targeting |
| _gcl_au | Marketing | .theiia.org | Google Ads | Advertising and Targeting |
| _gcl_au | Marketing | .feathr.co | Google Ads | Advertising and Targeting |
| _gcl_aw | Marketing | .theiia.org | Google Ads | Advertising and Targeting |
| _gcl_gs | Marketing | .theiia.org | Google Ads | Advertising and Targeting |
| _gid | Marketing | .theiia.org | Google Analytics | Analytics |
| _guid | Marketing | .linkedin.com | Advertising | |
| _hjDonePolls | Marketing | .hotjar.com | Hotjar | Analytics |
| _hjSession_662198 | Marketing | .theiia.org | Hotjar | Analytics |
| _hjSessionUser_14 | Marketing | .hotjar.com | Hotjar | Analytics and Performance |
| _hjSessionUser_204526 | Marketing | .hubspot.com | Hotjar | Analytics |
| _hjSessionUser_2049634 | Marketing | .hubspot.com | Hotjar | Analytics |
| _hjSessionUser_35118 | Marketing | .hotjar.com | Hotjar | Analytics |
| _hjSessionUser_662198 | Marketing | .theiia.org | Hotjar | Analytics |
| _hp5_event_props.236035... | Marketing | .hotjar.com | Hotjar | Analytics |
| _hp5_let.236035469 | Marketing | .hotjar.com | Hotjar | Analytics |
| _hp5_meta.236035469 | Marketing | .hotjar.com | Hotjar | Analytics |
| _rdt_uuid | Foundation | .feathr.co | Reddit Ads (via Feathr) | Advertising |
| _twpid | Marketing | .hubspot.com | HubSpot | Advertising |
| _uetsid | Marketing | .theiia.org | Microsoft/Bing Ads | Advertising |
| _uetvid | Marketing | .hubspot.com | Microsoft/Bing Ads | Advertising |
| _uetvid | Marketing | .theiia.org | Microsoft/Bing Ads | Advertising |
| .AspNetApplicationCookie (chunks:2) | TPX | .theiia.org | IIA (site infrastructure) | Necessary |
| .AspNetApplicationCookie | TPX | .theiia.org | IIA (site infrastructure) | Necessary |
| .AspNetApplicationCookie | TPX | .theiia.org | IIA (site infrastructure) | Necessary |
| aam_uuid | Marketing | .linkedin.com | Adobe Audience Manager (via LinkedIn) | Advertising |
| adButlerCIS530658[7810...] | Advertising Services | .servedbyadbutler.com | AdButler | Advertising |
| adButlerCIS530659[7810...] | Advertising Services | .servedbyadbutler.com | AdButler | Advertising |
| ADS_VISITOR_ID | Marketing | .google.com | Google Ads | Advertising |
| AEC | Marketing | .google.com | Necessary | |
| ai_session | TPX | www.theiia.org | IIA (site tool) | Functional and Preference |
| ai_user | TPX | www.theiia.org | IIA (site tool) | Functional and Preference |
| ajs_anonymous_id | Marketing | .hotjar.com | Segment (via Hotjar) | Analytics |
| ajs_user_id | Marketing | .hotjar.com | Segment (via Hotjar) | Analytics |
| AMCV_14215E3D5995... | Marketing | .linkedin.com | Adobe Experience Cloud | Advertising |
| AMCVS_14215E3D5995... | Marketing | .linkedin.com | Adobe Experience Cloud | Advertising |
| AnalyticsSyncHistory | Marketing | .linkedin.com | Advertising | |
| APISID | Marketing | .google.com | Advertising and Targeting | |
| ar_debug | Marketing | .doubleclick.net | Google DoubleClick | Advertising |
| ARRAffinity | TPX | www.theiia.org | IIA (Azure infrastructure) | Necessary |
| ARRAffinitySameSite | TPX | www.theiia.org | IIA (Azure infrastructure) | Necessary |
| ASP.NET_SessionId | TPX | www.theiia.org | IIA (Azure infrastructure) | Necessary |
| bcookie | Marketing | .linkedin.com | Advertising | |
| cf_38306_first_touch | Foundation | .theiia.org | Feathr | Advertising |
| cf_38306_id | Foundation | .theiia.org | Feathr | Advertising |
| cf_38306_person_last_up... | Foundation | .theiia.org | Feathr | Advertising |
| cf_38306_person_time | Foundation | .theiia.org | Feathr | Advertising |
| cfid | TPX | .theiia.org | IIA (ColdFusion infrastructure) | Necessary |
| cftoken | TPX | .theiia.org | IIA (ColdFusion infrastructure) | Necessary |
| CLID | Marketing | www.clarity.ms | Microsoft Clarity | Analytics |
| csrf.app | Marketing | .hubspot.com | HubSpot | Necessary |
| cuvid | Marketing | .theiia.org | HubSpot | Analytics |
| dfpfpt | Marketing | .linkedin.com | Google DoubleClick for Publishers (via LinkedIn) | Advertising |
| f_id | Foundation | .feathr.co | Feathr | Advertising |
| feathr_session_id | Foundation | .theiia.org | Feathr | Advertising |
| FPID | Marketing | .hubspot.com | HubSpot | Analytics |
| fptctx2 | Marketing | .linkedin.com | Functional and Preference | |
| GCL_AW_P | Marketing | .doubleclick.net | Google Ads | Advertising |
| GCL_AW_P | Marketing | .google.com | Google Ads | Advertising |
| gpv_pn | Marketing | .linkedin.com | Adobe Analytics (via LinkedIn) | Analytics |
| hs_login_email | Marketing | .hubspot.com | HubSpot | Necessary |
| hs_login_metadata | Marketing | .hubspot.com | HubSpot | Necessary |
| HSID | Marketing | .google.com | Advertising and Targeting | |
| hubspotapi-csrf | Marketing | .hubspot.com | HubSpot | Necessary |
| hubspotapi-prefs | Marketing | .hubspot.com | HubSpot | Functional and Preference |
| hubsputk | Marketing | .theiia.org | HubSpot | Advertising |
| hubsputk | Marketing | .hubspot.com | HubSpot | Advertising |
| IDE | Marketing | .doubleclick.net | Google DoubleClick | Advertising |
| IIAEcommSession | TPX | .theiia.org | IIA (site infrastructure) | Necessary |
| IR_PI | Marketing | .hubspot.com | Impact Radius (via HubSpot) | Advertising |
| lang | Marketing | .linkedin.com | Functional | |
| li_sugr | Marketing | .linkedin.com | Advertising | |
| liap | Marketing | .linkedin.com | Functional | |
| lidc | Marketing | .linkedin.com | Functional | |
| lms_ads | Marketing | .linkedin.com | Advertising | |
| lms_analytics | Marketing | .linkedin.com | Analytics | |
| mbox | Marketing | .linkedin.com | Adobe Target (via LinkedIn) | Advertising |
| MR | Marketing | c.clarity.ms | Microsoft Clarity | Analytics |
| MR | Marketing | bat.bing.com | Microsoft/Bing Ads | Advertising |
| MUID | Marketing | .bing.com | Microsoft/Bing Ads | Advertising |
| MUID | Marketing | .clarity.ms | Microsoft Clarity | Analytics |
| NID | Marketing | .google.com | Advertising/Functional | |
| OptanonAlertBoxClosed | TPX | .theiia.org | OneTrust | Necessary |
| OptanonConsent | TPX | .hotjar.com | OneTrust | Necessary |
| OptanonConsent | TPX | .theiia.org | OneTrust | Necessary |
| S | Marketing | .google.com | Functional | |
| s_cc | Marketing | .linkedin.com | Adobe Analytics (via LinkedIn) | Analytics |
| s_ips | Marketing | .linkedin.com | Adobe Analytics (via LinkedIn) | Analytics |
| s_plt | Marketing | .linkedin.com | Adobe Analytics (via LinkedIn) | Analytics |
| s_pltp | Marketing | .linkedin.com | Adobe Analytics (via LinkedIn) | Analytics |
| s_ppv | Marketing | .linkedin.com | Adobe Analytics (via LinkedIn) | Analytics |
| s_sq | Marketing | .linkedin.com | Adobe Analytics (via LinkedIn) | Analytics |
| s_tp | Marketing | .linkedin.com | Adobe Analytics (via LinkedIn) | Analytics |
| s_tslv | Marketing | .linkedin.com | Adobe Analytics (via LinkedIn) | Analytics |
| SAPISID | Marketing | .google.com | Advertising/Functional | |
| sdui_ver | Marketing | .linkedin.com | Functional | |
| SEARCH_SAMESITE | Marketing | .google.com | Functional | |
| SID | Marketing | .google.com | Advertising/Functional | |
| SIDCC | Marketing | .google.com | Advertising/Functional | |
| SM | Marketing | c.clarity.ms | Microsoft Clarity | Analytics |
| SSID | Marketing | .google.com | Advertising/Functional | |
| TDCPM | TPX | .adsrvr.org | The Trade Desk | Advertising |
| TDID | TPX | .adsrvr.org | The Trade Desk | Advertising |
| TiPMix | TPX | www.theiia.org | IIA (Azure infrastructure) | Necessary |
| UserMatchHistory | Marketing | .linkedin.com | Advertising | |
| VID | Marketing | .linkedin.com | Advertising | |
| visit | Marketing | .linkedin.com | Functional | |
| x-ms-routing-name | TPX | www.theiia.org | IIA (Azure infrastructure) | Necessary |