3.5 Practice Drills and Readiness Markers

The QAIP, end to end (Standards 8.3, 8.4, 12.1)

The quality assurance and improvement program (QAIP) is the CAE's program to evaluate whether the function conforms with the Standards, achieves its performance objectives, and pursues continuous improvement. Standard 8.3 Quality requires the CAE to develop, implement, and maintain a QAIP covering all aspects of the function, made up of two assessment types:

Internal assessment has two layers. Ongoing monitoring is built into routine supervision — reviewing engagement planning, workpapers, and final communications, plus stakeholder feedback and metrics like budget-to-actual and plan completion. Periodic self-assessment is the broader, holistic review of conformance against every standard. Based on self-assessment results, the CAE develops action plans for any nonconformance and communicates them to the board and senior management.

External assessment specifics (Standard 8.4)

The external assessment is the high-yield QAIP fact set:

• It must be performed at least once every five years.
• The assessor or team must be qualified and independent of the organization.
• At least one member must hold an active Certified Internal Auditor® (CIA) designation — a 2024-Standards requirement worth memorizing.
• The requirement may be met by a self-assessment with independent validation (SAIV) — the function self-assesses, and an independent party validates the result.
• The CAE develops the plan and discusses it with the board; the board reviews/approves scope, frequency, and assessor competence, and receives the complete results directly from the assessor.
• The board and CAE may choose more frequent assessments after events like a new CAE, a merger of audit functions, major methodology changes, or heavy staff turnover.

Reporting cadence — who hears what, and when

• Organizational independence: the CAE confirms it to the board at least annually (Standard 7.1).
• Internal assessment results: communicated to the board and senior management at least annually (Standard 8.3).
• External assessment results: communicated when completed (Standard 8.3).

Communications in all cases cover conformance with the Standards, achievement of performance objectives, any legal/regulatory compliance issues, and action plans for deficiencies.

How the QAIP connects back to the rest of Section B

The QAIP is not a standalone topic — it is the feedback loop that keeps integrity, objectivity, competency, due professional care, and confidentiality honest. The periodic self-assessment measures the function's conformance against every standard, and the ongoing monitoring built into daily supervision catches problems engagement by engagement. The external assessment then independently validates all of it and is the formal mechanism by which the function can claim it conforms with the Global Internal Audit Standards.

This is why the exam frequently links QAIP facts to ethics behavior. A function that lets an auditor audit their own recent work, accepts vendor gifts, or skips ethics CPE is generating nonconformances that a periodic self-assessment should surface and an external assessor would flag. Conversely, a strong QAIP is evidence of conformance for nearly every ethics standard — note how often the Standards list "results of internal and external quality assessments" among their examples of conformance.

Numbers you must not miss

Readiness drills for the whole chapter

Use a two-column recall sheet: cue on the left, controlling standard and required action on the right. Drill until you can produce the right column from memory.

Readiness markers

• Recall: state the five ethics principles (Integrity, Objectivity, Competency, Due Professional Care, Confidentiality) without notes.
• Discrimination: instantly label a scenario as independence vs objectivity and as assurance vs advisory.
• Application: name who must act (auditor, CAE, senior management, board) and the disclosure path.
• Currency: avoid retired language ("generally conforms") and remember the 12-month, 5-year, and annual numbers.
• Retention: re-run a mixed set after a one-day break and keep your rationale quality stable. If you can name a rule but not the action, or the action but not the standard, the material is not yet exam-ready.

A final drill: for each of the five ethics principles, write one sentence describing the behavior it demands and one describing the failure the exam will test (for example, Confidentiality demands protecting non-public information and is failed by trading on a planned acquisition). When you can produce both halves for all five principles without notes, and can place each scenario on the independence-versus-objectivity and assurance-versus-advisory axes, Section B is exam-ready.