2.6 Quality Assurance and Improvement Program (QAIP)
Key Takeaways
The QAIP evaluates the function's conformance with the Global Internal Audit Standards, achievement of performance objectives, and continuous improvement; the CAE must develop, implement, and maintain it.
Internal assessments combine continuous ongoing monitoring with periodic self-assessments; external assessments are a separate pillar.
External assessments are required at least every five years by a qualified, independent assessor from outside the organization (or self-assessment with independent external validation).
A function may state it 'conforms with the Standards' only when assessments — including an external one within five years — support it; belief alone is insufficient.
Nonconformance that affects the function's overall scope or operation must be disclosed (what, why, impact) to senior management and the board.
What the QAIP Is and Who Owns It
The 2025 CIA syllabus tests the QAIP in Part 3 (Section C, Quality of the Internal Audit Function, 15%); the Part 1 syllabus lists no QAIP objective, so treat this section as background on the Standards.
The Quality Assurance and Improvement Program (QAIP) is the CAE's program to evaluate and ensure that the internal audit function conforms with the Global Internal Audit Standards, achieves its performance objectives, and pursues continuous improvement. The chief audit executive (CAE) must develop, implement, and maintain it (Standard 8.3).
The QAIP has two pillars; know the timing and the assessor of each:
| Element | Frequency | Performed by |
|---|---|---|
| Internal assessments — ongoing monitoring | Continuous, built into routine supervision | The function itself (supervision, metrics, checklists) |
| Internal assessments — periodic self-assessments | Periodically (often annually) | Someone within the function with sufficient knowledge of practice |
| External assessments | At least once every five years | A qualified, independent assessor or assessment team from outside the organization |
The "at least once every five years" rule for external assessments is the number to remember.
Internal vs. External Assessments — the Mechanics
Internal assessments combine two layers:
- Ongoing monitoring is embedded in day-to-day practice: engagement supervision, working-paper review, performance metrics, project budgets vs. actuals, and client feedback. It is continuous, not a one-time event.
- Periodic self-assessments look back over a span of work to evaluate conformance with the Standards and the efficiency/effectiveness of the activity.
External assessments must occur at least once every five years by a qualified (competent in the profession and the QAIP process) and independent (free of any conflict, from outside the organization) reviewer. Two valid forms:
- A full external assessment by an outside team, or
- A self-assessment with independent external validation (SAIV) — the function self-assesses, then a qualified independent external reviewer validates it.
Who approves the external assessor and discusses its form and frequency? The CAE discusses with the board. A worked rule: if a stem asks who selects/oversees the external assessor, the answer involves the board's oversight, not management — protecting independence. An assessor employed elsewhere in the same organization is not independent and cannot perform the external assessment.
Reporting Results and Conformance Statements
Results of the QAIP must be communicated to senior management and the board — the CAE communicates internal quality assessment results at least annually and external quality assessment results when they are completed (Standard 8.3).
The conformance-statement rule (high-yield)
The phrase "conforms with the Global Internal Audit Standards" (historically, the International Standards) may be used only if assessments — including at least one external assessment within five years — support that the function conforms. No supporting external assessment, no conformance claim.
Disclosing nonconformance
When nonconformance affects the overall scope or operation of the internal audit function, the CAE must disclose the nonconformance and its impact to senior management and the board. Disclosure rules to memorize:
- Disclose what failed to conform, why, and the impact on the engagement or the activity.
- Nonconformance significant enough to affect the function's overall scope/operation must be reported to the board — it cannot be buried.
- The function may not state it "conforms" while material nonconformance exists.
Worked decision
Internal audit has never had an external assessment, though the CAE believes the team follows the Standards closely.
The function may not state that it "conforms with the Standards," because no external assessment within five years supports the claim. Belief is insufficient; the conformance statement is evidence-based. The CAE should schedule an external assessment and, until then, refrain from asserting full conformance. This belief-vs-evidence gap is the classic QAIP exam trap.
Ongoing Monitoring vs. Periodic Self-Assessment — Don't Confuse Them
Within internal assessments, the exam separates two layers and tests which tool belongs to which:
| Layer | What it is | Typical tools |
|---|---|---|
| Ongoing monitoring | Continuous, built into routine supervision | Engagement supervision, working-paper review, checklists, performance metrics, project budget vs. actual, client satisfaction surveys |
| Periodic self-assessment | A point-in-time look back over a body of work | Self-assessment against each Standard, peer review within the function, benchmarking |
A stem describing real-time supervisory review of every engagement points to ongoing monitoring; a stem describing an annual review of conformance with the Standards by the team points to periodic self-assessment.
Qualified and independent — both words matter
For the external assessment, the assessor must be qualified (demonstrated competence in professional practice and in the external-assessment process) and independent (no real or apparent conflict, and not from within the organization). A reviewer from a sister business unit fails the independence test; a generalist with no QAIP experience fails the qualification test. The CAE discusses the assessor's qualifications and independence with the board.
How QAIP results connect to the rest of Part 1
The QAIP is the feedback loop that proves the function actually delivers on the other domains: it tests whether independence, objectivity, proficiency, and due professional care are being honored in practice. That is why nonconformance affecting overall scope must reach the board — it signals a breakdown in the very safeguards the rest of Part 1 describes. Treat QAIP as the audit of the auditors, and the reporting rules become intuitive: material problems go up to those charged with governance, never stay hidden in the function.
Numbers and phrases to memorize
- External assessment: at least once every 5 years.
- Two valid external forms: full external assessment or self-assessment with independent external validation (SAIV).
- Conformance statement requires a supporting external assessment within the last 5 years.
- Internal assessment results go to senior management and the board at least annually; external assessment results when completed.
- The CAE must develop, implement, and maintain the QAIP.
How often must an external assessment of the internal audit activity be conducted, and by whom?
Annually, by the internal audit staff themselves
At least once every five years, by a qualified, independent assessor from outside the organization
Every three years, by the organization's external financial-statement auditor
Only when senior management requests one, by any willing reviewer
An internal audit function has never undergone an external assessment but the CAE is confident the team follows the Standards. May the function state it 'conforms with the Standards'?
Yes, because the CAE's professional judgment is sufficient evidence of conformance
Yes, as long as no stakeholder objects
No, because a conformance statement requires supporting assessments, including an external assessment within five years
No, because conformance can never be claimed by an internal audit function
Sections you finish are checked off in the contents.