2.6 Quality Assurance and Improvement Program (QAIP)
Key Takeaways
- The QAIP lets stakeholders judge the function's conformance with the Standards and Code of Ethics; the CAE owns it and cannot delegate that responsibility.
- Internal assessments combine continuous ongoing monitoring with periodic self-assessments; external assessments are a separate pillar.
- External assessments are required at least every five years by a qualified, independent assessor from outside the organization (or self-assessment with independent external validation).
- A function may state it 'conforms with the Standards' only when assessments — including an external one within five years — support it; belief alone is insufficient.
- Nonconformance that affects the function's overall scope or operation must be disclosed (what, why, impact) to senior management and the board.
What the QAIP Is and Who Owns It
The Quality Assurance and Improvement Program (QAIP) is the mechanism that lets the internal audit function — and its stakeholders — judge whether it conforms with the Standards and the Code of Ethics and operates effectively and efficiently. The chief audit executive (CAE) is responsible for developing and maintaining the QAIP; this responsibility cannot be delegated away.
The QAIP has two pillars, and the exam expects you to know the timing and the assessor of each:
| Element | Frequency | Performed by |
|---|---|---|
| Internal assessments — ongoing monitoring | Continuous, built into routine supervision | The function itself (supervision, metrics, checklists) |
| Internal assessments — periodic self-assessments | Periodically (often annually) | Someone within the function with sufficient knowledge of practice |
| External assessments | At least once every five years | A qualified, independent assessor or assessment team from outside the organization |
The "every five years" rule for external assessments is one of the most frequently tested single facts in this material. Memorize it cold.
Internal vs. External Assessments — the Mechanics
Internal assessments combine two layers:
- Ongoing monitoring is embedded in day-to-day practice: engagement supervision, working-paper review, performance metrics, project budgets vs. actuals, and client feedback. It is continuous, not a one-time event.
- Periodic self-assessments look back over a span of work to evaluate conformance with the Standards and the efficiency/effectiveness of the activity.
External assessments must occur at least once every five years by a qualified (competent in the profession and the QAIP process) and independent (free of any conflict, from outside the organization) reviewer. Two valid forms:
- A full external assessment by an outside team, or
- A self-assessment with independent external validation (SAIV) — the function self-assesses, then a qualified independent external reviewer validates it.
Who approves the external assessor and discusses its form and frequency? The CAE discusses with the board. A worked rule: if a stem asks who selects/oversees the external assessor, the answer involves the board's oversight, not management — protecting independence. An assessor employed elsewhere in the same organization is not independent and cannot perform the external assessment.
Reporting Results and Conformance Statements
Results of the QAIP must be communicated to senior management and the board — the CAE reports upon completion of internal and external assessments, and at least annually on the QAIP overall.
The conformance-statement rule (high-yield)
The phrase "conforms with the Global Internal Audit Standards" (historically, the International Standards) may be used only if assessments — including at least one external assessment within five years — support that the function conforms. No supporting external assessment, no conformance claim.
Disclosing nonconformance
When nonconformance affects the overall scope or operation of the internal audit function, the CAE must disclose the nonconformance and its impact to senior management and the board. Disclosure rules to memorize:
- Disclose what failed to conform, why, and the impact on the engagement or the activity.
- Nonconformance significant enough to affect the function's overall scope/operation must be reported to the board — it cannot be buried.
- The function may not state it "conforms" while material nonconformance exists.
Worked decision
Internal audit has never had an external assessment, though the CAE believes the team follows the Standards closely.
The function may not state that it "conforms with the Standards," because no external assessment within five years supports the claim. Belief is insufficient; the conformance statement is evidence-based. The CAE should schedule an external assessment and, until then, refrain from asserting full conformance. This belief-vs-evidence gap is the classic QAIP exam trap.
Ongoing Monitoring vs. Periodic Self-Assessment — Don't Confuse Them
Within internal assessments, the exam separates two layers and tests which tool belongs to which:
| Layer | What it is | Typical tools |
|---|---|---|
| Ongoing monitoring | Continuous, built into routine supervision | Engagement supervision, working-paper review, checklists, performance metrics, project budget vs. actual, client satisfaction surveys |
| Periodic self-assessment | A point-in-time look back over a body of work | Self-assessment against each Standard, peer review within the function, benchmarking |
A stem describing real-time supervisory review of every engagement points to ongoing monitoring; a stem describing an annual review of conformance with the Standards by the team points to periodic self-assessment.
Qualified and independent — both words matter
For the external assessment, the assessor must be qualified (demonstrated competence in professional practice and in the external-assessment process) and independent (no real or apparent conflict, and not from within the organization). A reviewer from a sister business unit fails the independence test; a generalist with no QAIP experience fails the qualification test. The CAE discusses the assessor's qualifications and independence with the board.
How QAIP results connect to the rest of Part 1
The QAIP is the feedback loop that proves the function actually delivers on the other domains: it tests whether independence, objectivity, proficiency, and due professional care are being honored in practice. That is why nonconformance affecting overall scope must reach the board — it signals a breakdown in the very safeguards the rest of Part 1 describes. Treat QAIP as the audit of the auditors, and the reporting rules become intuitive: material problems go up to those charged with governance, never stay hidden in the function.
Numbers and phrases to memorize
- External assessment: at least once every 5 years.
- Two valid external forms: full external assessment or self-assessment with independent external validation (SAIV).
- Conformance statement requires a supporting external assessment within the last 5 years.
- QAIP results reported to senior management and the board at least annually, plus on completion of each assessment.
- Responsibility for the QAIP rests with the CAE and cannot be delegated.
How often must an external assessment of the internal audit activity be conducted, and by whom?
An internal audit function has never undergone an external assessment but the CAE is confident the team follows the Standards. May the function state it 'conforms with the Standards'?