QAIP design: internal checks, external assessment, and reporting
A quality assurance and improvement program combines ongoing monitoring, periodic internal assessment, external assessment, and improvement action. Build a program that produces evidence and communicates results. The external assessment cycle does not remove the need to monitor quality between assessments.
Build the quality program as a cycle
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Ongoing monitoring | Use routine supervision and quality checks to detect problems in current work. | Waiting for the external review to address a known weakness. |
| Periodic internal assessment | Evaluate the function through periodic self-assessment or assessment by other knowledgeable people in the organization. | Treating routine file supervision as the entire quality program. |
| External assessment | Arrange qualified independent assessment at least every five years, or self-assessment with independent validation. At least one assessor must hold an active CIA designation. | Treating an internal self-assessment without independent validation as sufficient. |
| Reporting and improvement | Communicate results and improvement plans, assign actions, and follow progress. | Filing the report without addressing the weaknesses. |
Ongoing monitoring
Use routine supervision and quality checks to detect problems in current work.
Avoid: Waiting for the external review to address a known weakness.
Periodic internal assessment
Evaluate the function through periodic self-assessment or assessment by other knowledgeable people in the organization.
Avoid: Treating routine file supervision as the entire quality program.
External assessment
Arrange qualified independent assessment at least every five years, or self-assessment with independent validation. At least one assessor must hold an active CIA designation.
Avoid: Treating an internal self-assessment without independent validation as sufficient.
Reporting and improvement
Communicate results and improvement plans, assign actions, and follow progress.
Avoid: Filing the report without addressing the weaknesses.
A decision path you can use
- 1Monitor work continuously
- 2Assess the function periodically and externally
- 3Report results and verify improvements
Understand the method
Work through the reasoning
Design a program that covers the function
A quality assurance and improvement program should address the function’s activities and its conformance and performance. Identify the assessment methods, responsibilities, evidence, reporting, and improvement process. A calendar entry for an external review is only one element, not the whole program.
Connect the program to actual work. Engagement supervision, monitoring of performance, periodic assessment, and improvement tracking should provide evidence about how the function operates. Use the broad quality lesson to interpret these signals; this lesson focuses on organizing them into a functioning program.
Combine ongoing monitoring with periodic internal assessment
Ongoing monitoring operates through routine supervision and other continuing activities that assess performance and conformance. Periodic internal assessments take a broader look at the function. Define who will perform them and ensure they have sufficient knowledge of internal audit practices and the relevant requirements.
Document the scope, method, results, and required improvements. A checklist can support consistency, but answers should be grounded in evidence. If routine review repeatedly finds weak conclusions, the periodic assessment should consider systemic causes rather than treating each file as an isolated event.
Plan the independent external assessment
The Global Internal Audit Standards require an external quality assessment at least once every five years by a qualified, independent assessor or assessment team. At least one assessor must hold an active Certified Internal Auditor designation. A self-assessment with independent validation is an available route when its requirements are met.
Plan the timing, qualifications, independence, scope, and board involvement early. An internal self-assessment without the required independent validation does not satisfy the external element. Evaluate relevant relationships and conflicts when selecting assessors instead of assuming that anyone outside the immediate audit team is independent.
Report results and track improvements
The chief audit executive communicates internal quality assessment results to the board and senior management at least annually and external assessment results when completed. Reporting should explain relevant conformance, performance, and improvement matters, including significant weaknesses and the actions needed.
Assign owners and dates to improvement actions, then assess whether they work. Completing a revised manual or training event is not enough if the underlying engagement defect persists. Retain evidence of follow-through so the next assessment can evaluate both the original gap and the effectiveness of the response.
Original teaching example
Apply the method to a decision
The scenario
The function received an external assessment four years ago. Repeated internal checks now show weak risk assessment in new engagements. The CAE proposes waiting for the next external review.
The decision
Address the current weakness through the QAIP now, while maintaining the required external assessment arrangements.
The next assessment is not a waiting period for quality improvement. Identify why planning is weak, update the approach, support the team, and examine later engagements for evidence that the change works.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
The external review deadline has no delivery plan
The situation
The function is approaching five years since its last external assessment. A calendar reminder exists, but no assessor, independence evaluation, or assessment route has been arranged.
Reason through it
A reminder does not deliver the assessment. The CAE needs to organize the required process with appropriate board involvement, qualified independent assessors, resources, and timing.
Take the decision
Treat the assessment as a governed program commitment and retain the internal assessment and improvement activities alongside it.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Does a self-assessment alone meet the external assessment requirement?
No. Distinguish internal self-assessment from the permitted self-assessment with independent validation approach. Independence, qualifications, scope, and board oversight still matter.
Does an internal self-assessment alone replace the five-year external assessment?
No. A self-assessment with independent validation is a specific permitted route, with applicable qualification and independence requirements. An internal review without that validation is not the same arrangement.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Quality of the Internal Audit Function (15% of Part 3). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Standards 8.3-8.4 and 12.1. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
Part 3: Internal Audit Function. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.