CIA Quality Assurance and Improvement

What the QAIP does

A quality assurance and improvement program, or QAIP, helps the chief audit executive assess whether internal audit conforms with the Global Internal Audit Standards and whether the function is meeting its performance objectives. It is an ongoing management responsibility, not a project performed only when an external assessment is due.

A QAIP provides evidence about policies, engagement supervision, workpaper quality, stakeholder communication, plan delivery, and corrective action. It should identify strengths and weaknesses, support improvement, and help the chief audit executive communicate honestly about the function.

The program has three connected parts: ongoing monitoring, periodic internal assessments, and external quality assessment. Together they provide routine feedback, structured self-evaluation, and independent external perspective.

Ongoing monitoring

Ongoing monitoring occurs through ordinary management of internal audit work. Examples include engagement supervision, review of workpapers and reports, monitoring methodology adherence, reviewing stakeholder feedback, and tracking performance measures.

An engagement supervisor can identify whether evidence supports findings, criteria are clear, scope limitations are documented, and review notes are resolved. Function leaders can aggregate recurring issues: missing risk assessments, inconsistent sampling documentation, late reports, or action items closed without verification.

Monitoring should be timely enough to address problems before they become systemic. If several engagement teams fail to document criteria, the chief audit executive can clarify methodology, train staff, strengthen supervision, and test whether work improves. A quarterly dashboard that reports the number of reviews but ignores recurring weaknesses is not a complete quality response.

Periodic internal assessments

Periodic internal assessments evaluate conformance and performance more broadly than routine file review. They may use self-assessment, peer review, or another qualified internal evaluator who is sufficiently independent of the work assessed. The process should be documented and objective.

An assessment can examine whether the internal audit charter, methodologies, governance relationships, risk-based planning, resource management, engagement work, reporting, and follow-up align with Standards and expectations. It also considers performance objectives and opportunities for improvement.

Suppose the function has an established advisory practice. A periodic assessment can evaluate whether advisory boundaries are clear, objectivity safeguards are tracked, and assurance coverage remains adequate. It should not merely confirm that an advisory template exists.

External quality assessment

An external quality assessment is required at least once every five years. It is conducted by a qualified independent assessor or assessment team from outside the organization, or through a self-assessment with independent external validation when permitted by current Standards. The assessor must have appropriate competence and independence.

The external assessment considers the function’s conformance with the Standards and performance objectives. It can include document review, interviews, stakeholder perspectives, and examination of selected engagement files. The chief audit executive should prepare the function, provide access, consider findings, and develop an action plan.

The five-year interval is a minimum requirement, not a reason to postpone corrective work until the next assessment. Major changes, recurring deficiencies, or stakeholder concerns may justify additional internal review before the next external cycle.

Communicating conformance and nonconformance

The chief audit executive communicates quality program results and significant nonconformance to senior management and the board as required. If a function claims that its work conforms with the Standards, the claim must be supported by the quality program.

When significant nonconformance affects the function or a specific engagement, assess its nature, scope, impact, and implications for prior or current communications. Communicate the matter through appropriate governance channels and take corrective steps. Do not leave a claim in place simply because it appears in a standard report template.

A finding from an assessment is not automatically significant nonconformance. Evaluate severity and impact using the Standards and the function’s governance framework. The response should be proportionate and transparent.

From assessment to improvement

A QAIP is useful when findings lead to action. Assign an owner, set a practical due date, identify the expected evidence, and monitor progress. If the assessment identifies a competence gap, training alone may be insufficient; check whether assignments, supervision, recruiting, or co-sourcing also need adjustment.

Example: external reviewers find that workpapers do not consistently link objectives to procedures. The chief audit executive updates the methodology, trains staff, adds supervisory checkpoints, and samples later files to test adoption. Closing the action after the training session would show completion of one activity, not that workpaper quality improved.

Track whether the issue recurs and whether intended outcomes were achieved. Quality improvement should connect to risk, stakeholder needs, and the function’s ability to provide assurance.

Worked example: unsupported conformance assertion

An internal assessment finds repeated deficiencies in engagement evidence and review, but the annual report states that all work was conducted in accordance with the Standards. The chief audit executive determines which engagements and periods are affected, whether the deficiencies are isolated or systemic, and whether conclusions were impacted.

The chief audit executive communicates significant nonconformance and its effect to senior management and the board as required, corrects the assertion when appropriate, and develops an action plan. The function revises guidance and review practices, then tests future files.

The wrong responses are to ignore the finding because it was internal, delete files, or wait for a five-year assessment. Each leaves stakeholders with unsupported assurance or delays a known correction.

Common QAIP misunderstandings

QAIP is not only an external assessment. It is not a pass/fail certificate that guarantees every engagement conclusion is correct. It does not transfer the chief audit executive’s responsibility to a consultant. And it is not complete when an action is marked finished without checking its effect.

Use precise terms. A self-assessment can be part of internal quality work; an independent external assessment provides outside evaluation. Ongoing monitoring occurs in normal management. Their scope and evidence differ.

The current Part 3 Quality domain is 15%. Study the program as a cycle: monitor work, assess function-wide conformance, obtain external perspective, communicate results, improve, and verify.

Exam application

When a scenario describes recurring engagement errors, identify whether the issue is routine supervision, a broader QAIP concern, or significant nonconformance. Determine who evaluates impact and who receives communication.

If the question asks whether the function may claim conformance, look for supporting assessment evidence and unresolved issues. If it asks what happens after a quality finding, select corrective action and follow-up, not merely acknowledgement.

Use the five-year external assessment requirement accurately, but do not confuse the interval with the ongoing quality responsibility.

Choose qualified assessors

Internal reviewers need sufficient knowledge and independence from the work they assess. A person should not provide an objective assessment of their own engagement without appropriate safeguards. External assessors need relevant internal audit knowledge, professional judgment, and freedom from conflicts.

The chief audit executive should evaluate credentials and experience, scope, objectivity, and familiarity with the Standards. A prestigious firm is not automatically qualified for every function, and an internal assessor from another unit may still have relationships that affect objectivity.

Connect measures to function objectives

Performance objectives may include stakeholder expectations, plan delivery, quality, resource stewardship, and contribution to governance and risk management. Measures should be defined, supported, and interpreted with context.

If the function tracks report turnaround, define when the clock starts and ends and whether complexity is considered. If the measure rewards speed without review findings, the function may encourage incomplete work. Pair activity measures with quality and outcome evidence.

Assessment results and governance

The chief audit executive shares quality information with senior management and the board in a form that supports oversight. Explain the assessment scope, conclusion, significant findings, action plan, and any effect on prior communications.

A material issue should not be hidden in a technical appendix. Governance recipients need to know whether assurance conclusions or a conformance statement were affected. Corrective action should have an owner and a way to verify completion.

Quality scenario variation

If a function has no external assessment within the required five-year interval, the chief audit executive should arrange a qualified external assessment and communicate the deficiency as appropriate. The answer is not to substitute routine file reviews for the independent external perspective.

If a single engagement has a documentation defect but broader QAIP results remain sound, address the file and assess whether the issue is isolated. Do not describe every problem as a significant function-wide nonconformance without evaluation.

A mature quality response checks whether corrective action changed outcomes. If staff training is completed, sample later work to see whether criteria and procedures are documented. If review standards are revised, inspect whether supervisors apply them consistently. If stakeholder feedback is negative, determine whether the problem is timeliness, clarity, access, or expectation setting. The QAIP should feed changes into methodology, development, and performance monitoring rather than treating each assessment as a one-time report.

Additional function-level application

A quality calendar can plan routine file reviews, periodic self-assessment, and the five-year external assessment. It should also allow event-driven review after major methodology changes or repeated engagement failures. Planning the calendar does not replace judgment about when a concern needs immediate attention.

A quality example should be concrete: an identified weakness, the action taken, and later evidence that the process improved.

A function should also preserve assessment records and document how conclusions were reached. Clear records help governance understand the quality result and allow later reviewers to verify corrective action.

Review the action at a later interval.

Verify that it resolved the gap.