A board asks one question at the end of the year: can we trust what internal audit told us? That is the purpose of a quality assurance and improvement program, and its key components exist to answer it with structured evidence rather than assertion.
The quality assurance and improvement program (QAIP) is the documented system a function uses to evaluate whether it conforms with the Global Internal Audit Standards, whether it operates in line with its charter and mandate, and whether it is performing effectively. Two words carry the load. Assurance looks backward and asks whether the work met the required level. Improvement looks forward and asks what gets fixed next.
The chief audit executive (CAE) develops, maintains, and owns the program. Responsibility does not shift to the assessor, the board, or a consultant.
KEY: Scope covers all internal audit work, including engagements performed by external service providers and by co-source partners under the function's name. Buying the hours does not remove them from the QAIP.
Common mistakes
- Collapsing internal assessments into one element. Ongoing monitoring and periodic self-assessment are distinct. A function with strong supervisory review but no periodic self-assessment is missing a required element.
- Treating five years as a target date. Five years is a maximum interval. A gap of 5 years and 5.5 months is nonconformance, not a scheduling delay.
- Accepting an in-group assessor. A parent-company team or sister-subsidiary reviewer is inside the organization. Independence for the external element means outside the whole organization.
Bottom line
- Four required elements: ongoing monitoring, periodic self-assessment, external assessment, and performance measurement with reporting.
- CAE ownership: the CAE develops and maintains the QAIP; scope includes work performed by external and co-source providers.
- Internal split: ongoing monitoring is continuous and supervision-based; periodic self-assessment is scheduled and function-wide.
- External interval: at least once every five years, by a qualified assessor independent of the entire organization, not merely outside the function.
Exam shortcut
When a stem gives a date for the last external assessment, subtract before reading the options. Past five years means disclose nonconformance to senior management and the board, not "schedule one soon." When an assessor is proposed, run two filters in order: independence first, competence second. Independence kills parent-company teams, sister subsidiaries, and any firm that recently built or advised on the function's methodology, regardless of price or credentials.
The full lesson (about 2,107 words, 14 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 1
Browse all free CIA Part 3 lessons or jump into free CIA Part 3 practice questions.