Category: Internal Audit and Assurance

Quality Assurance and Improvement Program

Also known as: QAIP, Quality Assurance and Improvement Programme

Simply put

A Quality Assurance and Improvement Program (QAIP) is a structured set of activities an internal audit function uses to check that its work meets recognized professional standards and to identify ways to improve. It typically gives the board and management a level of assurance that the internal audit function is operating effectively. The specifics of any QAIP depend on the function's size, mandate, and the standards it chooses to follow.

Formal definition

A QAIP is a program established to evaluate an internal audit function's conformance with the applicable internal audit standards (such as the IIA's Global Internal Audit Standards) and to drive continuous improvement of the activity. It is generally designed to draw conclusions about the quality of the internal audit function, generate recommendations for appropriate improvements, and provide reasonable assurance to stakeholders, including the board and senior management. A QAIP typically encompasses both internal assessments (ongoing monitoring and periodic self-assessment) and external assessments, though the precise composition and cadence depend on the standards adopted and the function's circumstances. This entry is educational and does not constitute audit, legal, or compliance advice; conformance requirements and their applicability vary by the standards framework a given function elects or is required to apply.

Why it matters

Internal audit exists to give the board and senior management independent, objective assurance about governance, risk management, and control. That assurance is only as credible as the audit function producing it. A QAIP matters because it is the mechanism by which the function demonstrates that its own work conforms with recognized professional standards, such as the IIA's Global Internal Audit Standards, and that its conclusions can be relied upon. Without a structured program to evaluate quality, stakeholders have little basis for confidence that audit findings are sound, that methodologies are consistent, or that the function is genuinely independent.

A QAIP also shifts internal audit from a static compliance exercise toward continuous improvement. By drawing conclusions about the quality of the internal audit activity and generating recommendations for appropriate improvements, it helps the function identify gaps, adapt to changing risks, and enhance its performance over time. For the audit committee and board, a functioning QAIP provides evidence that the assurance function they depend on is itself subject to disciplined oversight rather than operating unchecked.

It is important to be clear about scope and applicability. The precise conformance requirements, and whether they apply at all, depend on the standards framework a given function elects or is required to follow; some public sector and regulated entities face specific expectations, while others adopt IIA standards voluntarily. This entry is educational and does not constitute audit, legal, or compliance advice. Whether a particular QAIP is adequate is a matter of professional judgment informed by the function's size, mandate, and adopted standards.

Who it's relevant to

Chief Audit Executives and Internal Audit Leaders

The chief audit executive typically owns the design, implementation, and maintenance of the QAIP. This role is responsible for establishing ongoing monitoring and periodic self-assessments, arranging external assessments, and ensuring the program supports conformance with the standards the function has adopted and drives continuous improvement of the activity.

Audit Committees and Boards

The board, typically acting through its audit committee, is a primary recipient of the reasonable assurance a QAIP is intended to provide. Members use QAIP results to gauge whether the internal audit function they rely on is operating effectively and conforming with recognized standards, informing their oversight of the function without assuming its operational management.

Senior Management

Senior management is among the stakeholders a QAIP is designed to serve. Management draws on the program's conclusions and recommendations to understand the reliability of internal audit's work, while recognizing that responsibility for the quality of the audit function itself sits with the audit function and its oversight, not with the operational areas audit reviews.

Internal Audit Staff

Auditors performing engagements are affected by the ongoing monitoring and supervision embedded within a QAIP. Their day-to-day work, methodologies, and documentation are the raw material against which conformance and quality are evaluated, and the program's improvement recommendations shape how they carry out future engagements.

External Quality Assessors

Independent reviewers who conduct external assessments provide an objective, outside evaluation of the function's conformance and quality. Their involvement is generally a component of a complete QAIP under standards frameworks that call for periodic external assessment, though the specific requirements and frequency depend on the standards the function applies.

Inside QAIP

Internal Assessments

Ongoing monitoring and periodic self-assessments of the internal audit activity's performance, typically conducted by or under the direction of the chief audit executive. Ongoing monitoring is generally embedded in routine supervision and management of the function, while periodic self-assessments review conformance with applicable professional standards and the internal audit charter.

External Assessments

Evaluations conducted by a qualified, independent assessor or assessment team from outside the organization. Under the standards commonly issued by the Institute of Internal Auditors, these are generally expected at least once every five years, though the specific frequency and form may depend on the applicable professional framework and organizational circumstances.

Conformance Evaluation

An assessment of whether the internal audit activity operates in accordance with a recognized set of professional standards, its charter, and its own policies and procedures. This is a measure of adherence to established criteria rather than a guarantee of audit quality outcomes.

Performance and Efficiency Assessment

Review of the internal audit activity's effectiveness and efficiency, which may identify opportunities for improvement in how audit work is planned, executed, and reported. The scope of what is measured typically depends on the objectives set by the chief audit executive and expectations of the board or audit committee.

Reporting to the Board and Senior Management

Communication of QAIP results, including conformance conclusions and improvement plans, to senior management and the board or its audit committee, who typically hold oversight responsibility for the internal audit function. The chief audit executive generally owns the QAIP itself, while the board provides oversight rather than operating the program.

Common questions

Answers to the questions practitioners most commonly ask about QAIP.

Is a Quality Assurance and Improvement Program the same thing as internal audit's regular testing of controls?

No. A QAIP evaluates the internal audit function itself, its conformance with applicable professional standards and the effectiveness of its activity, rather than testing the organization's operational or financial controls. The controls testing internal audit performs is part of its engagement work, whereas the QAIP is a mechanism that assesses the quality and performance of that work and the audit function overall. Confusing the two obscures the QAIP's purpose, which is assurance over the assurance provider. The specific expectations for a QAIP generally derive from professional standards for internal auditing, and their applicability depends on whether the function has adopted or committed to those standards.

Does having a QAIP mean the internal audit function can declare itself fully compliant with professional standards?

Not automatically. A QAIP is the program through which conformance is assessed and improvement is pursued; it does not by itself confer conformance. Under many professional frameworks, a statement that an internal audit activity conforms with the applicable standards is typically supported only when the results of both internal and external assessments support that conclusion. Where assessments identify gaps, the appropriate approach is generally to disclose non-conformance and its impact rather than to overstate the function's status. The QAIP is a tool for evidencing and improving quality, not a guarantee of it.

What are the typical components of a QAIP?

A QAIP generally includes both internal and external assessments. Internal assessments typically cover ongoing monitoring embedded in the day-to-day supervision and management of the audit activity, together with periodic self-assessments or assessments performed by others within the organization with sufficient knowledge of the applicable standards. External assessments are usually conducted by a qualified, independent reviewer or team from outside the organization on a periodic basis. The precise scope, frequency, and terminology depend on the professional standards the function has adopted, so those standards should be consulted directly.

Who is accountable for the QAIP, and what role does the audit committee play?

Responsibility for developing and maintaining the QAIP generally rests with the chief audit executive, as an element of managing the internal audit function. The board or its audit committee typically exercises oversight, for example, by receiving reports on the program's results, discussing external assessment outcomes, and considering the implications for the reliability of assurance the function provides. This reflects the broader distinction between management's operational responsibility and the board's oversight duty; the audit committee generally does not run the QAIP but oversees it. Specific reporting lines and expectations vary by organization and by the governance framework in place.

How often should external assessments be performed?

Professional standards for internal auditing commonly call for external assessments to be performed on a periodic basis by a qualified, independent party. Rather than relying on a specific interval, functions should consult the current version of the standards they have adopted for the applicable frequency and for any permitted approaches, such as an independent external review or a self-assessment with independent validation. Because expectations can be updated and can differ by framework and jurisdiction, the governing standard should be treated as the authoritative source for timing.

How should the results of a QAIP be reported and used?

Results are typically communicated to senior management and the board or audit committee, and are used to inform statements about the internal audit function's conformance with applicable standards. Beyond conformance, the improvement dimension of the program means findings should generally feed into corrective action plans and enhancements to audit methodology, staffing, and processes. Where assessments reveal non-conformance that affects the overall scope or operation of the function, disclosure of that impact is generally expected. This entry is educational and not audit, legal, or compliance advice; how results are handled depends on the applicable standards, the organization's facts, and professional judgment.

Common misconceptions

A QAIP is only about the periodic external assessment.

A QAIP is generally intended to be a continuous program encompassing ongoing monitoring, periodic internal self-assessments, and external assessments. The external assessment is one component, not the entirety, and the internal elements typically operate throughout the year.

A QAIP guarantees the quality or correctness of individual audit conclusions.

A QAIP assesses conformance with professional standards and the audit charter and identifies improvement opportunities; it does not certify the accuracy of every engagement outcome. It is a process-level assurance mechanism, not a warranty of audit results.

The board or audit committee is responsible for running the QAIP.

The chief audit executive typically develops, maintains, and executes the QAIP, while the board or audit committee generally provides oversight and receives reporting on its results. Confusing the oversight role with the operational responsibility misattributes accountability.

Best practices

Establish the QAIP as a continuous program that combines embedded ongoing monitoring, periodic internal self-assessments, and external assessments, rather than treating it as a single point-in-time exercise.

Define assessment criteria explicitly against the applicable professional standards, the internal audit charter, and internal policies, and document how conformance is being evaluated.

Confirm the frequency and form of external assessments against the professional framework the function has adopted, and consider the qualifications and independence of any external assessor before engagement.

Report QAIP results, including conformance conclusions and improvement actions, to senior management and the board or audit committee on a defined cadence, clarifying that the chief audit executive owns the program while the board provides oversight.

Track identified improvement opportunities through to remediation, assigning ownership and timelines so that the QAIP drives measurable enhancements rather than generating findings that go unaddressed.

Periodically revisit the QAIP's own design to ensure it remains aligned with changes in the audit charter, organizational structure, and the professional standards or frameworks the function relies upon.