Internal versus External Quality Assessments: A CIA Exam Guide to the Quality Assurance and Improvement Program (QAIP)
Overview
Every internal audit function must be able to show that it works well. The board, senior management, regulators and external auditors all rely on its assurance. The Institute of Internal Auditors (IIA) therefore requires a Quality Assurance and Improvement Program (QAIP). The QAIP has two pillars:
• Internal assessments, which the internal audit function performs or arranges inside the organization.
• External assessments, which a qualified, independent party from outside the organization performs.
CIA candidates are regularly tested on how these two differ. Typical questions ask about frequency, who may perform each one, independence requirements, reporting lines and the conformance statement. This guide explains why the topic matters, what each assessment is, how each works and how to handle exam questions.
Where this sits in the syllabus
This page appears under the Part 3 path for quality of the internal audit function. The detailed QAIP rules are mainly examined in CIA Part 1 under the current syllabus. Check your exam blueprint so you know where the heaviest testing falls.
1. Why Quality Assessments Are Important
• Credibility and trust: Stakeholders need evidence that internal audit conforms with the IIA Standards and adds value. Quality assessments provide that evidence.
• Conformance claims: Internal audit may state that it "conforms with the Standards" only if the results of the QAIP support that statement. Without an external assessment, the claim cannot be made.
• Continuous improvement: Assessments find gaps in methodology, staffing, tools and stakeholder service. They drive action plans for improvement.
• Governance and accountability: The board uses assessment results to oversee internal audit's effectiveness, resources and independence.
• Objectivity check: Internal assessments alone carry a self-review risk. External assessments supply the independent viewpoint that internal reviews cannot.
2. What They Are: Key Definitions
A. Internal Assessments
The 2017 IPPF Standard 1311 and the 2024 Global Internal Audit Standards (GIAS), Standard 12.1 Internal Quality Assessment, describe two components:
1. Ongoing monitoring
This is the day-to-day, built-in part of quality. Examples include:
• Engagement supervision and review of workpapers and reports.
• Standard policies, procedures, templates and checklists.
• Post-engagement client feedback surveys.
• Key performance indicators (KPIs), such as plan completion rate, cycle time, recommendations accepted and staff certifications.
• Analysis of budget versus actual hours.
2. Periodic self-assessments
These are separate, scheduled reviews of conformance with the Standards and the internal audit charter. They are performed by:
• Members of the internal audit function with sufficient knowledge of internal audit practices (for example, a dedicated QA team), or
• Other people in the organization who have that knowledge (for example, a compliance specialist outside internal audit).
Periodic self-assessments are often done annually, or more often if needed. They frequently mirror the external assessment methodology so the function is ready for the next external review.
B. External Assessments
External assessments are covered by 2017 Standard 1312 and GIAS Standard 8.4 External Quality Assessment.
Frequency
• They must be conducted at least once every five years.
Who performs them
• A qualified, independent assessor or assessment team from outside the organization.
Two acceptable approaches
• Full external assessment: The external team performs the entire review.
• Self-assessment with independent (external) validation (SAIV): Internal audit performs a rigorous self-assessment, and a qualified, independent external validator confirms the process and conclusions.
Qualified
The assessor must have competence in internal audit professional practice and the external assessment process. Under the GIAS, at least one member of the team should hold an active CIA designation.
Independent
The assessor must have no actual, potential or perceived conflict of interest. They must not be part of, or under the control of, the organization. The following generally do not qualify:
• Current or recent employees.
• The organization's external financial statement auditor, where independence is impaired.
• A reciprocal two-party peer review, in which Organization A reviews B and B reviews A.
A peer review among three or more organizations, arranged so that no one reviews the party that reviews them, may be acceptable.
3. How It Works
Step 1: Design the QAIP
The CAE develops and maintains the QAIP. It must cover all aspects of internal audit: conformance with the Standards, the Code of Ethics or Ethics and Professionalism principles, efficiency and effectiveness, and opportunities for improvement.
Step 2: Run internal assessments continuously
Ongoing monitoring is embedded in every engagement. Periodic self-assessments evaluate the function as a whole.
Step 3: Report internal assessment results
The CAE communicates results to senior management and the board at least annually, or periodically as the GIAS requires. Reports include corrective action plans and their status.
Step 4: Plan the external assessment
The CAE discusses the following with the board:
• The form of the assessment (full or SAIV).
• Its frequency, which may need to be more often than every five years, for example after major changes, new leadership or regulatory expectations.
• The scope.
• The qualifications and independence of the assessor, including any potential conflicts.
Step 5: Perform the external assessment
Typical activities include:
• Document review of the charter, methodology, audit plan and workpapers.
• Stakeholder surveys and interviews with the board, senior management and auditees.
• Staff interviews.
• Benchmarking against leading practice.
The usual conformance rating scale is:
• Generally conforms: the highest rating.
• Partially conforms.
• Does not conform.
Step 6: Communicate external results
Results are reported to senior management and the board upon completion. The report includes the assessor's opinion on conformance, recommendations and the CAE's action plans.
Step 7: Use and disclose results
• The statement that internal audit "conforms with the Standards" may be used only if the QAIP, including an external assessment, supports it.
• When nonconformance affects the overall scope or operation of internal audit, the CAE must disclose it to senior management and the board, along with its impact.
Side-by-Side Comparison
• Performed by: Internal: internal audit staff or other knowledgeable people in the organization. External: a qualified, independent party from outside the organization.
• Frequency: Internal: ongoing, plus periodic reviews (often annual). External: at least once every five years.
• Components: Internal: ongoing monitoring and periodic self-assessment. External: full assessment or SAIV.
• Reporting: Internal: at least annually to senior management and the board. External: upon completion.
• Main value: Internal: continuous, timely and low-cost improvement. External: independent, objective validation that supports the conformance claim.
• Key limitation: Internal: self-review risk and lack of independence. External: cost, infrequency and a point-in-time view.
4. Common Exam Scenarios
Scenario 1
A CAE asks a senior internal auditor to review workpapers after each engagement.
• This is ongoing monitoring, part of internal assessment.
Scenario 2
The compliance department, which sits outside internal audit, evaluates the function's conformance once a year.
• This is a periodic self-assessment and still counts as internal.
• The reviewers belong to the organization, so it is not an external assessment.
Scenario 3
Two companies agree to audit each other's internal audit functions.
• This is not acceptable as an external assessment because a reciprocal arrangement impairs independence.
Scenario 4
An internal audit function was formed three years ago and has never had an external assessment. Can it state that it conforms?
• It may make the claim only if the QAIP supports it.
• An external assessment must occur within five years.
• Watch for wording that requires an external assessment to support conformance claims.
Scenario 5
A retired former CAE of the same organization is proposed as the external assessor.
• Independence is likely impaired, so this person should not be selected.
Exam Tips: Answering Questions on Internal versus External Quality Assessments
1. Classify the reviewer first
Ask: "Is the reviewer inside or outside the organization?"
• Anyone employed by the organization makes the review internal, even if they are outside the internal audit department.
2. Memorize the core numbers and words
• External assessment: at least once every five years.
• Internal assessment reporting: at least annually.
• External assessor: qualified and independent, from outside the organization.
3. Know both components of internal assessment
Ongoing monitoring and periodic self-assessment are both internal. Distractors often label a periodic self-assessment as "external."
4. Know both forms of external assessment
A full external assessment and an SAIV are both acceptable. Do not reject an answer just because the internal audit function did much of the work, as long as an independent external party validated it.
5. Watch for independence traps
Answers involving reciprocal two-way peer reviews, former employees, affiliates, or the external auditor in a conflicted position are usually wrong.
6. Identify the responsible parties
• The CAE develops and maintains the QAIP.
• The board oversees it, discusses external assessment arrangements and receives results.
• Under the GIAS, the board approves or discusses the plans for external assessments.
7. Apply the conformance statement rule
"Conforms with the Standards" may be used only when the QAIP results support it. If nonconformance affects overall scope or operation, the CAE must disclose it to senior management and the board.
8. Recognize when to choose "more frequent" answers
If the scenario mentions significant changes, such as a new CAE, a merger, regulatory pressure or a prior "partially conforms" rating, the best answer often involves discussing a more frequent external assessment with the board.
9. Match the purpose to the type
• Questions about timely, day-to-day quality point to ongoing monitoring.
• Questions about objective validation or credibility with stakeholders point to external assessment.
10. Pick the IIA's ideal answer
When several options seem reasonable, choose the one most aligned with the Standards: independence, board involvement, timely communication and continuous improvement. Avoid answers that are merely practical shortcuts.
11. Read qualifiers carefully
Words such as must, at least, only and outside the organization often decide the correct answer.
12. Know both frameworks
Learn the 2017 Standards (1300–1322) and the 2024 Global Internal Audit Standards (Standard 8.3 Quality, Standard 8.4 External Quality Assessment and Standard 12.1 Internal Quality Assessment). The core concepts are the same. The GIAS adds the board's stronger oversight role and the expectation that at least one assessor holds an active CIA.
Quick Memory Aid
"Inside: Daily and Yearly. Outside: Five-yearly and Free of conflict."
Internal assessments are daily monitoring plus yearly self-assessment. External assessments happen at least every five years by assessors free of conflicts of interest.
Summary
Internal assessments give continuous, built-in assurance about quality. External assessments give independent, credible validation at least every five years. Together they form the QAIP, support the claim of conformance with the Standards and drive improvement. On the exam, first decide who performed the review and how independent they are. Then apply the frequency, reporting and disclosure rules.
