Periodic Self-Assessments: A Complete CIA Exam Guide to Internal Quality Assessments
Introduction
Periodic self-assessments are one of the main building blocks of an internal audit function's Quality Assurance and Improvement Program (QAIP). Every CIA candidate needs to know where they fit within quality assessments, who performs them, how often, what they cover and how their results are used. This guide explains the concept and shows you how to handle exam questions on it.
1. What Is a Periodic Self-Assessment?
A periodic self-assessment is a structured, point-in-time evaluation of the internal audit function. It is performed either by members of the internal audit function or by other people in the organization who know internal audit practices and the Standards well enough to do it.
It assesses:
• Conformance with the Global Internal Audit Standards, including the Ethics and Professionalism principles (under the former IPPF, the Code of Ethics, the Definition of Internal Auditing and the Standards).
• Conformance with the internal audit charter, policies and methodology.
• Performance, meaning efficiency, effectiveness and progress toward the function's performance objectives.
• Whether the function meets the needs and expectations of the board, senior management and other stakeholders.
The Standards divide quality assessment into two broad categories:
• Internal assessments, which consist of two parts:
1. Ongoing monitoring: continuous, day-to-day activities that are built into the function's normal work.
2. Periodic self-assessments: separate, periodic reviews performed internally.
• External assessments, performed by a qualified, independent assessor or team from outside the organization at least once every five years.
Under the former IPPF, this requirement appeared in Standard 1311 (Internal Assessments). Under the 2024 Global Internal Audit Standards, it appears in Standard 12.1 (Internal Quality Assessment). External assessments are covered by former Standard 1312 and new Standard 8.4.
2. Why Periodic Self-Assessments Are Important
• Mandatory element of the QAIP. The chief audit executive (CAE) must develop and conduct internal assessments. These include both ongoing monitoring and periodic self-assessments.
• Support the conformance claim. A function may state that it conforms with the Standards only if the results of its QAIP support that statement. Periodic self-assessments supply much of that evidence between external assessments.
• Bridge the five-year gap. External assessments are required only once every five years. Periodic self-assessments let the function find and fix weaknesses in the years between them.
• Prepare for external assessment. A self-assessment often serves as a dry run before an external review. It is also the base document in a self-assessment with independent external validation (SAIV).
• Drive continuous improvement. The results lead to action plans that improve methodology, staff competencies, tools and stakeholder value.
• Build accountability and credibility. Reporting the results to the board and senior management shows transparency and supports the board's oversight of internal audit.
3. How Periodic Self-Assessments Work
a) Who performs them?
They may be performed by:
• Members of the internal audit function, ideally people who were not involved in the engagements being reviewed.
• Other people within the organization who have sufficient knowledge of internal audit practices. Examples include CIA-certified staff in other departments or former internal auditors working in risk or compliance.
The key requirement is sufficient knowledge of internal audit practices and the Standards. The assessors are internal, so the review is not independent of the organization. That is exactly why it cannot replace the external assessment.
b) How often?
• The Standards require periodic self-assessments but do not set a fixed frequency.
• The CAE decides the frequency. Most functions perform them annually, or more often when there are significant changes such as a new CAE, a restructuring, new regulations or a new methodology.
• For contrast, external assessments must happen at least once every five years.
c) Typical steps
1. Plan. Define the scope, criteria (the Standards, charter and methodology), assessors, timing and tools. Many functions use the IIA's Quality Assessment Manual or similar checklists.
2. Gather evidence. Common sources include:
• A review of a sample of engagement workpapers and reports.
• A review of the charter, audit plan, policies and procedures.
• Stakeholder surveys and interviews with the board, senior management and auditees.
• Staff surveys and interviews.
• Analysis of performance metrics, such as plan completion, cycle time, recommendations implemented and staff certifications.
• Benchmarking against leading practices.
• A review of ongoing monitoring results.
3. Evaluate. Rate conformance, for example 'generally conforms', 'partially conforms' or 'does not conform'. Identify gaps and opportunities for improvement.
4. Develop action plans. Assign owners and deadlines for corrective actions.
5. Communicate. The CAE reports the results, including any action plans, to the board and senior management.
6. Follow up. Track whether the corrective actions have been implemented, often through ongoing monitoring and the next periodic assessment.
d) Ongoing monitoring versus periodic self-assessment
• Ongoing monitoring: continuous and built into daily work. Examples include engagement supervision, workpaper review, standard checklists, post-engagement client surveys and real-time KPIs.
• Periodic self-assessment: performed at intervals and broader in scope. It looks across the whole function, covering governance, the charter, resourcing, methodology and the full set of Standards. It is often performed by someone other than the engagement team.
e) Periodic self-assessment versus external assessment
• Performed by: a self-assessment uses internal personnel, while an external assessment uses a qualified, independent assessor from outside the organization.
• Frequency: a self-assessment is periodic, usually annual, while an external assessment is required at least every five years.
• Independence: a self-assessment is not independent of the organization, while an external assessment is.
• Replacement: a self-assessment can never replace the external assessment. A self-assessment validated by a qualified independent external reviewer (SAIV) does count as an external assessment.
f) Reporting and disclosure
• The CAE communicates the results of internal and external assessments to the board and senior management.
• If a nonconformance affects the overall scope or operation of the function, the CAE must disclose the nonconformance and its impact to the board and senior management.
• If the QAIP results, including the external assessment, do not support conformance, the function must not claim conformance with the Standards.
4. Common Exam Scenarios
• A question asks which activity is an example of a periodic self-assessment. The correct answer is typically an annual review of conformance with the Standards, or a sample review of workpapers by an auditor not involved in those engagements.
• A question asks whether a CAE can rely solely on internal assessments to claim conformance. The answer is no; an external assessment is required at least once every five years.
• A question asks who may perform a periodic self-assessment. The answer is internal audit staff or others in the organization with sufficient knowledge of internal audit practices.
• A question asks what the CAE should do with the results. The answer is to communicate them to the board and senior management and to implement action plans.
• A question describes engagement supervision or a post-audit client survey. Classify this as ongoing monitoring, not periodic self-assessment.
5. Exam Tips: Answering Questions on Periodic Self-Assessments
• Classify the activity first. Ask yourself whether it is continuous or point-in-time, and internal or external. 'Continuous', 'routine', 'supervision' or 'each engagement' points to ongoing monitoring. 'Annual', 'periodic', 'function-wide' or 'by others within the organization' points to periodic self-assessment. 'Outside the organization', 'independent' or 'every five years' points to external assessment.
• Watch for the word 'independent'. Internal assessors, even from another department, are not independent of the organization. Any answer suggesting that a self-assessment meets the external assessment requirement is wrong, unless it describes independent external validation.
• Remember the five-year rule. External assessments are required at least once every five years. Self-assessments fill the gap between them but never satisfy that requirement on their own.
• Know the reporting line. The results go to the board and senior management. The CAE is responsible for the QAIP and for communicating its results.
• Remember that knowledge is the qualification. Other people within the organization may perform the assessment if they have sufficient knowledge of internal audit practices. Do not reject such an answer just because the assessor is outside the internal audit function.
• Expect a broad scope. A periodic self-assessment covers conformance with the Standards, ethics and professionalism, the charter and methodology, plus efficiency, effectiveness and stakeholder value. Answers limited to one engagement's workpapers usually describe ongoing monitoring.
• Link it to the conformance statement. A function may claim conformance with the Standards only when the QAIP results support it. Significant nonconformance must be disclosed.
• Choose the 'most appropriate' answer. IIA questions often offer several plausible options. Prefer the answer that is mandatory under the Standards, involves objectivity and leads to improvement and communication. For example, prefer 'report results and action plans to the board' over 'file results for the next external review'.
• Watch for absolute language. Options stating that periodic self-assessments must be performed 'every quarter' or 'only by external parties' are usually wrong. The Standards leave the frequency to the CAE and allow internal personnel to perform them.
• Learn both sets of terminology. Questions may use former IPPF wording (Standards 1300, 1310, 1311, 1312, 1320, 1321, 1322) or the 2024 Global Internal Audit Standards wording (Standards 8.3, 8.4, 12.1). The concepts are the same.
6. Quick Practice Questions
Q1. Which of the following is the best example of a periodic self-assessment?
a) Supervisory review of workpapers on each engagement.
b) A client satisfaction survey issued after each audit.
c) An annual review of the function's conformance with the Standards, performed by a senior auditor not involved in the sampled engagements.
d) A review by an independent consulting firm every five years.
Answer: c. Options a and b are ongoing monitoring, and option d is an external assessment.
Q2. A CAE completes thorough annual self-assessments and wishes to skip the external assessment. This is:
a) Acceptable if the board approves.
b) Acceptable if the self-assessments are performed by CIAs.
c) Not acceptable, because an external assessment is required at least once every five years.
d) Acceptable for small internal audit functions.
Answer: c.
Summary
Periodic self-assessments are internal, point-in-time reviews of the internal audit function's conformance and performance. They are performed by internal audit staff or other knowledgeable people within the organization, usually annually. They complement ongoing monitoring and prepare the function for the mandatory external assessment required every five years. Their results must be communicated to the board and senior management and turned into improvement actions. On the exam, classify the activity, check for independence and remember that self-assessments never replace external assessments.
