The Quality Assurance and Improvement Program (QAIP) is a structured, ongoing process that the chief audit executive (CAE) must develop and maintain. It covers every aspect of the internal audit function and helps ensure that internal audit delivers reliable, value-adding services. In the CIA Part 3 context of quality of the internal audit function, the QAIP has several core purposes.

First, it evaluates conformance. The QAIP assesses whether the internal audit function complies with the IIA's Standards (now the Global Internal Audit Standards) and whether internal auditors apply the Code of Ethics or the Ethics and Professionalism principles. Conformance is the basis for using the phrase 'conforms with the Standards' in audit reports, and that claim is only appropriate when QAIP results support it.

Second, it assesses efficiency and effectiveness. Beyond compliance, the QAIP examines whether the function achieves its mandate, meets stakeholder expectations, uses resources wisely, and contributes to governance, risk management, and control.

Third, it drives continuous improvement. Assessments identify gaps, weaknesses, and opportunities to strengthen methodology, staff competency, technology use, and communication. The CAE then develops action plans to address them.

Fourth, it provides accountability and assurance. Results are communicated to senior management and the board, giving them confidence in the quality of internal audit work and supporting the board's oversight of the function.

The QAIP achieves these purposes through two types of assessment. Internal assessments include ongoing monitoring, such as engagement supervision, checklists, and performance metrics, plus periodic self-assessments. External assessments are conducted at least once every five years by a qualified, independent assessor or team, either as a full external assessment or as a self-assessment with independent validation.

Finally, the CAE must disclose any nonconformance that affects the overall scope or operation of the function to senior management and the board. In short, the QAIP builds credibility, supports professionalism, and helps keep internal audit relevant and trustworthy.

In CIA Part 3, quality of the internal audit function centers on the Quality Assurance and Improvement Program (QAIP). The chief audit executive (CAE) must develop and maintain it, and it covers every aspect of internal audit activity. Its purpose is to evaluate conformance with the IIA Standards, assess whether internal auditors apply the Code of Ethics (now the Ethics and Professionalism principles under the 2024 Global Internal Audit Standards), and measure the function's efficiency, effectiveness and opportunities for improvement. The program has several key components.

First, internal assessments, which come in two forms:
- Ongoing monitoring is built into routine operations. Examples include engagement supervision, standardized work programs, workpaper review, approval of reports, client feedback surveys and performance metrics such as budget versus actual hours and recommendation implementation rates.
- Periodic self-assessments are conducted by members of the activity or other qualified people in the organization who know internal audit practices. They evaluate conformance with the Standards more comprehensively.

Second, external assessments. These must occur at least once every five years. A qualified, independent assessor or team from outside the organization performs them. They take one of two approaches:
- A full external assessment.
- A self-assessment with independent external validation (SAIV).
The CAE discusses the form, frequency, and the assessor's qualifications and independence with the board. Any potential conflicts of interest must be considered.

Third, reporting. The CAE communicates QAIP results to senior management and the board. The report covers the scope and frequency of assessments, the assessors' qualifications and independence, conclusions, and corrective action plans. Ongoing monitoring results are reported at least annually.

Fourth, conformance disclosure. The internal audit activity may state that it 'conforms with the Standards' only when QAIP results support that statement. If nonconformance affects the overall scope or operation of the activity, the CAE must disclose it to senior management and the board, along with its impact.

Finally, continuous improvement. Findings from assessments drive action plans, training and methodology updates. This keeps the function aligned with stakeholder expectations and adds value to governance, risk management and control processes.

In CIA Part 3, the quality of the internal audit function depends on conforming with The IIA's International Professional Practices Framework (IPPF). The IPPF has three mandatory elements: the Global Internal Audit Standards, Topical Requirements, and supporting Global Guidance. Topical Requirements and Quality Assurance work together so that internal audit performs consistently, credibly, and to a recognized baseline.

Topical Requirements are mandatory minimum expectations for auditing specific high-risk subjects. The first one issued was Cybersecurity. Others, such as third-party management and organizational behavior, have been in development. A Topical Requirement applies when the topic falls within an engagement's scope, is identified as significant in the risk-based audit plan, or is requested by the board or management. Each one sets out the governance, risk management, and control processes auditors must evaluate. Auditors use professional judgment to apply the requirements and must document how they were addressed. If any element is excluded, the rationale must be documented. Conformance with Topical Requirements is assessed as part of quality assessments, so they directly affect quality.

Quality Assurance is delivered through the chief audit executive's Quality Assurance and Improvement Program (QAIP). Under Domain IV (Principle 8) and Domain V (Principle 12), the QAIP includes the following:

- Internal assessments, combining ongoing monitoring (for example, engagement supervision, workpaper review, and performance metrics) with periodic self-assessments.
- External quality assessments, conducted at least once every five years by a qualified, independent assessor or team. The team must include at least one Certified Internal Auditor.
- Performance measurement, using objectives, key performance indicators, and stakeholder feedback.

The CAE must communicate QAIP results, including any nonconformance and action plans, to the board and senior management. Internal audit may state that it conforms with the Standards only when QAIP results support that claim.

Together, Topical Requirements set the baseline for what must be covered in key risk areas. Quality Assurance verifies that the function meets that baseline, drives continuous improvement, and builds stakeholder confidence in internal audit's value.

Ongoing monitoring is one of the two components of internal assessments within an internal audit function's Quality Assurance and Improvement Program (QAIP). The other component is periodic self-assessment. Under the IIA Standards (Standard 1311 in the IPPF and Standard 8.3 in the Global Internal Audit Standards), the chief audit executive (CAE) must keep the activity's quality under continual evaluation. Ongoing monitoring provides assurance that processes and practices conform with the Standards, the Code of Ethics or Ethics and Professionalism principles, and the internal audit charter, and that work is performed efficiently and effectively.

Ongoing monitoring is built into the routine policies and practices used to manage the internal audit activity, rather than performed as a separate project. Its main tools include:

1) Engagement supervision, where supervisors direct staff, review workpapers, and approve engagement plans, work programs, and final communications.

2) Standardized methodologies, audit manuals, checklists, and templates that promote consistent conformance.

3) Feedback from clients and stakeholders, such as post-engagement surveys.

4) Key performance indicators, such as percentage of the audit plan completed, cycle time from fieldwork to report issuance, budget-to-actual hours, recommendations accepted and implemented, and staff certifications and training hours.

5) Project budgets, timekeeping systems, and analysis of staff performance.

For the CIA exam, it is important to distinguish ongoing monitoring from other assessments. Periodic self-assessments are conducted at intervals, often by experienced staff or Certified Internal Auditors, and evaluate broader conformance. External assessments must occur at least once every five years and be performed by a qualified, independent assessor or team from outside the organization.

Results of ongoing monitoring should be documented, analyzed, and used to identify improvement opportunities, with action plans developed where gaps exist. The CAE communicates QAIP results, including internal assessment outcomes, to senior management and the board at least annually. Effective ongoing monitoring supports a claim that the activity conforms with the Standards, strengthens credibility, and drives continuous improvement.

In CIA Part 3, periodic self-assessments are one of the two components of the internal assessment element of the Quality Assurance and Improvement Program (QAIP). The other component is ongoing monitoring. Internal assessments complement external assessments, which must be performed at least once every five years by a qualified, independent assessor or assessment team. Ongoing monitoring is built into daily activities, such as engagement supervision, checklists, and workpaper reviews. Periodic self-assessments, by contrast, are separate, more comprehensive evaluations performed at scheduled intervals, often annually or in preparation for an external assessment. Their purpose is to evaluate the internal audit function's conformance with the IIA Standards (including the ethics and professionalism requirements) and to judge its efficiency, effectiveness, and value to stakeholders. They are carried out by members of the internal audit activity or by other people within the organization who have sufficient knowledge of internal audit practices and the Standards. Because these assessors are not independent of the organization, the results cannot replace an external assessment. However, a well-documented self-assessment can serve as the basis for an external assessment performed as a self-assessment with independent validation (SAIV). Typical procedures include reviewing the internal audit charter, policies, and procedures; testing a sample of engagement files for proper planning, evidence, supervision, and reporting; surveying clients, senior management, and the board; analyzing performance metrics such as plan completion, cycle time, and implementation rates for recommendations; benchmarking against leading practices; and assessing staff competencies and training. The chief audit executive (CAE) must communicate the results, including any significant nonconformance and the related action plans, to senior management and the board. Internal audit may state that it conforms with the Standards only when the results of the QAIP, including both internal and external assessments, support that statement. For the exam, remember three key points: who performs the assessment (internal, knowledgeable personnel), what it covers (conformance and performance), and why it matters (continuous improvement, accountability to the board, and readiness for external assessment).

Under the IIA's Quality Assurance and Improvement Program (QAIP), required by Standards 1300 to 1312 in the 2017 IPPF and Standards 8.3 and 8.4 in the 2024 Global Internal Audit Standards, the chief audit executive (CAE) must evaluate internal audit quality through both internal and external assessments. INTERNAL ASSESSMENTS have two parts. Ongoing monitoring is built into daily activity. Examples include engagement supervision, standardized workpaper review, audit manuals and checklists, client feedback surveys, and performance metrics such as cycle time, recommendations accepted, and budget-to-actual hours. Periodic self-assessments are conducted by members of the internal audit activity who are experienced in internal audit practices, or by other qualified people in the organization. They evaluate conformance with the Standards, the Code of Ethics or Principles, and the charter, as well as efficiency, effectiveness, and value added. Internal assessments are continuous or periodic and feed directly into improvement plans. EXTERNAL ASSESSMENTS must be performed at least once every five years by a qualified, independent assessor or assessment team from outside the organization. Independent means there is no actual or perceived conflict of interest. For example, the assessor should not be a current employee or the organization's external auditor providing related services. The CAE must discuss with the board the form and frequency of the assessment, the qualifications and independence of the assessor, and whether more frequent reviews are needed. There are two acceptable approaches. One is a full external assessment. The other is a self-assessment with independent validation (SAIV), in which the internal audit activity performs a rigorous self-assessment and a qualified outsider validates it. KEY DIFFERENCES: Internal assessments are frequent and performed by insiders or other qualified staff within the organization. External assessments are mandatory every five years, are performed by independent outsiders, and give an objective opinion on conformance. REPORTING: QAIP results go to senior management and the board. Internal audit may state that it conforms with the Standards only when QAIP results support that claim, and it must disclose any nonconformance that affects its overall scope or operation.

Under the IIA framework, external quality assessments (EQAs) of the internal audit activity must be performed at least once every five years by a qualified, independent assessor or assessment team from outside the organization (Standard 1312 of the former IPPF; Standard 8.4 of the 2024 Global Internal Audit Standards). These requirements give the board and senior management credible assurance that the function conforms with the Standards and operates effectively. QUALIFICATIONS: Assessors must be competent in two areas: the professional practice of internal auditing, including current, in-depth knowledge of the IPPF, and the external quality assessment process itself. Competence comes from a combination of practical experience and theoretical learning. Experience gained in organizations of similar size, complexity, sector or industry, and technical issues is more valuable than general experience. For a team, competence is judged collectively, but a qualified team leader should oversee the work and sign off on the conclusions. The 2024 Standards add that at least one team member must hold an active Certified Internal Auditor (CIA) designation. Professional judgment determines whether the assessor has sufficient competence; relevant credentials and prior assessment work are useful evidence. INDEPENDENCE: Assessors must have no actual, potential, or perceived conflict of interest and must not be part of, or under the control of, the organization to which the internal audit activity belongs. Examples that impair independence include current or recent employees of the organization, persons from another department or affiliate of the same organization or parent group, the external auditor if objectivity is compromised, and reciprocal peer reviews where two organizations assess each other. Peer reviews among three or more organizations may be acceptable if independence safeguards exist. GOVERNANCE ROLE: The chief audit executive should discuss with the board the form and frequency of the EQA and the qualifications and independence of the assessor, including any potential conflicts. A self-assessment with independent validation is an acceptable alternative, but the validator must meet the same qualification and independence criteria. Results, including the assessor's conformance opinion, are reported to senior management and the board.

Communicating the results of the Quality Assurance and Improvement Program (QAIP) to the board is a key accountability mechanism in the IIA Standards. Under the 2017 IPPF, Standard 1320 requires the chief audit executive (CAE) to report QAIP results to senior management and the board. The 2024 Global Internal Audit Standards keep this requirement through Standards 8.3, 8.4 and 12.1. The purpose is to give the board, as the internal audit function's oversight body, reliable evidence that the function conforms with the Standards, follows the Code of Ethics (now the Ethics and Professionalism principles), works effectively, and is improving continuously. Communications should cover four main points. The first is the scope and frequency of both internal and external assessments. The second is the qualifications and independence of the assessors or assessment team, including any potential conflicts of interest. The third is the conclusions of the assessors, such as the overall rating of 'generally conforms', 'partially conforms' or 'does not conform'. The fourth is the corrective action plans, with responsibilities and timelines. Timing matters. Results of ongoing monitoring and periodic internal self-assessments should be communicated at least annually. External quality assessments, required at least once every five years, should be reported when they are completed, along with the CAE's response. Under the 2024 Standards, the CAE must also discuss the scope, frequency and choice of external assessor with the board before the assessment takes place. Reporting is also tied to conformance claims. The CAE may state that internal audit 'conforms with the Standards' only when QAIP results support that statement. If nonconformance affects the overall scope or operation of the internal audit activity, the CAE must disclose the nonconformance and its impact to senior management and the board. On the CIA Part 3 exam, candidates should recognize that the board, not the CAE alone, is the final audience for quality results. This transparency strengthens trust, supports board oversight of internal audit performance, and drives continuous improvement.

Disclosing nonconformance is a key part of the quality of the internal audit function. It protects the credibility of internal audit by making sure stakeholders know when work has not fully met the IIA's Standards. Under the 2017 IPPF, Standard 1321 says internal audit may state that it 'conforms with the International Standards' only if the Quality Assurance and Improvement Program (QAIP) supports that statement. This support comes from ongoing monitoring, periodic self-assessments, and an external assessment at least once every five years. When internal audit does not conform, Standard 1322 applies. If nonconformance with the Code of Ethics or the Standards affects the overall scope or operation of the internal audit activity, the chief audit executive (CAE) must disclose the nonconformance and its impact to senior management and the board. Examples include an independence impairment, inadequate resources, no external assessment within five years, or a restricted scope. At the engagement level, Standard 2431 requires the engagement communication to disclose four things: the principle, rule of conduct, or standard that was not fully met; the reasons; and the impact on the engagement and the communicated results. The 2024 Global Internal Audit Standards, effective January 2025, keep these ideas. Standard 4.1 permits a conformance claim only when it is supported by quality assessment results. It also requires internal auditors to disclose when they cannot conform and to explain the circumstances. Standard 8.3 requires the CAE to report external quality assessment results, conformance status, and action plans for significant deficiencies to the board. Engagement-level disclosure is addressed in the requirements for final engagement communications. For the CIA exam, remember three points. First, disclosure goes to senior management and the board. Second, it must explain the impact, not merely state that a gap exists. Third, a false claim of conformance damages trust and is itself an ethical failure. Transparent disclosure supports accountability, prompts corrective action, and demonstrates the integrity expected of the internal audit profession.

Communicating nonconformance means that the Chief Audit Executive (CAE) tells senior management and the board when the internal audit activity does not fully conform with the IIA's mandatory guidance. Under the IPPF this is Standard 1322, Disclosure of Nonconformance. Under the 2024 Global Internal Audit Standards it falls under Standard 4.1, Conformance with the Global Internal Audit Standards, together with the quality requirements in Domain IV. The Code of Ethics is integrated into the 2024 Standards rather than treated separately. Exam questions may use either set of terms.

The disclosure requirement applies when nonconformance affects the overall scope or operation of the internal audit activity. Minor, isolated lapses that a quality review finds and corrects usually do not need board-level disclosure. Significant gaps do. Examples include auditor impairments that are not managed, inadequate resources that prevent coverage of key risks, missing external quality assessments, or methodology weaknesses that undermine reliance on audit work.

The CAE must report the nature of the nonconformance, the reasons for it, its impact on the internal audit activity, and the actions planned to resolve it. Because the board oversees internal audit, it needs this information to judge how reliable the assurance it receives is. The board can then support corrective steps such as more budget, more staff, or changes to the audit charter.

Nonconformance is typically identified through the Quality Assurance and Improvement Program (QAIP). This includes ongoing monitoring, periodic internal self-assessments, and external quality assessments, which must be performed at least once every five years. Results of the QAIP, including any nonconformance, are reported regularly to senior management and the board.

There is also a related engagement-level rule (Standard 2431 under the IPPF). When nonconformance affects a specific engagement, the communication of results must disclose:
- the requirement not met,
- the reasons for the nonconformance,
- its impact on the engagement and the communicated results.

Finally, internal audit may state that it 'conforms with the Standards' only when QAIP results support that claim. Transparent disclosure protects the credibility of internal audit and reinforces accountability, integrity, and stakeholder trust.

In CIA Part 3, internal audit key performance indicators (KPIs) are measurable metrics the chief audit executive (CAE) uses to evaluate how well the internal audit function performs. They support the Quality Assurance and Improvement Program (QAIP) and the Global Internal Audit Standards, especially Principle 12 (Enhance Quality) and Standard 12.2 (Performance Measurement). KPIs serve several objectives. First, they demonstrate value and accountability by showing the board, audit committee, and senior management that internal audit achieves its mandate, executes the approved audit plan, and contributes to governance, risk management, and control. Second, they align the function with stakeholder expectations, because good KPIs link to organizational strategy and the internal audit charter, so audit activities focus on what matters most to the organization. Third, they drive continuous improvement: by tracking trends, the CAE can find weaknesses in methodology, staffing, or processes and act on them through ongoing monitoring and periodic self-assessments. Fourth, they support efficient resource management by showing whether budgets, staff hours, and technology are used well and by justifying requests for more resources. Fifth, they confirm conformance with the Standards and help prepare for external quality assessments. KPIs are commonly arranged in a balanced scorecard with several perspectives. Efficiency measures include percentage of the audit plan completed, budget-to-actual hours, and cycle time from fieldwork to final report. Effectiveness measures include the percentage of recommendations accepted and implemented and significant issues identified. Stakeholder satisfaction is tracked through post-engagement surveys and audit committee feedback. Staff competence is reflected in certifications held, CPE hours, and staff turnover. Innovation is shown through use of data analytics and automation. Effective KPIs should be SMART: specific, measurable, achievable, relevant, and time-bound. They should balance quantitative and qualitative measures and include both leading and lagging indicators. The CAE should avoid metrics that reward volume over quality or that could impair objectivity. KPIs should be agreed with the board and reported to it regularly.

In the CIA Part 3 context, setting performance indicators and targets is how the Chief Audit Executive (CAE) shows that the internal audit function is effective, efficient, and adding value. Under the IIA's Global Internal Audit Standards (Standard 12.2, Performance Measurement), the CAE must develop objectives for evaluating the function's performance. The CAE must also build a methodology to assess progress toward those objectives, and the methodology should consider input from the board and senior management.

The process typically follows five steps:

1. Align with strategy. Indicators should flow from the internal audit charter, the internal audit strategy, and organizational goals. This alignment ensures that measurement reflects what stakeholders actually value.

2. Select balanced key performance indicators (KPIs). Many functions use a balanced scorecard approach that covers several perspectives. Stakeholder measures include satisfaction survey results and board feedback. Efficiency measures include audit plan completion rate, cycle time from fieldwork to report issuance, and budget versus actual hours. Effectiveness measures include the percentage of recommendations accepted and implemented, significant issues identified, and value or cost savings delivered. People and innovation measures include certifications held, training hours, staff retention, and use of data analytics.

3. Set SMART targets. Targets should be specific, measurable, achievable, relevant, and time-bound. An example is issuing 90 percent of final reports within 30 days of fieldwork completion. Targets may be benchmarked against prior performance, peer organizations, or IIA surveys.

4. Mix quantitative and qualitative measures. Output metrics such as reports issued are easy to count but can encourage volume over value. Outcome measures, such as improvements in risk management and control, better reflect real impact.

5. Monitor, report, and refine. Results are tracked continuously as part of ongoing monitoring within the Quality Assurance and Improvement Program (QAIP). They are communicated periodically to senior management and the board, and they inform both internal and external quality assessments.

Well-designed indicators promote accountability and continuous improvement, and they help justify resource requests. Poorly designed indicators can drive unintended behaviors, such as rushing audits to meet deadlines, so measures should be reviewed regularly to keep them meaningful.

In the CIA syllabus, the quality of the internal audit function is assessed partly through performance measures that show whether the internal audit activity is effective, efficient, and adding value. Under the Global Internal Audit Standards (Principle 12, Enhance Quality), the chief audit executive must develop a performance measurement methodology. This methodology supports the Quality Assurance and Improvement Program (QAIP) and is reported to senior management and the board. Performance measures fall into two complementary categories: quantitative and qualitative. Quantitative performance measures are objective, numeric indicators that can be tracked and benchmarked over time. Common examples include: the percentage of the approved audit plan completed, actual versus budgeted audit hours, the average cycle time from fieldwork to final report issuance, the number of audit findings and recommendations, the percentage of management action plans implemented on time, staff utilization rates, training hours completed per auditor, and the number of professional certifications held by staff. These metrics are useful for monitoring efficiency, productivity, and resource management, but they may not reveal whether the work was meaningful or valuable. Qualitative performance measures assess the value, relevance, and quality of internal audit work, often through judgment and stakeholder perception. Examples include: results of post-audit client satisfaction surveys, feedback from the audit committee and senior management, the significance and practicality of recommendations, the quality of audit reports and workpapers as shown by internal or external quality assessments, auditor competence and professionalism, alignment of audit coverage with key organizational risks, and the perceived contribution of internal audit to governance, risk management, and control. Effective internal audit functions use a balanced approach, sometimes structured as a balanced scorecard, combining both types of measures. Quantitative metrics show how much and how fast work is done, while qualitative measures show how well it is done and how much it is valued. Together, they help the chief audit executive identify improvement opportunities, demonstrate accountability, and confirm conformance with the Standards.

An Internal Audit Balanced Scorecard is a performance measurement tool that the chief audit executive (CAE) uses to evaluate and communicate how effective and efficient the internal audit activity is. It adapts the balanced scorecard concept developed by Kaplan and Norton. Within the Quality of the Internal Audit Function topic, it supports the Quality Assurance and Improvement Program (QAIP) and ongoing internal assessments. It also gives the board and senior management evidence that internal audit adds value. Instead of relying only on financial or output metrics, the scorecard balances measures across four perspectives adapted for internal audit. (1) Stakeholder or Customer perspective: board and audit committee satisfaction, post-audit client survey results, management acceptance of recommendations, and alignment of the audit plan with key organizational risks. (2) Internal Process perspective: audit plan completion rate, cycle time from fieldwork to final report, timeliness of issue follow-up, and conformance with the Standards as shown by quality reviews. (3) Innovation, Learning and Growth perspective: training hours per auditor, professional certifications held, staff retention, and use of data analytics and technology. (4) Financial perspective: budget-to-actual performance, cost per audit, cost savings or recoveries identified, and efficient use of co-sourced resources. The CAE links each measure to the internal audit strategy and mission, sets targets, and tracks results. Results are reported periodically to senior management and the board as part of QAIP communication. Good scorecards combine leading indicators, such as training and planning quality, with lagging indicators, such as completion rates and satisfaction scores. They also blend quantitative and qualitative measures. This gives a holistic view and avoids an overemphasis on activity counts like the number of audits completed. Key benefits include stronger accountability, continuous improvement, better resource allocation, and clearer alignment with organizational objectives. CIA candidates should recognize the scorecard as a key performance indicator framework that complements internal and external quality assessments rather than replacing them.

In CIA Part 3, productivity and efficiency measures are quantitative indicators the chief audit executive (CAE) uses to show how well the internal audit activity turns its resources (staff time, budget, technology) into useful outputs. They support the Quality Assurance and Improvement Program (QAIP), ongoing monitoring, and reporting to senior management and the board. Productivity looks at the volume of output per unit of input. Efficiency looks at whether that output is produced on time and within budget, with minimal waste. Common measures include: (1) Audit plan completion, the percentage of planned engagements completed during the period. (2) Budget-to-actual hours, the variance between estimated and actual hours for each engagement. (3) Staff utilization, the ratio of direct (chargeable) audit hours to total available hours, which shows how much time goes to administration, travel, or idle periods. (4) Cycle time, the elapsed days from planning to fieldwork completion and from fieldwork end to final report issuance. (5) Report timeliness, the percentage of reports issued within a target number of days. (6) Cost per engagement or per audit hour, compared with budgets or benchmarks. (7) Number of engagements per auditor. (8) Use of technology, such as the share of audits using data analytics or continuous auditing. These measures are most meaningful when combined with effectiveness and quality indicators. Examples include client satisfaction surveys, the percentage of recommendations accepted and implemented, significant issues identified, and conformance with the IIA Standards. Without these, the function could appear productive while delivering little value. Many organizations use a balanced scorecard to cover stakeholder, process, financial, and learning-and-growth perspectives. CAEs also benchmark results against peer groups or IIA data such as GAIN to identify gaps. Exam candidates should remember four points: metrics must align with the audit charter and organizational objectives, be agreed with the board, be tracked consistently, and drive continuous improvement rather than encourage rushed audits that sacrifice quality or objectivity.