This article makes a narrower, and we believe uncontroversial, argument: the self-assessment half of SAIV should not wait five years for its next iteration. GIAS already requires ongoing monitoring and periodic self-assessment under Standard 12.1, separate from the Standard 8.4 external cycle — but "periodic" has too often, in practice, meant "annual at best, and often only in the year before the external assessment is due."[3] I will argue that internal audit functions should run comprehensive self-assessments against the full body of GIAS far more frequently than that — quarterly or even continuously — and that artificial intelligence tools, applied carefully and under human oversight, make this newly practical in a way it simply was not when the current five-year model was designed.
The Standards Already Separate the Two Clocks — the Profession Just Hasn't Used That Freedom
It is worth being precise about what GIAS actually requires, because the case for more frequent self-assessment does not require any change to the Standards at all. Standard 12.1 requires the CAE to develop and conduct internal assessments of the function's conformance and progress, comprising both ongoing monitoring and periodic self-assessment reviews, and to communicate the results to the board and senior management at least annually.[4] Standard 8.4's five-year clock governs only the independent validation — the point at which an outside assessor tests a sample of the self-assessment's conclusions.[5] Nothing in the text ties the frequency of the self-assessment itself to the five-year external cycle. The profession has simply drifted toward treating them as the same clock, largely because a comprehensive, function-wide self-assessment against 52 standards has historically been labour-intensive enough that doing it more than once every few years felt impractical.
That practical constraint is the thing that has changed.
What a Full Self-Assessment Actually Involves — and Why It Has Been Rare
A comprehensive self-assessment under SAIV requires the CAE's team to document, standard by standard, how the function conforms — the same fifty-two standards a full-scope EQA would examine, evidenced through policies, engagement files, board communications, and performance data.[6] Done manually, this is a substantial undertaking: gathering evidence across every domain, cross-referencing it against the Standards' requirements, and identifying gaps takes weeks of dedicated staff time even for a moderately sized function. It is not hard to see why CAEs have historically reserved this effort for the run-up to the mandated external validation, treating the intervening years as a lower-intensity monitoring exercise rather than a repeat of the full assessment.
What AI Changes
Artificial intelligence tools — the same category of data analytics and AI capability the IIA has itself begun formally addressing through recent Global Practice Guides on data analytics and AI skills for internal auditors[7] — change the economics of this exercise substantially. Applied to the self-assessment process specifically, AI can:
- Continuously cross-reference engagement documentation against Standards requirements, flagging where a completed engagement's working papers appear to fall short of a specific standard's evidentiary expectations, rather than waiting for a periodic manual review to catch the same gap months later.
- Track performance indicators established under Standard 12.2 in real time, surfacing drift from board-agreed objectives as it happens rather than at the next scheduled reporting interval.
- Maintain a living conformance record that consolidates evidence for each of the 52 standards as it is generated throughout the year, so that a "self-assessment" becomes a continuously updated artefact rather than a periodic reconstruction project.
- Reduce the marginal cost of each additional self-assessment cycle close to zero once the underlying documentation pipeline exists, because the heavy lifting — gathering and organizing evidence — no longer needs to be repeated from scratch each time.
None of this replaces the judgment of the CAE or the internal audit team. It replaces the labour of assembling and cross-referencing evidence, which is precisely the labour that made frequent self-assessment impractical in the first place. The professional judgment about whether the evidence actually demonstrates conformance remains, as it must, a human determination.
Why More Frequent Self-Assessment Strengthens — Rather Than Duplicates — the SAIV Model
A sceptic might ask why this matters if the independent validation still only happens every five years regardless. The answer is that the value of SAIV depends entirely on the quality of the self-assessment the independent assessor is validating. The IIA's own guidance on how a SAIV validation is conducted — reviewing a sample of working papers already assessed internally, alongside a sample not previously reviewed — makes clear that the assessor's confidence in the whole self-assessment rests on how rigorously and recently that self-assessment was actually performed.[8] A self-assessment substantially reconstructed in the months before the external validation is a weaker foundation than one built continuously, with each quarter's evidence gathered and evaluated close to when the underlying engagement work actually occurred, while memories are fresh and documentation gaps are still fixable.
There is a second, more immediate benefit that has nothing to do with the five-year cycle at all. GIAS requires the CAE to communicate internal assessment results and any related action plans to the board and senior management at least annually.[9] A CAE running quarterly, AI-assisted self-assessments has something far more substantive to report at each of those checkpoints than a CAE relying on a lighter-touch annual review: a current, evidenced picture of exactly where the function stands against all 52 standards, with gaps identified and remediation already underway well before the next external validation is due. That is not a compliance nicety. It is the difference between a board that learns about a conformance gap in year four of a five-year cycle, with limited time to see it fixed before the external assessor arrives, and a board that has been tracking remediation in near-real time since the gap first appeared.
Guardrails: What This Proposal Does Not Argue For
To be clear about the limits of this argument: nothing here suggests that AI-assisted frequency should be used to argue for reducing the five-year independent validation requirement, substituting AI output for the independent assessor's judgment, or allowing AI tools to reach conclusions about conformance without human review. The point of more frequent self-assessment is to make the evidence base better and more current — not to change who is accountable for judging it. The CAE remains accountable for every conclusion the self-assessment reaches, and the independent assessor's role in testing that self-assessment against a sample of evidence every five years remains exactly as GIAS prescribes it. The next article in this series addresses, more broadly, why that human accountability must remain non-negotiable as AI's role in internal audit expands.
Conclusion
The five-year cycle for independent validation under Standard 8.4 is sound and should not change. What should change is the assumption, more habit than requirement perhaps, that the self-assessment component of SAIV needs to wait for that same five-year clock. GIAS already permits — and its Standard 12.1 requirement for ongoing monitoring arguably already expects — a far more frequent rhythm of self-assessment than the profession has typically delivered. AI tools now make that frequency achievable without a proportional increase in staff burden. Internal audit functions that continue to treat self-assessment as a once-every-few-years reconstruction exercise are leaving real quality-assurance value on the table, not because the Standards prevent them from claiming it, but because the tools to claim it affordably have only recently become available.
Endnotes
1. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 8.4, External Quality Assessment.
2. The Institute of Internal Auditors, Quality Services, "Internal Audit Quality Frequently Asked Questions."
3. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 12.1, Internal Quality Assessment.
4. Ibid.
5. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 8.4, External Quality Assessment.
6. Baker Tilly, "Preparing for Your External Quality Assessment under the [Global Internal Audit Standards]," July 2025.
7. The Institute of Internal Auditors, Global Practice Guides, "Understanding Data Analytics for Internal Auditors" and "Data Analytics Skills for Internal Auditors," issued May 8, 2026.
8. The Institute of Internal Auditors, Quality Services, "Internal Audit Quality Frequently Asked Questions."
9. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 12.1, Internal Quality Assessment.
