Five Domains, One Continuous Thread
GIAS organizes the Standards into five domains: Purpose of Internal Auditing, Ethics and Professionalism, Governing the Internal Audit Function, Managing the Internal Audit Function, and Performing Internal Audit Services.[3] Quality assurance is not confined to a single domain. It is introduced in Domain III (Governing the Internal Audit Function), developed further in Domain IV (Managing the Internal Audit Function), and ultimately tested against the work performed under Domain V (Performing Internal Audit Services). Taken together, the Standards comprise 15 guiding principles and 52 individual standards, and a full external quality assessment examines conformance across all of them.[4]
Standard 8.3: The Quality Assurance and Improvement Program
The foundational requirement sits in Domain III, under Standard 8.3, Quality. It requires the chief audit executive (CAE) to develop, implement, and maintain a quality assurance and improvement program (QAIP) that covers all aspects of the internal audit function.[5] GIAS defines the QAIP in its glossary as a program established by the CAE "to evaluate and ensure the internal audit function conforms with the Global Internal Audit Standards, achieves performance objectives, and pursues continuous improvement."[6] The QAIP is deliberately broad in scope: it is not limited to individual engagements but extends to the strategy, resourcing, methodology, and reporting of the function as a whole.
Standard 8.4: The External Quality Assessment
Sitting alongside Standard 8.3 in Domain III is Standard 8.4, External Quality Assessment (EQA). This standard requires the CAE to develop a plan for an external quality assessment and to discuss that plan with the board or audit committee.[7] The external assessment must be performed at least once every five years by a qualified, independent assessor or assessment team, and at least one member of that team must hold an active Certified Internal Auditor (CIA) credential.[8]
GIAS explicitly permits two routes to satisfying this requirement. The first is a full-scope external quality assessment, in which an independent assessor comprehensively reviews the internal audit function's conformance with every standard. The second is a self-assessment with independent validation (SAIV), in which the CAE's team completes a comprehensive, fully documented internal assessment, and the independent assessor then selects and validates a sample of that work to confirm it was conducted completely and accurately.[9] Both routes satisfy Standard 8.4; the choice between them is a matter of organisational judgment, cost, and disruption tolerance, which later articles in this series examine in more detail.
The requirement applies universally. Every internal audit function is subject to Standard 8.4, regardless of its size, its sector, or whether the function is performed in-house, outsourced, or co-sourced.[10] For internal audit functions of only one person, GIAS acknowledges that an adequate QAIP will require assistance from outside the function, since internal self-assessment alone cannot substitute for independent perspective.[11]
Standard 12.1: Internal Quality Assessment
Where Standard 8.4 governs the external, periodic dimension of quality assurance, Standard 12.1, Internal Quality Assessment, governs the continuous, internal dimension. It sits in Domain IV, under Principle 12, which makes the CAE responsible for the internal audit function's conformance with GIAS and its continuous performance improvement.[12] Standard 12.1 requires the CAE to develop and conduct internal assessments of the function's conformance with the Standards and its progress toward performance objectives, comprising two elements: ongoing monitoring of engagement performance, and periodic self-assessment of the function as a whole.[13] At least annually, the CAE must communicate the results of the internal quality assessment to the board or audit committee and to senior management.[14]
Standard 12.2: Performance Measurement
Adjacent to internal assessment sits Standard 12.2, Performance Measurement, which requires the CAE to establish performance objectives — typically expressed as key performance indicators — designed to evaluate the function's performance, taking into account the input and expectations of the board and senior management.[15] Where those objectives are not met, the CAE must develop an action plan to address the shortfall. Guidance accompanying the standard offers CAEs a range of performance categories to consider when building these indicators, spanning efficiency, effectiveness, stakeholder satisfaction, and talent development.
Standard 12.3: Oversee and Improve Engagement Performance
The third element of the Domain IV quality principle is Standard 12.3, Oversee and Improve Engagement Performance, which requires the CAE to establish and implement methodologies for engagement supervision, quality assurance at the engagement level, and the development of staff competencies.[16] This standard is the connective tissue between the function-level QAIP and the individual engagements conducted under Domain V; it ensures that supervisory review, coaching, and quality checks occur while engagements are in progress, not only after the fact.
How the Pieces Fit Together
Read together, Standards 8.3, 8.4, 12.1, 12.2, and 12.3 describe a layered system rather than a single control point:
- Engagement-level supervision (Standard 12.3) provides real-time quality control during fieldwork.
- Ongoing monitoring and periodic self-assessment (Standard 12.1) evaluate the function's conformance and progress on a continuous, internally driven basis.
- Performance measurement (Standard 12.2) tracks the function's effectiveness against objectives agreed with the board and senior management.
- The QAIP (Standard 8.3) binds these internal mechanisms into a single, documented program.
- The external quality assessment (Standard 8.4), conducted at least every five years, provides the independent, outside perspective that internal mechanisms alone cannot supply.
The IIA's Quality Assessment Manual, updated for the 2024 edition of GIAS and effective for assessments from January 9, 2025, operationalises this structure. It provides assessors and CAEs with domain-level fieldwork templates, models for concluding on the overall quality of the function, and guidance for interpreting maturity against the Standards.[17] A successful quality assessment — defined as a rating of Full Achievement or General Achievement — is a precondition for an internal audit function to be considered in full conformance with GIAS.[18]
Governance and Reporting
GIAS also assigns explicit responsibilities to the board and senior management in this architecture. The board, with input from senior management, is expected to review and approve the CAE's QAIP, including the most effective and efficient approach to periodic assessment of the function.[19] Both internal and external assessment results must be reported to the board and senior management when completed, and the results of the internal quality assessment must be communicated at least annually.[20] This reporting obligation reflects a broader theme in the 2024 Standards: that conformance with GIAS is not solely a function of internal audit's own diligence, but is embedded in — and overseen by — the governance structures of the organization it serves.
Conclusion
The 2024 Global Internal Audit Standards do not treat quality assurance as a compliance exercise conducted once every five years and otherwise set aside. They construct a continuous system — engagement supervision, internal monitoring, performance measurement, a documented improvement program, and periodic independent validation — in which each layer supports and is tested by the others. Understanding this architecture is a necessary foundation for the articles that follow in this series, which examine the two routes to satisfying the external assessment requirement, the QAIP in operational detail, the case for more frequent self-assessment, and the emerging role of artificial intelligence within this quality framework.
Endnotes
1. RSM US LLP, "IIA Issues 2024 Global Internal Audit Standards to Guide the Profession's Future," March 2024.
2. The Institute of Internal Auditors, "Global Internal Audit Standards," IPPF Framework, effective for quality assessments January 9, 2025.
3. The Institute of Internal Auditors, 2024 Global Internal Audit Standards (Lake Mary, FL: The IIA, January 9, 2024).
4. The Institute of Internal Auditors, Quality Services, "Maximizing Internal Audit Effectiveness through External Quality Assessments."
5. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 8.3, Quality.
6. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Glossary, "quality assurance and improvement program."
7. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 8.4, External Quality Assessment.
8. Ibid.
9. The Institute of Internal Auditors, Quality Services, "Internal Audit Quality Frequently Asked Questions."
10. Ibid.
11. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Considerations for Implementation, cross-reference to Standards 10.1, 12.1, and 12.3.
12. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Principle 12.
13. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 12.1, Internal Quality Assessment.
14. Ibid.
15. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 12.2, Performance Measurement.
16. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 12.3, Oversee and Improve Engagement Performance.
17. The Institute of Internal Auditors, Quality Assessment Manual, 2024 Edition.
18. The Institute of Internal Auditors, Quality Services, "Internal Audit Quality Frequently Asked Questions."
19. Plante Moran, "IIA Global Internal Audit Standards Update: Value for Executive Management & Boards," October 2024, summarizing GIAS Standard 8.4 board-approval expectations.
20. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 12.1, Internal Quality Assessment.
