The QAIP Is the Only Thing Standing Between "Trust Us" and "Verify Us"
Internal audit's entire mandate rests on a single premise: that when internal audit says a control is effective, a risk is managed, or a process is compliant, the board and senior management can rely on that conclusion without independently re-checking it. That premise only holds if internal audit's own work is itself subject to the same discipline it applies to everyone else. GIAS does not leave this to good intentions. Standard 8.3 requires the CAE to develop, implement, and maintain a QAIP covering all aspects of the internal audit function, and the Standards define the QAIP as a program to "evaluate and ensure the internal audit function conforms with the Global Internal Audit Standards, achieves performance objectives, and pursues continuous improvement."[2] That is a demanding brief. It is not a request for a periodic self-congratulatory review; it is a mandate for continuous, evidenced self-scrutiny.
A CAE who treats the QAIP as a once-every-five-years exercise, assembled in the months before an external quality assessment, is not implementing what Standard 8.3 requires. They are implementing a much weaker thing that happens to share the same name.
Three Standards, One Program, No Room to Pick and Choose
GIAS makes the QAIP's scope explicit by binding three separate standards into it. Standard 12.1, Internal Quality Assessment, requires ongoing monitoring of engagement performance and periodic self-assessment of the function.[3] Standard 12.2, Performance Measurement, requires the CAE to set performance objectives — key performance indicators agreed with input from the board and senior management — and to build action plans when those objectives are not met.[4] Standard 12.3, Oversee and Improve Engagement Performance, requires methodologies for engagement supervision, quality assurance, and competency development.[5] The IIA's own quality guidance is unambiguous that these three standards, together with the external assessment requirement in Standard 8.4, together constitute the QAIP.[6]
We raise this structural point because it forecloses a common evasion: the CAE who says "we have a QAIP" while pointing only to the external assessment every five years, or only to an annual internal audit satisfaction survey, is describing a fragment of the requirement, not the requirement itself. A QAIP that lacks continuous engagement supervision, that lacks documented performance measurement against board-informed objectives, or that lacks ongoing internal monitoring is not partially compliant — it is not a QAIP as GIAS defines the term. The profession should stop granting itself partial credit for partial implementation.
What a Neglected QAIP Actually Costs
The cost of treating the QAIP as an occasional exercise is not abstract. Consider what a genuine QAIP is supposed to catch, continuously, rather than once every five years: engagements delivered without adequate supervision; a function whose performance has quietly drifted from the objectives the board thought it had agreed to; conformance gaps that accumulate for years before an external assessor happens to find them. GIAS requires the CAE to communicate the results of the internal quality assessment to the board and senior management at least annually, precisely because the Standards' authors understood that quality problems discovered only once every five years are quality problems that went unmanaged for most of that period.[7]
There is also a reputational cost that becomes visible only in hindsight. When an external quality assessment surfaces significant non-conformance, the first question a serious board should — and increasingly will — ask is not "what went wrong in the audit engagements?" but "what was the QAIP doing for the years in between assessments?" A CAE who cannot answer that question with evidence of continuous monitoring, documented performance tracking, and active engagement supervision has no good answer to give. The QAIP is, in this sense, the function's defence file — the record that demonstrates the CAE was managing quality actively, not waiting for someone else to discover its absence.
The QAIP as a Source of Value, Not Just Risk Mitigation
It would be a mistake to frame the QAIP purely as a defensive necessity, because doing so undersells its constructive purpose. Standard 12.2's requirement for performance objectives developed with board and senior management input is, properly used, a mechanism for internal audit to demonstrate its value in terms the organization's leadership actually cares about — not just conformance with the Standards, but efficiency, stakeholder satisfaction, and contribution to organizational objectives.[8] A CAE who takes this requirement seriously has, built into the mandatory framework, a continuous feedback loop with the board about what the function is delivering and where it is falling short. Functions that resist building this loop are not avoiding bureaucracy; they are declining a structured opportunity to prove their worth on an ongoing basis, and leaving that proof to happen, if at all, only once every five years.
The Objection: "We Are Too Small for This"
The most sympathetic objection to a demanding QAIP comes from small internal audit functions, sometimes staffed by a single person, for whom continuous monitoring, formal performance measurement, and engagement supervision can seem like requirements written for a Fortune 500 audit shop. GIAS itself acknowledges this tension and states plainly that if a function comprises only one member, an adequate QAIP will require assistance from outside the function.[9] We take this seriously, but it does not weaken the argument — it reinforces it. GIAS did not respond to small-function constraints by lowering the bar on what a QAIP must achieve; it responded by requiring small functions to bring in outside help to meet that bar. The Standards treat a rigorous QAIP as non-negotiable regardless of headcount, which tells the profession something about how central the drafters considered it to be.
Conclusion
The QAIP is not a document produced for an assessor's benefit once every five years. It is the continuous mechanism by which internal audit earns, and re-earns, the trust the board places in it every time the function issues an opinion. Standards 8.3, 12.1, 12.2, and 12.3 do not describe a periodic compliance task; they describe an operating discipline. CAEs who build that discipline — ongoing monitoring, documented performance measurement, active engagement supervision, and an internal assessment cycle that reports to the board at least annually — are not doing more than GIAS requires. They are, finally, doing what it always asked of them. The profession should stop treating the QAIP as paperwork, because the alternative is a quality assurance program that exists mostly in name, discovered to be missing only when it is too late to matter.
Endnotes
1. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 8.3, Quality.
2. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Glossary, "quality assurance and improvement program."
3. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 12.1, Internal Quality Assessment.
4. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 12.2, Performance Measurement.
5. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 12.3, Oversee and Improve Engagement Performance.
6. The Institute of Internal Auditors, Quality Services, "Internal Audit Quality Frequently Asked Questions."
7. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Standard 12.1, Internal Quality Assessment.
8. Wolters Kluwer, "How Internal Quality Assessment Enhances Internal Audit Performance," 2026.
9. The Institute of Internal Auditors, 2024 Global Internal Audit Standards, Considerations for Implementation, cross-reference to Standards 10.1, 12.1, and 12.3.
