Internal Audit Quality Assessment: Standards, Review, and Rating

An internal audit quality assessment is the review process that determines whether an internal audit function conforms with the Institute of Internal Auditors’ Global Internal Audit Standards. It has two layers: continuous internal monitoring and periodic self-assessment carried out by the department itself, and an independent external assessment that must be completed at least once every five years.¹ Together they form what the Standards call a quality assurance and improvement program, or QAIP. Without one, the function cannot claim conformance with the Standards, and that claim is what gives its work weight with the board, regulators, and external auditors.

What the Current Standards Require

The Global Internal Audit Standards became mandatory on January 9, 2025, replacing the earlier International Standards for the Professional Practice of Internal Auditing.² Under the new framework, quality obligations are distributed across four standards rather than grouped in one series. Standard 8.3 requires the chief audit executive to develop and maintain the QAIP. Standard 8.4 governs the external assessment. Standard 12.1 covers ongoing internal assessment. Standard 12.2 adds a requirement to set measurable performance objectives with input from the board and senior management.¹ If your department’s charter or manual still references the old 1300-series numbering, the citations need updating.

Internal Assessments: Ongoing Monitoring and Periodic Self-Review

Internal assessment happens on two tracks. Ongoing monitoring is the daily work of supervising engagements, reviewing workpapers, and confirming that each audit follows the department’s methodology. It happens in real time. Periodic self-assessment is broader: someone with sufficient knowledge of audit practices reviews the function’s overall conformance with the Standards, typically once a year or on a set cycle.³

The chief audit executive must report the results of internal assessments to the board and senior management at least annually. That report has to state whether the function conforms with the Standards, whether it is meeting its performance objectives, and, where gaps exist, what action plans will fix them and by when.¹ These internal results also feed the next external assessment, so a weak internal program creates cascading problems.

The External Assessment and the Five-Year Deadline

An external quality assessment must occur at least once every five years. No grace period exists. The IIA has stated that a signed engagement letter for a future assessment does not satisfy the requirement if the five-year window has already closed.⁴ Miss the deadline and the department must stop claiming conformance until a current assessment is completed.

The clock starts when the internal audit function formally adopts the Standards. Evidence of adoption can include audit committee minutes, an updated audit charter, or the first use of a conformance statement in audit reports.⁴

There are two ways to satisfy the requirement. A full external assessment uses a team of outside professionals who conduct their own review, test workpapers, interview stakeholders, and evaluate the function against the Standards. A self-assessment with independent validation shifts most of the evaluation work to your internal team, with an outside assessor verifying that the self-assessment was complete and accurate.⁵ The board must approve the choice of the self-assessment route, and the rationale should be documented.

Who Can Serve as the External Assessor

The external assessor or team must be both qualified and independent. Qualified means demonstrated competence in internal audit practice and in the assessment process, evidenced by relevant certifications, management-level audit experience, and familiarity with organizations of similar size and complexity. Under the current Standards, at least one person on the assessment team must hold an active Certified Internal Auditor designation.⁶

Independent means no actual or perceived conflict of interest with your organization. That rules out staff from other departments in the same company, individuals from affiliated entities that share your reporting structure, and anyone with a recent personal or professional relationship that could compromise objectivity. Former employees can serve, but the longer someone has been away, the stronger the independence argument.⁷ The chief audit executive discusses the assessor’s qualifications and any potential conflicts with the board before the engagement begins.⁸

What to Prepare Before the Assessment

The assessor needs a clear picture of how the audit function is organized, authorized, and executed. The internal audit charter defines the department’s purpose, authority, and position in the organization and is the starting point.⁹ Beyond the charter, assemble the methodology manual, the annual audit plan, the risk assessments used to build that plan, and any key performance indicators the department tracks.

Workpapers from a representative sample of completed audits sit at the center of the review. The assessor examines how each engagement was planned, what evidence was collected, how findings were documented, and how results were communicated. Weak documentation habits show up here quickly: if workpapers cannot stand on their own without verbal explanation, the assessor will flag it. Personnel records, training logs, and competency assessments also matter, because the assessor needs to confirm the team has the skills and continuing education for the work assigned.¹⁰

Compile a list of stakeholders who will provide feedback. This typically includes the audit committee chair, senior executives who interact regularly with the audit team, and operational managers who have been audited. Coordinate schedules early to avoid bottlenecks during fieldwork.

How the Assessment Is Conducted

The engagement opens with a kickoff meeting that lays out scope, timeline, and logistics. Fieldwork then runs on two parallel tracks: a technical review of documentation and qualitative feedback from stakeholders.

The technical review is where the assessor works through workpapers, methodology, and reporting. The questions are whether audits were planned with a clear risk focus, whether evidence supports the conclusions in reports, and whether supervision and review procedures actually functioned as designed.

Stakeholder interviews run at the same time. The assessor meets with board members, executive leadership, operational managers, and audit staff to understand how the function is perceived across the organization.⁸ Conversations focus on organizational risks, whether audit keeps pace with changes in the business, and whether its work adds value. Gaps between what documentation shows and what stakeholders describe get investigated further. Written surveys often supplement the interviews, covering the usefulness and accuracy of audit reports, the professionalism of staff, and whether auditees had adequate opportunity to respond to findings.

The process closes with a conference where the assessor shares preliminary findings with the chief audit executive. That meeting gives the department a chance to correct factual misunderstandings and add context before the final report is drafted.

The Rating Scale and Final Report

The updated Quality Assessment Manual uses a four-tier scale, a change from the three tiers used under the prior framework.

Fully Conforms: the function meets all requirements of the Standards with no material deficiencies.
Generally Conforms: the function has a well-developed charter and follows the Standards in all material respects, with only minor improvement opportunities.
Partially Conforms: most standards are met, but specific deficiencies exist that need corrective action to avoid undermining effectiveness.
Does Not Conform: significant gaps prevent the function from providing reliable assurance.

The assessor produces a formal report with an executive summary, detailed observations tied to specific standards, and recommended actions. The report goes to the chief audit executive, senior management, and the board through the audit committee chair.⁸ The board must receive external assessment results directly. That requirement exists to prevent unfavorable findings from being filtered through management layers.¹¹

Using the Conformance Statement

A Generally Conforms or Fully Conforms rating earns the department the right to state in its reports and charter that the internal audit activity conforms with the Global Internal Audit Standards. That statement carries real weight with regulators and external auditors because it signals independent validation.

The statement must come down in three situations. First, if an external assessment concludes the function does not conform, use stops immediately and cannot resume until deficiencies are remediated and a new external assessment confirms conformance. Second, if more than five years have passed since the last external assessment, the statement must come down regardless of what internal assessments show. Third, if internal assessments no longer support a conformance conclusion, continued use is inappropriate.¹² A chief audit executive who uses the statement while the function is out of compliance faces potential disciplinary sanctions from the IIA.⁴

Addressing Non-Conformance

When an assessment identifies deficiencies, the chief audit executive develops action plans that address each instance of non-conformance, with a specific timeline for remediation. Those plans and their progress must be reported to the board and senior management.¹

If a deficiency is serious enough to affect the overall scope or operation of the function, for example when resource constraints prevent coverage of high-risk areas in the audit plan, the chief audit executive has an affirmative duty to disclose the non-conformance and its impact to the board and senior management. Disclosure usually occurs through board meeting discussions, private sessions with the audit committee chair, or formal written communications. The function should document the nature of the non-conformance, its assessed impact, and evidence that disclosure was made.¹³

A Does Not Conform rating means the conformance statement cannot be used, and that signals to regulators, external auditors, and other stakeholders that the function’s work product may not be reliable. In regulated industries, that signal can prompt additional scrutiny from oversight bodies. The assessment report is the roadmap for the next cycle, and treating corrective actions as optional compounds the problem over time.

1
The Institute of Internal Auditors. Quality Assurance and Improvement Program (QAIP)
2
The Institute of Internal Auditors. The IIA Celebrates the Effective Date of the Global Internal Audit Standards
3
The Institute of Internal Auditors. Global Internal Audit Standards – Standard 12.1 Internal Quality Assessment
4
The Institute of Internal Auditors. Frequently Asked Questions
5
The Institute of Internal Auditors. Global Internal Audit Standards – Standard 8.4 External Quality Assessment
6
The Institute of Internal Auditors. The Global Internal Audit Standards and Related Materials
7
The Institute of Internal Auditors. Implementation Guide 1312 – External Assessments
8
The Institute of Internal Auditors. Quality Assessment Manual Chapter 4
9
The Institute of Internal Auditors. The Internal Audit Charter – A Blueprint to Assurance Success
10
The Institute of Internal Auditors. Implementation Guide 1200 – Proficiency and Due Professional Care
11
The Institute of Internal Auditors. Chief Audit Executive’s Guide to Domain III – Governing the Internal Audit Function
12
The Institute of Internal Auditors. Implementation Guide 1321 – Use of Conforms with the International Standards for the Professional Practice of Internal Auditing
13
The Institute of Internal Auditors. Implementation Guide 1322 – Quality Assurance and Improvement Program