ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Quality assurance and improvement program requirements are how an internal audit function proves to its board that it does what its charter says, to the standard it claims. Under the Global Internal Audit Standards the program is not optional and not a once-every-five-years event. It is a standing system with three layers, an annual reporting cycle and an external check.
This guide works through Standards 8.3, 8.4, 12.1, 12.2 and 12.3: what the program must contain, how the assessment types differ, what the board receives and when, and when you may tell report readers that the work conformed.
Standard 8.3 puts the obligation on the chief audit executive (CAE), who builds, runs and maintains the quality assurance and improvement program. Its scope is the whole function, not just engagement files: strategy, methodology, resourcing, board reporting and the plan are all in range.
The program has two families of assessment: internal ones, detailed in Standard 12.1, and external ones, governed by Standard 8.4. Quality in the 2024 framework means two things measured together, conformance with the Standards and achievement of the function’s own performance objectives. A function that conforms but misses every target it agreed with the board does not have a quality outcome.
Standard 8.3 also carries Essential Conditions for the board. It is expected to discuss the program with the CAE, approve the function’s performance objectives at least once a year, and, with senior management, assess how effective and efficient the function is. If your board has never seen the objectives it is supposed to approve, that is a Domain III gap before anyone opens a workpaper.
Every quality assurance and improvement program is built from the same layers. They differ in frequency, depth and who performs them, and an assessor will expect evidence of each.
| Assessment type | Standard | Frequency | Who performs it | Typical evidence |
|---|---|---|---|---|
| Ongoing monitoring | 12.1, 12.2, 12.3 | Continuous, built into daily work | Engagement supervisors and the CAE | Signed review checklists, supervision notes, KPI results, survey returns |
| Periodic self-assessment | 12.1 | Set by the CAE’s methodology; reported to the board at least annually | Senior auditors, a quality team, or knowledgeable people elsewhere in the organisation | Assessment plan, standard-by-standard workpapers, dated action plan |
| Full external quality assessment | 8.4 | At least once every five years | A qualified, independent external team with at least one active CIA | Assessor’s report delivered to the board, approved action plan |
| Self-assessment with independent validation (SAIV) | 8.4 | Alternative route to the five-year requirement | The function assesses itself; an independent qualified assessor validates it | Full self-assessment file, validator’s report, board-approved rationale for SAIV |
Ongoing monitoring is the part of the quality assurance and improvement program that runs every day. Its main instrument is engagement supervision under Standard 12.3: a supervisor guides the team, checks the work program is complete, and confirms the workpapers support each finding and conclusion. Evidence of that supervision must be documented and kept, so a review that leaves no trace does not count.
Alongside supervision sit the measures from Standard 12.2. The CAE sets performance objectives, taking account of what the board and senior management expect, and builds a way to measure progress. Plan completion, timeliness, budget variance and stakeholder feedback are reasonable candidates. What matters is that results are reported and shortfalls produce an action plan.
A periodic self-assessment tests conformance with all 52 standards, not only those that bite during engagements, and asks whether the methodology itself is adequate. Standard 12.1 lets people inside the function perform it, or others in the organisation who know internal audit practice well enough to judge.
Within a quality assurance and improvement program the output is not a score. The CAE turns the results into action plans with a proposed timeline and reports both to the board and senior management. The file must be kept, because the external assessor will review it.
Standard 8.4 sets the external layer. The CAE drafts a plan and discusses it with the board. The assessment must happen no less than once in every five-year period, and the team must be both qualified and independent, with at least one member holding an active Certified Internal Auditor designation.
There are two routes. A full external quality assessment is performed end to end by the outside assessor. A self-assessment with independent validation has the function carry out a complete, documented assessment that mirrors the external process, after which an independent assessor confirms it was done completely and accurately. Both satisfy the requirement.
The board’s Essential Conditions under 8.4 include approving the plan, agreeing scope and frequency, considering the assessor’s competence and independence, recording why SAIV was chosen if it was, approving the action plan and timeline, and monitoring progress. The board must also receive the complete results directly from the assessor, not a summary filtered through the CAE.
Staff from another department of the same organisation do not qualify, however separate their reporting line, and neither does a parent, a sister entity in the group, or a body with oversight of the organisation. A two-way peer swap is not independent; a rotation among three or more peers may be. The guidance also suggests assessing sooner than five years after a change of CAE, a major methodology change, a merger of audit functions or heavy staff turnover.
Standard 8.3 sets two reporting clocks. Internal assessment results go to the board and senior management at least once a year. External assessment results go to them when the assessment is completed. In both cases the communication covers conformance and progress against performance objectives, compliance with laws or regulations governing internal audit where those apply, and the plans to fix deficiencies.
Standard 12.1 adds a sharper rule. If a nonconformance reaches the overall scope or operation of the function, the CAE must disclose it and its impact to the board and senior management. The Standard does not tie that disclosure to the annual reporting cycle.
A working quality assurance and improvement program therefore needs a reporting calendar: which committee meeting receives the annual internal assessment, when the KPI dashboard is presented, and where the next external assessment sits in the five-year cycle.
The Standards apply regardless of size, and the Fundamentals section addresses the smallest functions directly. Where the function is one person, its quality assurance and improvement program cannot be run from inside alone and needs outside support. One auditor cannot meaningfully supervise or self-assess their own work.
Options include a knowledgeable colleague elsewhere in the organisation performing the periodic self-assessment, a periodic review bought from a co-source provider, and structured checklists in place of second-person review, which the guidance to 12.1 and 12.3 suggests for functions with limited supervisory capacity. These help with internal assessment only; anyone who assisted may be impaired as an external assessor.
The guidance to Standard 15.1 encourages a statement in each final engagement communication that the work conformed with the Global Internal Audit Standards, but only where the results of supervision and of the quality assurance and improvement program support it. A function with no working program has no basis for the statement.
Where an engagement did not conform, 15.1 requires the report to disclose which standard was missed, why, and the effect on findings and conclusions. Standard 4.1 adds that where law prevents conformance with part of the Standards, the rest still applies and disclosure is required.
For how the program fits the wider framework, see our overview of the Global Internal Audit Standards. The internal audit charter is where the board’s quality expectations and the external assessment commitment should first be written down. Consistent finding ratings feed ongoing monitoring, which is why a documented internal audit findings rating scale belongs in the methodology the program tests. The Standards are free to read on the IIA’s standards page.
Yes. Standard 8.3 requires the CAE to develop, implement and maintain one covering the whole function, with internal and external assessments. Without one, a function cannot support a conformance statement.
At least once every five years under Standard 8.4. The board and CAE can choose a shorter cycle, and some regulators impose one.
Both meet Standard 8.4. SAIV puts more of the work on the function, and its value depends on how complete the self-assessment is, because the validator checks it rather than starting from scratch.
Conformance with the Standards, progress against board-approved performance objectives, compliance with laws governing internal audit where applicable, self-assessment results, and dated action plans with the status of actions already agreed.
Our Internal Audit Toolkit provides 87 editable templates built on the 2024 Standards and the four issued Topical Requirements. For a quality assurance and improvement program, use the Quality Assurance and Improvement Program Manual, the Internal Quality Assessment Procedure, the Periodic Conformance Self-Assessment Workbook covering all 52 standards, the External Quality Assessment Plan and Assessor Selection, the Performance Objectives and KPI Dashboard, the Engagement Supervision and Review Checklist and the Conformance Statement and Nonconformance Disclosure Procedure. It is $99, and every document is Word or Excel so you can adapt it to your function’s size.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026