A quality assurance and improvement programme, or QAIP, is the set of checks an internal audit team uses to prove its own work meets professional standards and to find ways to improve. It has two parts: ongoing and periodic internal assessments, and an independent external assessment at regular intervals.
Last reviewed: 17 October 2026. Facts checked. We searched for QAIP requirements and the IIA's Global Internal Audit Standards. We confirmed that the IIA's earlier (2017) Standard 1312 required an external assessment at least once every five years, by a qualified independent assessor, and that a full external review or a self-assessment with independent validation was allowed. We confirmed that the Global Internal Audit Standards took effect on 9 January 2025 and replaced the 2017 Standards. We did not open the new Standards and so do not cite their numbers. We saw RBI NBFC and bank direction summaries that mention a quality programme, but have not read the RBI text.
Why have a QAIP
Internal audit asks others to meet standards. A QAIP shows the team does the same. It also gives the audit committee and the board a basis to trust the reports.
It matters more where a regulator expects it. Secondary summaries of RBI's internal audit directions for banks and NBFCs say the board or its committee maintains a quality programme covering the whole function. Read the RBI text for your entity.
The two halves of a QAIP
| Part | Who does it | How often |
|---|---|---|
| Internal assessment, ongoing | Supervisors and reviewers within the team | On every engagement |
| Internal assessment, periodic | A senior person or another team member, not the one who did the work | At set intervals, such as yearly |
| External assessment | Qualified assessor from outside the organisation | At least once every five years under the earlier IIA standard; check the current one |
Ongoing internal assessment
This is the daily layer of quality.
- Supervisor review of every working paper and report before issue.
- Checklists for planning, fieldwork and reporting.
- Sign-off on scope, risk assessment and sampling.
- Feedback to the team from each review.
- Post-audit feedback from the auditee.
If this layer is strong, the rest is easier.
Periodic internal assessment
Once a year, or at another agreed interval, step back and ask whether the team meets the standards.
- Choose a framework, such as the IIA's Global Internal Audit Standards, and in India any ICAI guidance that applies to your type of engagement.
- Pick a sample of completed audits.
- Review each against a checklist: planning, evidence, documentation, reporting, follow-up.
- Review team-level items: independence, competence, training, charter, reporting line.
- Summarise strengths, gaps and actions.
The reviewer should be someone who did not work on those files.
External assessment
An outside reviewer looks at your function and gives an independent opinion. The IIA has allowed two routes: a full external assessment, or a self-assessment checked by an independent external validator. You must discuss the form, frequency and the reviewer's qualifications and independence with the board.
Choose an assessor who knows your sector. A bank internal audit team should not be assessed by someone who has never seen a bank.
Measures to track
QAIP works best with data. Examples:
- First-time pass rate on file review.
- Number of files with missing evidence.
- Time from fieldwork to draft report.
- Auditee feedback scores.
- Training hours completed.
- Percentage of QAIP actions closed.
Our KPI article shows how to put these into a scorecard.
Reporting QAIP results
Report to the audit committee at least once a year. Include:
- What you assessed and how.
- Whether the team generally conforms to the standards.
- Any gaps and what you are doing about them.
- When the next external assessment is due.
Be honest. A report that says everything is perfect is less credible than one that names gaps and plans.
A simple QAIP set-up for a small team
- Write a one-page QAIP policy and get it approved by the audit committee.
- Use one review checklist for every audit.
- Keep a log of review comments and common errors.
- Do an annual look-back review of a few completed audits by someone independent.
- Collect auditee feedback after each audit.
- Plan the external assessment well ahead and budget for it.
- Track actions in one register.
For observation quality in particular, see how to write audit observations.
Common mistakes
- Treating QAIP as a document to be filed.
- Having the same person do the work and the quality review.
- Doing the review but not acting on it.
- Waiting until the external assessment is due to start preparing.
- Reporting only good news.
Frequently Asked Questions
What does QAIP stand for?
Quality Assurance and Improvement Programme (spelled "Program" in US usage).
How often is an external assessment needed?
The earlier IIA Standard 1312 required one at least every five years. Check the current Global Internal Audit Standards and any regulator's requirement that applies to you.
Can a small team do a QAIP?
Yes. Use a simple checklist, peer review and annual look-back, and arrange an external assessment as the standards or regulator require.
Who owns the QAIP?
The head of internal audit is responsible for it. The audit committee or board oversees it.
Is a QAIP the same as a peer review?
A peer review is one way to do an assessment. The QAIP is the broader programme that includes ongoing review, periodic assessment and external assessment.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error