Most internal audit functions know they are required to have a Quality Assurance Improvement Program. Far fewer have one that functions as anything more than a document that gets pulled out every five years when an external quality assessment is approaching.
That gap is worth understanding — because a well-built QAIP is not just a compliance requirement. It is a continuous system for improving how your audit function operates.
What the IIA Standards Actually Require
The International Professional Practices Framework (IPPF) requires that every internal audit function have a Quality Assurance and Improvement Program. Under the 2025 IIA Global Internal Audit Standards, this requirement is explicit: the chief audit executive is responsible for developing and maintaining a QAIP that covers all aspects of the internal audit activity.
The QAIP must include both ongoing monitoring and periodic self-assessments, as well as external quality assessments conducted at least once every five years by a qualified, independent assessor.
What the standards do not prescribe is exactly how the program should be structured. That is where most audit functions get stuck.
What QAIP Development Looks Like in Practice
A functional Quality Assurance Improvement Program has three core components.
Ongoing monitoring means that quality is assessed continuously — not just before an EQA. This includes supervision of individual engagements, periodic reviews of audit work products, and tracking of key performance indicators across the audit cycle.
Periodic self-assessments are structured internal reviews that evaluate the audit function's conformance with IIA standards, its effectiveness in achieving its mission, and its alignment with the organization's risk profile and strategic objectives.
External quality assessments provide an independent perspective that internal reviews cannot replicate. An EQA validates the self-assessment findings, identifies blind spots, and provides the chief audit executive and audit committee with an objective view of the function's quality and conformance.
Why Most QAIPs Fall Short
The most common failure is treating QAIP as a documentation exercise rather than an operational system. A QAIP that lives in a policy document but is not embedded in day-to-day audit work does not improve quality — it just creates the appearance of compliance.
The second most common failure is building a QAIP that is too complex to sustain. When the program requires significant manual effort to maintain, it tends to be deprioritized when workloads increase. The result is a program that looks complete on paper but has not been actively used in years.
Effective QAIP development starts with the audit function's actual operating model — how engagements are planned, executed, and reported — and builds quality checkpoints into that workflow rather than layering them on top of it.
QAIP Development and EQA Readiness
A well-maintained QAIP is the foundation of EQA readiness. When an external quality assessment is conducted, the assessor will review the QAIP documentation, interview staff, and examine work products to evaluate whether the program is operating as described.
Audit functions that have invested in genuine QAIP development — not just documentation — tend to experience EQA as a validation of what they already know about their function. Those that have not tend to experience it as a scramble.
If your function is approaching an EQA or has not reviewed your QAIP structure in more than two years, that is a reasonable starting point for a gap assessment.
LH Consulting Group works with internal audit functions to build and strengthen QAIPs that are aligned with IIA standards, embedded in daily operations, and designed to support EQA readiness without the last-minute preparation that comes from treating quality as an afterthought.