—IIA 2024 · Standard 8.3
Standard 8.3: quality assurance and improvement.
Standard 8.3 asks the chief audit executive to maintain a quality assurance and improvement program covering the whole function — internal and external assessments, reported to the board. It is the first step on the path to an external quality assessment, and the evidence it produces is what that assessment reads.
—What the Standards Require
The requirements, in plain terms.
Standard 8.3
Quality
The CAE maintains a quality assurance and improvement program (QAIP) covering every aspect of the function, including internal (12.1) and external (8.4) assessments.
Standard 8.3 · Reporting
What the board sees
Internal assessment results go to the board and senior management at least annually; external results when completed — covering conformance, performance objectives, compliance and improvement plans.
Standard 8.3 · Essential Conditions
The board's role
The board approves internal audit's performance objectives at least annually and assesses the function's effectiveness and efficiency.
Standard 12.1
Internal Quality Assessment
Ongoing monitoring plus periodic self-assessments; nonconformance gets action plans with timelines, and the results feed the external assessment.
Standard 12.2
Performance Measurement
Performance objectives are set with input from the board and senior management, with a way to measure progress and action plans to improve.
—In Practice
What it looks like when it's done well.
One programme, two kinds of assessment
The QAIP is not a document that sits on a shelf. It joins the ongoing monitoring that happens in every engagement, the periodic self-assessment, and the five-yearly external assessment into one view of how well the function conforms.
Report the results, not just the activity
The Considerations suggest reporting the scope, frequency and results of assessments, plus the improvement actions agreed with the board and their progress. A list of reviews performed is not the same as evidence that the function is improving.
Measure what the board approved
Performance objectives approved by the board — coverage, timeliness, stakeholder feedback, plan delivery — give the QAIP something to measure against. Without them, quality reporting turns into anecdote.
—Evidence of Conformance
What an assessor will ask to see.
Board agendas and minutes recording QAIP discussions with the CAE (8.3)
CAE reports on assessment results and the status of improvement actions (8.3)
Documented internal assessments, with action plans and timelines for any nonconformance (12.1)
Board-approved performance objectives and the measurement against them (8.3, 12.2)
How ControlVista Supports It
The ControlVista audit record
When plans, reviewed working papers, sign-offs and remediation all live in one record, ongoing monitoring and periodic self-assessment become a query against the system — and VistaReport's live dashboards give the board the same view the QAIP uses.
—Further Reading
From our resources.
—IIA 2024 Hub
More on the Standards.
—Frequently Asked
Questions audit leaders ask.
What does QAIP stand for under the IIA 2024 Standards?
Quality assurance and improvement program. Under Standard 8.3 the CAE must maintain one covering all aspects of the internal audit function, including internal assessments (12.1) and external assessments (8.4).
How often must QAIP results be reported to the board?
Internal assessment results at least annually; external assessment results when the assessment is completed.
Last reviewed October 2026. Standards references paraphrase The IIA's Global Internal Audit Standards (2024); they are not a substitute for the official text.
—Request a demo
See ControlVista run your audit lifecycle, end to end.
A 30-minute walkthrough with the team that built it — from the audit universe to the board-ready committee pack, in English and Arabic.
A product of Vantage Technologies.