Skip to main content
Policy Authority
Category: Internal Audit

Internal Quality Assessment

Also known as: Internal Assessment, Internal Self-Assessment
Simply put

An internal quality assessment is a review that an internal audit function performs on itself to check how well it meets professional standards for internal auditing. It typically combines ongoing day-to-day monitoring with periodic self-evaluations. It is one part of a broader program used to maintain and improve the quality of internal audit work.

Formal definition

The internal quality assessment is a component of the internal audit activity's Quality Assurance and Improvement Program (QAIP) under the IIA's framework. As reflected in the 2024 Global Internal Audit Standards, the chief audit executive is generally responsible for developing and conducting internal assessments of the internal audit function's conformance with the applicable internal audit standards. Internal assessments commonly consist of ongoing monitoring embedded in the routine supervision and management of the internal audit activity, coupled with periodic self-assessments or reviews. Internal quality assessment is distinct from external quality assessment (EQA), which is performed or validated by a qualified, independent assessor from outside the organization; the evidence provided does not specify the frequency, scope, or procedural details of internal assessments, and requirements may vary by adopted standards and organizational context.

Why it matters

An internal quality assessment provides the internal audit function with a structured means of confirming that its work conforms to professional standards, such as the IIA's 2024 Global Internal Audit Standards. Because internal audit exists to provide independent, objective assurance to the board and senior management, the credibility of that assurance depends on the function itself operating to a recognized standard of quality. Internal assessments help the chief audit executive identify gaps in conformance, monitor the effectiveness of audit processes, and support continuous improvement before deficiencies affect the reliability of audit conclusions.

Internal quality assessment also forms part of a broader Quality Assurance and Improvement Program (QAIP), working alongside external quality assessment. The two are complementary but distinct: internal assessment is conducted within the function through ongoing monitoring and periodic self-evaluation, while external quality assessment is performed or validated by a qualified, independent assessor from outside the organization. Relying on internal assessment alone does not substitute for the independent perspective an external review provides, and treating the two as interchangeable is a common misunderstanding.

Because the evidence available does not specify the frequency, scope, or procedural detail of internal assessments, organizations should confirm the specific expectations of the standards they have adopted and their own governance context. Requirements and practices may vary depending on the standards in force, jurisdiction, and organizational circumstances, so an internal quality assessment should be designed to reflect the applicable framework rather than a single universal template.

Who it's relevant to

Chief Audit Executives
The chief audit executive is generally responsible for developing and conducting internal assessments of the internal audit function's conformance with the applicable standards. Internal quality assessment is a core element of the QAIP the CAE oversees, combining ongoing monitoring with periodic self-assessment.
Internal Audit Practitioners
Internal auditors contribute to internal quality assessment through the ongoing monitoring embedded in routine engagement supervision, and they are the subject of the periodic self-assessments that evaluate the function's conformance with professional standards.
Audit Committees and Boards
Those charged with governance rely on the assurance internal audit provides. Internal quality assessment supports the credibility of that assurance by evidencing the function's conformance with standards, and it complements the independent perspective of external quality assessment.
External Quality Assessors
Qualified, independent assessors performing or validating external quality assessments consider the internal audit function's internal assessment activities as part of the broader QAIP, since internal and external assessments are complementary components of the same program.

Inside Internal Quality Assessment

Ongoing Monitoring
The continuous, embedded evaluation of internal audit performance that occurs as part of routine supervision and management of engagements, typically including engagement supervision, working paper review, and performance metrics tracking.
Periodic Self-Assessment
A structured, point-in-time review conducted from within the internal audit function to evaluate conformance with applicable standards and the effectiveness of audit processes, distinct from the continuous nature of ongoing monitoring.
Conformance Evaluation
An assessment of whether the internal audit activity aligns with its own charter, methodology, and applicable professional standards, such as those issued by the IIA, though the specific benchmark depends on the standards the function has adopted.
Quality Program Component
Internal quality assessment functions as one part of a broader quality assurance and improvement program, commonly paired with periodic external assessments to form a complete quality framework.

Common questions

Answers to the questions practitioners most commonly ask about Internal Quality Assessment.

Is an internal quality assessment the same as an external quality assessment?
No. An internal quality assessment is conducted from within the internal audit function or organization, typically by staff or a qualified person under the chief audit executive's oversight, whereas an external quality assessment is performed by an independent, qualified reviewer from outside the organization. The two are complementary rather than interchangeable: professional guidance for internal audit commonly contemplates both, with internal assessments performed on an ongoing basis and external assessments performed periodically. Because an internal assessment is self-directed, it carries inherent independence limitations that an external review is designed to address.
Does completing an internal quality assessment mean the internal audit function is fully compliant with professional standards?
Not necessarily. An internal quality assessment evaluates conformance with applicable professional standards and the effectiveness of the internal audit activity, but its conclusions are the product of a self-assessment and are subject to the objectivity limitations that come with reviewing one's own function. A favorable internal assessment indicates that the function believes it conforms in the areas reviewed; it does not by itself provide the independent validation that an external assessment offers, and it does not guarantee that all gaps have been identified.
Who should perform an internal quality assessment?
Responsibility for the internal quality assessment program typically rests with the chief audit executive, who may assign the work to individuals within the internal audit function who are competent in the applicable standards and, where practical, sufficiently removed from the specific activities being reviewed to support objectivity. The specific staffing arrangement depends on the size, structure, and resources of the function; this entry does not prescribe particular roles or tooling.
How often should internal quality assessments be conducted?
Professional guidance commonly distinguishes between ongoing monitoring, which is embedded in routine supervision and management of engagements, and periodic self-assessments, which are conducted at intervals determined by the function. The precise frequency is not universal and may vary based on the organization's practices, applicable professional guidance, and the assessment approach adopted. This entry does not specify a mandatory interval.
What is typically covered in the scope of an internal quality assessment?
The scope commonly includes evaluating conformance with applicable professional standards, the internal audit charter, and relevant policies and procedures, as well as the efficiency and effectiveness of the internal audit activity and its alignment with stakeholder expectations. The exact scope depends on the function and the guidance being applied. This entry does not cover implementation specifics, assessment methodologies, or supporting tools.
How do the results of an internal quality assessment get reported and used?
Results are typically communicated by the chief audit executive to senior management and the board or its relevant committee, along with any planned actions to address identified improvement areas. The findings commonly feed into continuous improvement of the internal audit activity and may inform the timing and focus of subsequent external assessments. Specific reporting formats and escalation practices vary by organization and are outside the scope of this entry.

Common misconceptions

Internal quality assessment can fully substitute for an external assessment.
In many frameworks, notably the IIA's standards, internal and external assessments are complementary. Internal assessment addresses ongoing and self-directed review, while periodic external assessment provides independent validation; one is not generally treated as a replacement for the other.
Internal quality assessment is an assurance activity performed on the organization's operations.
It is a review of the internal audit function's own performance and conformance, not an audit of business processes or controls. It concerns the quality of the assurance provider itself rather than the areas that provider examines.
A single annual review satisfies internal quality assessment requirements.
Internal assessment typically comprises both ongoing monitoring embedded in day-to-day activity and periodic self-assessments. Relying on a one-time review may overlook the continuous monitoring element that many frameworks expect.

Best practices

Distinguish clearly between ongoing monitoring embedded in supervision and periodic self-assessments, and document how each contributes to the overall quality program.
Define the standards, charter provisions, and methodology against which conformance is evaluated so that assessment criteria are explicit and consistent.
Position internal quality assessment as complementary to, rather than a substitute for, periodic external assessment within the broader quality assurance and improvement program.
Maintain evidence of engagement supervision, working paper review, and performance metrics to support conclusions about conformance.
Report internal assessment results and any improvement actions to those charged with governance, keeping the review focused on the audit function's own performance rather than the areas it audits.
Periodically revisit the assessment approach to reflect changes in the applicable standards the function has adopted, noting that specific requirements may vary by framework and jurisdiction.
a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.