Skip to main content
Regulatory Council
Dark green background, "Weak Application Security Can Cost You Millions," 3 slanted images of fingers pointing to digital locks, and a "Learn the Basics" button
Category: Internal Controls & Audit

Self-Assessment with Independent Validation

Also known as: SAIV, Self-assessment with independent validation, SAIV external quality assessment
Simply put

A Self-Assessment with Independent Validation (SAIV) is one recognized way for an internal audit function to satisfy its periodic external quality assessment obligation. The internal audit function first evaluates itself against professional standards, and then a qualified, independent external assessor reviews and validates that self-assessment. The result is a report on how well the function conforms to applicable internal audit standards, along with any successful practices and opportunities for improvement.

Formal definition

SAIV is a form of external quality assessment (EQA) used by internal audit functions, as described in guidance from The Institute of Internal Auditors (IIA). It comprises two components: (1) a rigorous self-assessment performed by the internal audit function, typically led by the Chief Audit Executive (CAE), that documents the function's conformance with applicable internal audit standards; and (2) an independent validation of that self-assessment conducted by a qualified, independent external assessor. The validator's output is a validation report addressing the self-assessment's conclusions, conformance status, and successful practices. Under the IIA's Standards and related implementation guidance, the validator must be external and independent of the organization, so the validation is not something that can be delegated to internal audit staff or to a second-line compliance or risk function. The results of the external quality assessment, including an SAIV, are required to be communicated to senior management and the board (or its audit committee); this reporting is a requirement rather than an organizational option. Applicability, the precise periodicity, and detailed procedural requirements are governed by the version of the IIA Standards in force, which practitioners should verify against the primary source, as this framework language evolves across editions and specific requirements may vary by jurisdiction and adopting organization.

Why it matters

An internal audit function exists to provide independent, objective assurance over an organization's governance, risk management, and control processes. But that assurance is only credible if the audit function itself is subject to periodic, independent scrutiny. Under guidance from The Institute of Internal Auditors (IIA), internal audit functions are expected to undergo periodic external quality assessment (EQA), and a Self-Assessment with Independent Validation (SAIV) is one of the recognized ways to satisfy that obligation. It offers a middle path: the function performs a rigorous self-evaluation of its conformance with applicable internal audit standards, and a qualified, independent external assessor then validates that work. This preserves cost efficiency and internal ownership while still delivering the external perspective that gives the result its credibility.

Who it's relevant to

Chief Audit Executives
The CAE typically leads the self-assessment portion of an SAIV, documenting the function's conformance with applicable standards. The CAE is responsible for engaging a qualified, independent external assessor to perform the validation and for ensuring the results reach senior management and the board or audit committee as required.
Audit Committees and Boards
Governance bodies charged with oversight of internal audit are the intended recipients of external quality assessment results, including those from an SAIV. Because communication of these results to senior management and the board is a requirement under the Standards, audit committees should expect to receive the validation report and use it to gauge their continued reliance on the function's assurance.
Internal Audit Functions
The function as a whole undergoes the self-assessment and validation. An SAIV offers a recognized route to satisfying the periodic EQA obligation while retaining internal ownership of the underlying evaluation, provided the validation is performed by an external, independent assessor.
External Quality Assessors
Qualified, independent external assessors perform the validation component, reviewing the function's self-assessment and issuing a validation report on its conclusions, conformance status, and successful practices. Their independence from the organization is essential to the validity of the SAIV.
Senior Management
Senior management is among the parties to whom external quality assessment results must be communicated. The findings inform decisions on resourcing, addressing conformance gaps, and acting on identified opportunities for improvement.

Inside SAIV

Self-Assessment Component
The internal audit activity conducts a comprehensive self-evaluation of its conformance with applicable standards, its performance, and its effectiveness. In the IIA context, this self-assessment is a core element of the periodic external quality assessment cycle and is intended to be rigorous, evidence-based, and led by the chief audit executive.
Independent Validation Component
The completed self-assessment is validated by a qualified, independent external assessor or assessment team. Under IIA Standard 1312 and its Implementation Guidance, the validator must be external to the organization to preserve independence and objectivity; internal parties such as a second-line risk or compliance function, or internal audit staff themselves, do not satisfy this external-assessor requirement.
Assessor Qualification
The independent external validator is expected to be competent and qualified in the professional practice of internal auditing and in the quality assessment process. Qualification typically encompasses relevant knowledge, experience, and, in many cases, credentials recognized within the profession.
Scope of Conformance Evaluation
The assessment addresses conformance with the applicable professional standards and, often, the internal audit activity's charter, alignment with organizational objectives, and opportunities for improvement. The precise scope should be agreed at the outset and documented.
Reporting and Communication
The results of the external quality assessment, including an SAIV, are communicated to senior management and the board (or its audit committee). Under the Standards this communication is a required outcome of the assessment rather than a discretionary practice.
Periodicity
SAIV is one permitted method of satisfying the requirement for periodic external assessment of the internal audit activity. The frequency and timing should follow the applicable Standards and be confirmed against the current edition of the source material.

Common questions

Answers to the questions practitioners most commonly ask about SAIV.

Can our second-line compliance function or internal audit staff perform the validation portion of an SAIV?
Not for the validation step as contemplated by the IIA framework. Under IIA Standard 1312 and its Implementation Guide, the self-assessment with independent validation (SAIV) model pairs an internal self-assessment with a review performed by a qualified, independent external assessor or validation team. Personnel from a second-line compliance or risk function, or internal audit staff themselves, are part of the organization and therefore do not meet the external-assessor requirement for the independent validation. Their involvement may be appropriate in conducting the self-assessment component, but the validation is expected to come from outside the organization to preserve objectivity.
Is sharing the SAIV results with the audit committee or board optional depending on how our organization is set up?
No. While many aspects of how an assessment is scoped can vary by organization, the communication of external quality assessment results, including an SAIV, is not treated as discretionary under the IIA Standards. The results are expected to be communicated to senior management and the board. Organizations retain flexibility in the format, timing, and supporting detail of that communication, but the requirement to report the outcome to senior management and the board should not be characterized as varying at the organization's discretion.
How do we select a qualified, independent external assessor for the validation?
Selection typically focuses on demonstrated competence in applying the relevant standards and genuine independence from the function being assessed. The assessor is expected to be external to the organization and free from any real or apparent conflict of interest, including prior involvement in the activity under review. Organizations often consider the assessor's professional credentials, familiarity with the applicable framework, and sector experience. Because expectations around assessor qualifications and independence can be nuanced, they should be confirmed against the primary standard and its implementation guidance.
What is the practical division of labor between the self-assessment and the independent validation?
In a typical SAIV, the internal team conducts a structured self-assessment, gathering evidence, evaluating conformance against the applicable standards, and documenting findings and conclusions. The independent external assessor then reviews that self-assessment: examining the methodology, testing the sufficiency and reliability of the supporting evidence, and forming an independent view on whether the self-assessment's conclusions are supportable. The validation is a review and corroboration exercise rather than a full re-performance, though the scope of validation can vary based on the arrangement and the assessor's judgment.
How should we prepare documentation to support the validation step?
Preparation generally centers on assembling clear, traceable evidence that links each self-assessment conclusion to its supporting basis. This often includes the self-assessment methodology, working papers, evidence of conformance or gaps, and management's responses to identified issues. Well-organized documentation allows the external validator to efficiently corroborate conclusions and reduces the risk of scope disputes. Because the validator forms an independent view, documentation should be complete and candid rather than curated to support a predetermined outcome.
How often is an SAIV typically performed, and how does it relate to other assessment approaches?
The SAIV is one of the recognized approaches for satisfying periodic external quality assessment expectations, offering an alternative to a full external assessment performed entirely by an outside party. Organizations should verify the specific frequency and any prescribed intervals against the current IIA Standards and implementation guidance, as these details can be updated across editions. The choice between an SAIV and a full external assessment often depends on considerations such as cost, capacity, and the organization's desire for a fully external perspective; both are intended to provide credible, independent input into the assessment outcome.

Common misconceptions

The independent validation in an SAIV can be performed by an internal party, such as the organization's second-line risk or compliance function or other internal audit staff.
IIA Standard 1312 and its Implementation Guidance require the validator to be a qualified, independent external assessor. Parties internal to the organization do not meet the external-assessor requirement, and using them would not satisfy the validation component of an SAIV.
Whether the SAIV results are reported to the board or audit committee is a matter of organizational discretion.
Under the Standards, the results of the external quality assessment, including an SAIV, must be communicated to senior management and the board (or its audit committee). This reporting is a required outcome, not an optional one.
An SAIV is a wholly self-directed exercise that substitutes for external scrutiny.
SAIV is a hybrid approach: it combines a rigorous internal self-assessment with mandatory independent external validation. The self-assessment alone does not fulfill the periodic external assessment requirement without the accompanying independent validation.

Best practices

Engage a qualified, independent external assessor to perform the validation, and confirm that the individual or team has no organizational relationship that would compromise independence under the applicable Standards.
Verify the validator's competence and qualifications, including relevant experience in internal auditing and in quality assessment, before commissioning the engagement.
Define and document the scope of the self-assessment and the validation up front, including the standards to be assessed and the criteria for conformance.
Ensure the self-assessment is thorough and evidence-based so that the independent validation has a robust basis to review, rather than treating the self-assessment as a formality.
Communicate the results of the SAIV to senior management and the board or audit committee, treating this reporting as a required outcome of the assessment.
Confirm the periodicity, terminology, and specific requirements against the current edition of the IIA Standards and Implementation Guidance, as framework language evolves across editions and specifics should be verified with the primary source.
Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide