Photo by Luke Chesser on Unsplash
APIP capability shows how capable the government internal oversight apparatus is of carrying out its role: providing assurance, providing consulting, and driving improvements in governance, risk management, and control. Since the end of 2025, its assessment has followed BPKP Regulation 6/2025 with five levels and five elements. Because the term “level 3” is also used in other models, this article also clarifies the differences.
Regulatory changes in 2025 to 2026 that affect this topic are summarized in the article audit and oversight regulation update 2026.
The discussion covers the legal basis, the meaning of each level, the elements and their weights, how the assessment is carried out, the Level 3 requirements, and practical steps to raise the level. References checked as of 23 October 2026. For assessing the capability of a university SPI, read the article university SPI capability.
What Is the Legal Basis for APIP Capability Assessment?
The basis is BPKP Regulation 6/2025 on Improving APIP Capability in Ministries, Agencies, and Regional Governments, which was enacted on 28 November 2025 and took effect upon promulgation. This regulation revokes BPKP Regulation 8/2021, which used different level names (Initial, Structured, Delivered, Institutionalized, Optimized). The recitals of the regulation cite the Global Internal Audit Standards 2024 as one of its references.
Article 3 states that capability improvement is carried out jointly by the leadership of ministries/agencies/regional governments, APIP, and BPKP. Article 8 affirms leadership commitment in the form of monitoring, access to information, independence, and resource support. The foundation of APIP itself lies in Government Regulation 60/2008 Articles 48 to 56, which are discussed in the article SPIP maturity.
What Do Level 1 to Level 5 Mean?
Article 6 paragraph (2) establishes five levels. The following descriptions are summarized from Annex I.
| Level | Name | Description |
|---|---|---|
| 1 | Initial (Rintisan) | Sporadic or ad hoc oversight, no methodology yet, and limited to administrative matters |
| 2 | Structured | Provides assurance and consulting with structures and procedures, but quality and consistency are still low |
| 3 | Adequate | Risk-based internal oversight that provides reasonable assurance on the achievement of objectives, effectiveness and efficiency, and compliance; there is early warning of fraud and improvement of governance, risk management, and internal control |
| 4 | Integrated | Integrated and convergent oversight, giving insight to top leadership, and safeguarding strategic risks as well as cross-sector and national development risks |
| 5 | Optimal | Real-time and future-oriented oversight, APIP becomes a role model, and fraud risk management is also managed |
What Are the Five Elements and Their Weights?
Article 6 paragraph (3) and Annex II establish five elements. Each element is broken down into assessment topics in Annex I.
| Elements | Weight |
|---|---|
| 1. Quality of role and services | 40% |
| 2. Assignment professionalism | 20% |
| 3. Oversight management | 20% |
| 4. Performance and oversight resource management | 10% |
| 5. Organizational culture and relationships | 10% |
The largest weight lies in the quality of role and services. This means an APIP that is administratively tidy but whose services do not yet touch risk and governance will not rise in level merely by improving its documents.
What Are the Topics in Each Element?
Annex I breaks the five elements down into 19 topics. The first element reflects the quality of oversight results, the second and third elements reflect oversight activities, and the fourth and fifth elements reflect the capacity that supports them.
| Elements | Topic |
|---|---|
| 1. Quality of role and services | Assurance activities (compliance oversight with a focus on early warning of fraud, performance oversight, and assurance on governance, risk management, and internal control); consulting activities |
| 2. Assignment professionalism | Developing preliminary information; assignment planning; assignment execution; communicating assignment results; follow-up monitoring; assignment quality control |
| 3. Oversight management | Oversight planning; reporting to the management of ministries/agencies/regional governments |
| 4. Performance and oversight resource management | Performance management; financial resource management; planning of needs for and procurement of oversight personnel; professional development of APIP personnel; information technology support |
| 5. Organizational culture and relationships | Building an integrity culture; quality of APIP communication; coordination of oversight with external parties; access to information and information systems |
Two important notes from Annex I. First, the scope of consulting activities is agreed with the client without shifting the client's responsibility to APIP. Second, the assignment professionalism element refers to both the Indonesian Government Internal Audit Standards (SAIPI) and the Global Internal Audit Standards, with strong quality control.
How Is APIP Capability Assessed?
- Evaluator. The evaluation is carried out by BPKP (Articles 9 to 11). Evaluators test evidence through sampling, interviews, and confirmation.
- Statement letter. The APIP leadership submits a statement letter on the supporting data.
- Frequency. The evaluation is carried out annually. A special evaluation may be carried out if there is a trigger such as a corruption case, an organizational restructuring, or a policy change.
- Quality assurance. If the result rises to Level 3 or higher, independent quality assurance by BPKP is mandatory and the report is issued afterward.
- Transition period. The 2025 evaluation is divided between the end of 2025 and the beginning of 2026, and levels resulting from assessments under the old regulation are not taken into account.
The text of the regulation referred to in this article does not contain a self-assessment mechanism or a fixed validity period for results. Therefore, do not cite either of these as a provision of BPKP Regulation 6/2025.
What Is Required for APIP to Reach Level 3?
At the element level, Level 3 requires the following based on Annex I:
- Role and services: risk-based assurance and strategic consulting, not just administrative compliance checks.
- Assignment professionalism: a written methodology used in every assignment, documented evidence, and tiered review.
- Oversight management: planning that leads to institutional priorities and reports that reach root causes. The planning process is discussed in the article Inspectorate PKPT.
- Performance and resource management: results-oriented performance and effectively managed resources.
- Organizational culture and relationships: internal and external coordination that improves quality, and open access to oversight information.
The quality assurance and improvement program is also part of the assignment professionalism element. The external mechanism for testing APIP quality is discussed in the article APIP peer review.
Why Is Level 3 Important for Regional Governments and Inspectorates?
- Home Affairs Ministerial Regulation 4/2026 Annex IV lists APIP capability level 3 as one of the supporting targets on the Regional Head's oversight track over Regional Apparatus (Perangkat Daerah).
- In the Integrated SPIP maturity assessment (BPKP Regulation 5/2021), APIP capability results are used in the APIP role sub-element, so they affect the regional government's maturity score.
Do Not Mix Them Up: Level 3 in Three Different Models
| Model | Issuer | Level name | Level 3 means |
|---|---|---|---|
| APIP Capability (BPKP Regulation 6/2025) | BPKP | Initial, Structured, Adequate, Integrated, Optimal | Adequate: risk-based oversight with reasonable assurance |
| Integrated SPIP Maturity (BPKP Regulation 5/2021) | BPKP | Initial (Rintisan), Developing, Defined, Managed and Measured, Optimum | Defined: a score of 3.00 up to below 4.00 on SPIP implementation maturity |
| Internal Audit Capability Model (IA-CM) | IIA Research Foundation | Initial, Infrastructure, Integrated, Managed, Optimizing | Integrated |
The term “Level 3 (Integrated)” that is still often encountered comes from the naming in the IA-CM or older models. In BPKP Regulation 6/2025, the name “Integrated” is attached to Level 4. SPIP maturity is discussed in the article SPIP maturity.
What Are the Practical Steps to Raise APIP Capability Level?
The following steps are an example of a working approach, not a regulatory provision.
- Understand the topics in Annex I. Read the criteria of each element and its topics, then mark which ones are met and which are not.
- Collect evidence per topic. Evidence is tested through sampling and interviews, so documents must be consistent with day-to-day practice.
- Strengthen risk-based planning. Start from the risk assessment of oversight objects through to the PKPT.
- Set the methodology and tiered review. Make sure work programs, working papers, and supervision are uniform across assignments.
- Run a quality assurance program. Periodic internal assessment, then peer review for external assessment.
- Manage competencies. Plan auditor training and certification in a measurable way.
- Monitor the follow-up of recommendations. Oversight results only have an impact when their recommendations are resolved.
How Does Internal Audit Software Help?
Audithink does not assess or score capability, and does not replace BPKP evaluation. Audithink is internal audit management software with six main features: risk assessment, audit planning, work program templates, notifications, follow-up monitoring, and automated reports. These features help provide day-to-day working evidence: a risk-based plan, uniform work programs, monitored deadlines, and recorded follow-up status of recommendations.
APIP Capability FAQ
What is APIP capability?
APIP capability is a measure of the ability of the government internal oversight apparatus to carry out its role. BPKP Regulation 6/2025 divides it into five levels and five assessment elements.
What are the APIP capability levels?
Five levels: 1 Initial, 2 Structured, 3 Adequate, 4 Integrated, and 5 Optimal (BPKP Regulation 6/2025 Article 6 paragraph 2).
Who assesses APIP capability?
The evaluation is carried out by BPKP. If the result rises to Level 3 or higher, independent quality assurance by BPKP is mandatory before the report is issued.
What is the weight of each element?
Quality of role and services 40%, assignment professionalism 20%, oversight management 20%, performance and oversight resource management 10%, and organizational culture and relationships 10%.
Is APIP Level 3 the same as SPIP maturity Level 3?
No. APIP capability Level 3 is called Adequate (BPKP Regulation 6/2025), while SPIP maturity Level 3 is called Defined (BPKP Regulation 5/2021). The two are assessed with different models and processes.
Which regulation is replaced by BPKP Regulation 6/2025?
BPKP Regulation 8/2021 on improving APIP capability was revoked by Article 12 of BPKP Regulation 6/2025.
Conclusion
Raising the capability level is not about adding documents, but about proving that risk-based oversight is truly running and its results are followed up. Start by mapping against Annex I, then close the gaps that carry the most weight, namely the quality of role and services.
If your APIP wants to streamline plans, work programs, and follow-up monitoring as working evidence, schedule an Audithink demo.
