{"id":7511,"date":"2026-10-21T13:00:30","date_gmt":"2026-10-21T06:00:30","guid":{"rendered":"https:\/\/audithink.com\/?p=7511"},"modified":"2026-10-21T13:00:30","modified_gmt":"2026-10-21T06:00:30","slug":"university-spi-capability-assessment","status":"publish","type":"post","link":"https:\/\/audithink.com\/en\/blog\/kapabilitas-spi-perguruan-tinggi\/","title":{"rendered":"Assessing University SPI Capability: IA-CM, the BPKP Model, and the GIAS"},"content":{"rendered":"
\"University<\/figure>\n\n\n\n

Photo by Kanhaiya Sharma on Unsplash<\/p>\n\n\n\n

Once the SPI has a charter, an annual plan, and a work program, the next question comes from leadership and the oversight body: how well is this oversight function working, and what needs to improve? The answer is not just the number of reports issued. A clear measure of the SPI's ability is needed, often called the capability or maturity of the internal audit function.<\/p>\n\n\n\n

This article covers the capability assessment models a university SPI can use, namely the Internal Audit Capability Model<\/em> (IA-CM) from the IIA, the APIP Capability Model from BPKP, and the quality assurance provisions in the GIAS, followed by how to prepare a self-assessment. References were checked as of October 21, 2026.<\/p>\n\n\n\n

What Is SPI Capability or Maturity?<\/h2>\n\n\n\n

SPI capability is the ability of the internal oversight function to carry out its role consistently and with quality: from a written framework, competent auditors, and standardized audit practices, to a healthy relationship with leadership and the oversight body. A capability assessment differs from an audit of a single work unit. The object being assessed is the SPI itself.<\/p>\n\n\n\n

The results are useful in three ways: giving a starting picture for a newly formed SPI, setting improvement priorities, and showing leadership and the oversight body that improvement is planned. The basis for the SPI's mandate in each type of campus is discussed in the article University SPI<\/a>.<\/p>\n\n\n\n

Which Models Can Be Used?<\/h2>\n\n\n\n
Model<\/th>Issuer<\/th>Structure<\/th>Notes on use<\/th><\/tr><\/thead>
Internal Audit Capability Model (IA-CM) for the public sector<\/td>IIA Research Foundation, 2009, revised 2017<\/td>Five capability levels and six internal audit elements, with key process areas in each cell<\/td>Used for self-assessment and setting the direction of improvement. Not a legal requirement.<\/td><\/tr>
APIP Capability Model<\/td>BPKP (BPKP Regulation 6\/2025)<\/td>Five levels and five elements, broken down into topics<\/td>Intended for APIP at ministries, agencies, and regional governments. Replaces BPKP Regulation 8\/2021.<\/td><\/tr>
Quality assurance and improvement program (GIAS Standards 8.3, 8.4, 12.1, 12.2)<\/td>IIA, GIAS 2024<\/td>Ongoing and periodic internal assessment, external assessment at least once every five years, and performance measurement<\/td>Applies to SPIs that adopt the GIAS through a charter or campus policy<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The three complement each other. The IA-CM and the APIP Capability Model answer “what level are we at”, while the GIAS answers “how is quality maintained continuously and tested by outside parties”.<\/p>\n\n\n\n

What Is the Structure of the IA-CM?<\/h2>\n\n\n\n

The IA-CM arranges capability in a matrix: the vertical axis is the five levels and the horizontal axis is the elements of internal auditing. The five levels are commonly called initial<\/em>, infrastructure<\/em>, integrated<\/em>, managed<\/em>, and optimizing<\/em>. The six elements are internal audit services and role, people management, professional practices, performance management and accountability, organizational relationships and culture, and governance structures. Each cell of the matrix contains key process areas that must be met for a level to be achieved.<\/p>\n\n\n\n

As of October 21, 2026, I found no IIA announcement of a new IA-CM edition after the 2017 revision in the sources I reviewed. Check the IIA or Internal Audit Foundation site for the latest edition and assessment tool.<\/p>\n\n\n\n

What Is the APIP Capability Model from BPKP?<\/h2>\n\n\n\n

BPKP Regulation 6\/2025 on Improving the Capability of APIP at Ministries, Agencies, and Regional Governments sets five levels and five elements:<\/p>\n\n\n\n

Level<\/th>Short description in the regulation annex<\/th><\/tr><\/thead>
1 Initiating<\/td>Sporadic oversight without a plan, no system or methodology yet<\/td><\/tr>
2 Structured<\/td>Oversight is based on structure and procedures, but quality and consistency are still low<\/td><\/tr>
3 Adequate<\/td>Risk-based internal oversight that gives reasonable assurance, including early warning of fraud<\/td><\/tr>
4 Integrated<\/td>Oversight results are convergent and provide insight to top stakeholders, with attention to strategic risks<\/td><\/tr>
5 Optimal<\/td>A role model and guide to achieving organizational goals, with real-time oversight information<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The five elements are quality of role and services, engagement professionalism, oversight management, performance and resource management for oversight, and culture and organizational relationships. The regulation is aimed at APIP, namely BPKP, inspectorates general, provincial inspectorates, and regency or city inspectorates (Government Regulation 60\/2008 Article 49). A university SPI is not automatically included, but the structure of its levels and elements can serve as a comparison reference. The SPI's relationship with APIP is discussed in the article SPI coordination with the audit committee, board of trustees, inspectorate, and BPK<\/a>.<\/p>\n\n\n\n

Government Regulation 60\/2008 Article 55 also provides for periodic peer review to maintain the quality of APIP audit results, with guidelines prepared by the auditor professional organization.<\/p>\n\n\n\t\t

\n\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"cta\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\n\n\n\n

What Do the GIAS and BLU Regulations Require on SPI Quality?<\/h2>\n\n\n\n