1.9 QUALITY ASSURANCE AND IMPROVEMENT PROGRAM(QAIP)
Attribute Standard 1300 Quality Assurance and Improvement Program
The chief audit executive must develop and maintain a quality assurance and improvement covers all aspects of the internal audit activity.
1. Quality Assurance and improvement Program (QAIP)
a) Practice Advisory 1300-1, Quality Assurance and Improvement Program, provides guidance for internal audit activities in the continuous examination of their processes and efforts to meet the needs of stakeholders.
1) The CAE implements processes designed to provide reasonable assurance to stakeholders that the internal audit activity a) Performs in accordance with its charter, the Definition of internal Auditing, the Code of Ethics, and the Standards
b) Operates effectively and efficiently
c) Is perceived as adding value and improving operations
2) These processes include appropriate supervision, periodic internal and external assessments, and ongoing monitoring of quality assurance.
3) The QAIP embraces all facets of the internal audit activity as reflected in the pronouncements of the IIA and best practices of the profession.
a) Its processes are performed or supervised by the CAE.
b) A large or complex entity has a formal, independent QAIP administered and monitored by an audit executive.
Attribute Standard 1310
Requirements of the Quality Assurance and Improvement Program
The quality assurance and improvement program must include both internal and external assessments.
b. Practice Advisory 1310-1, Requirements of the Quality Assurance and improvement Program, provides detailed guidance:
1) A QAIP is an ongoing periodic assessment of all work by the internal audit activity. These rigorous assessments include
a) Continuous supervision and testing of performance.
b) Periodic validation with mandatory IIA guidance.
c) Measurement and analysis of performance metrics (e.g., audit plan accomplishment and customer satisfaction).
2) Indicated improvements are implemented by the CAE through the QAIP.
3) Assessments evaluate and state concussions about the quality of the internal audit activity and produce recommendations. QAlPs evaluate
a) Conformance with mandatory IA guidance;
b) Adequacy of the internal audit activity's charter, objectives, policies, and procedures;
c) The contribution to risk management, control, and governance;
d) Compliance with laws, regulations, and government or industry standards;
e) Continuous improvement and adoption of best practices, and
f) Whether the internal audit activity adds value and improves operations.
4) QAIP efforts include follow-up involving appropriate and timely modification of resources, processes, procedures, and technology.
5) The results of assessments are communicated to stakeholders. The CAE reports to senior management and the board on QAlP efforts at least a annually.
Attribute Standard 1311
Internal Assessments must include
* ongoing monitoring of the performance of the internal audit activity; and
* Periodic self-assessments or assessments by other persons within the organization with sufficient knowledge of internal audit practices.
2. Internal Assessments
a. Ongoing and periodic internal assessments are addressed in Practical Advisory 1311-1, Internal Assessment
1) The processes and tools used in ongoing internal assessments include
a) Engagement supervision;
b) Checklists and procedures;
c) Feedback:
d) Peer reviews of working papers;
e) Budgets, timekeeping, and tracking of audit plan completion and cost recoveries, and
f) Analyses of other performance metrics.
2) The IIA’s Quality Assessment Manual is a basis for periodic internal assessments. These may involve
a) More thorough feedback from stakeholders (in interviews and surveys) than in ongoing assessment,
b) Self- assessment,
c) Assessment by audit professionals (e.g., CIAs).
d) A combination of self- assessment and preparation of materials to be reviewed by audit professionals, and
e) Benchmarking against best practices.
3) A periodic internal assessment may facilitate and reduce the cost of an external assessment performed shortly afterward.
a) But the results should not communicate assurance about the outcome of the external assessment, although the report may give recommendations enhance practices.
b) Moreover, the periodic internal assessment may be the self-assessment part of a self-assessment with independent validation.
4) After an ongoing or periodic internal assessment, conclusions about performance are reached, and appropriate action is begun to ensure improvements are made.
5) Those conducting internal assessments generally report directly to the CAE, who should establish a structure for reporting results that maintains credibility and objectivity.
6) At least annually, the CAE reports results, action plans, and implementation information to senior management and the board.
Attribute Standard 1312
External Assessments
External assessments must be conducted at least once every five years by a qualified independent assessor or assessment team form outside the organization. The chief audit executive must discuss with the board:
• The form and frequency of external assessments; and
• The qualifications and independence of the external reviewer or assessment team, including any potential conflict of interest.
3. External Assessments
a. External assessments provide an independent and objective evaluation of the internal audit activity's compliance with the Standards and Code of Ethics.
b Further specifics are provided in Practice Advisory 1312-1, External Assessment:
1) An external assessment may be a full assessment by a qualified, independent external reviewer or review team. It also may be an internal self-assessment with independent validation by such a reviewer or team.
a) An external assessment covers all work by the internal audit activity.
b) The scope of work should include benchmarking, identification, and reporting of best practices.
c) The scope must clearly state the expected deliverables.
2) Individuals who perform the external assessment should have no obligation to, or interest in, the organization assessed or its personnel. External assessors have no real or apparent conflict of interest due to current or past relationships with the organization.
a) Matters relating to independence include conflicts of former employees or of firms providing (1) the financial statement audit, (2) significant consulting services, or (3) assistance to the internal audit activity
b) An individual in another part of the organization or in a related organization (e.g., a parent or an affiliate) is not independent.
c) Peer review among three unrelated organizations(but not between two) may satisfy the independence requirement.
d) Given concerns about independence, one or more independent individuals may provide separate validation.
3) Integrity is honesty and candor limited by confidentiality, with no subordination of service and the public trust to personal gain
a) objectivity is impartiality, intellectual honesty. and freedom from conflicts of interest.
4) An external reviewer should be a certified audit professional well versed Standards and best practices with at least years management experience in internal auditing or related consulting.
a) Leaders of independent review teams and those who validate a self-assessment must have additional experience.
i) Qualifications include prior external assessment work, quality assessment training, or service as a senior internal auditor.
5) The reviewer(s) should have relevant technical and industry experience, and other specialists may be needed
6) Senior management and the board are involved in selecting (a) the approach and (b) the external quality assessment provider.
7) The scope of the review extends to conformance with mandatory guidance of The IIA, the internal audit activity's charter, laws, etc. It also extends to
a) The expectations of management and the board,
b) Integration of the internal audit activity with the governance process,
c) The internal audit activity's tools and techniques,
d) Competence(mix of the staffs knowledge, experience, and disciplines) and
e) Whether the internal audit activity adds value and improves operations
8) Preliminary results are discussed with the CAE. Final results are communicated to the CAE, and a formal communication is given to senior management and the board.
9) The communication includes an opinion on conformance with the mandatory guidance of The IIA. Conformance means the practices of the internal audit activity satisfy such guidance.
a) Nonconformance means the internal audit activity's ability to discharge its responsibilities is impaired.
i) The degree of partial conformance is express if relevant.
b) Expression of an opinion requires sound business judgment, integrity, and due professional care.
c) The communication also includes (1) an evaluation of the use of best practices, (2) recommendation and (3) CAE responses regarding action plans and implementation dates.
10) The results, including specific planned actions and information about their accomplishment, are communicated to stakeholders of the internal audit activity (e.g. senior management, the board, and external auditors).
a) The purpose is to provide accountability and transparency.
4. Reporting Results
a. senior management and the board must be kept informed about the extent to which the internal au activity achieves the degree of professionalism required by The IIA.
Attribute Standard 1320
Reporting on the Quality Assurance and Improvement Program
The chief audit executive must communicate the results of the quality assurance and m program to senior management and the board.
b. This excerpt from the Interpretation of Standard 1320 addresses the fr