TIAPS ALB_Module 2C. Quality Assurance

2C. Quality Assurance
2C Learning Outcomes
On completion of this section, students will be better able to:
• Describe processes for establishing and maintaining quality assurance.
• Evaluate internal audit performance.
• Evaluate the internal audit function.
2C.1 The Need for Quality Assurance
IIA Internal Audit Competency Framework: Quality Assurance and Improvement Program
General Awareness: Describe requirements of the Quality Assurance and Improvement
Program. Identify appropriate disclosure of conformance vs. nonconformance with The IIA’s
International Standards for the Professional Practice of Internal Auditing.
Applied Knowledge: Schedule and complete internal and external quality assessments to
meet requirements and report results. Formulate appropriate disclosures of conformance vs.
nonconformance with the Standards.
Expert: Assess the internal audit activity’s quality assurance and improvement practices and
assess conformance with the Standards. Assess the internal audit activity’s disclosures of
conformance vs. nonconformance with the Standards. 26
No amount of rigor, care, and attention can guarantee perfection. The goal of quality
assurance is to ensure internal audit services are fit for purpose, meaning they should meet
and ideally exceed stakeholder needs and expectations. The head of internal audit should
engage regularly with stakeholders and seek their feedback – formally and informally – on
their level of satisfaction. This can be achieved through structured surveys and discussions,
questionnaires issued to clients after completion of engagements, and via continuous
dialogue. In addition to the “pull” from customers, internal auditors should strive for
continuous improvement and innovation in everything they do. Even if we are doing well,
how can we do even better? The internal audit function is the champion of excellence and
must lead by example.
Quality assurance processes should operate at the individual engagement level as well as
the internal audit function level. The following table highlights the key components of a
quality assessment.
Engagement Level Quality Assessment
• Processes for planning, scoping, setting
objectives, and resourcing engagements.
• Conformance with the Standards.
• Quality of work undertaken.
• Processes used for follow-up.
• Feedback collected from auditees.
• Self-assessment conducted by auditors and
supervisors.
Internal Audit Activity Level Quality Assessment
• Policies and procedures for all technical and
administrative aspects.
• Conformance with the Standards.
• Conformance with policies and procedures.
• Alignment of work with the internal audit charter.
• Alignment with stakeholder needs and
expectations.
• Utilization of resources.
26
Internal Audit Competency Framework, The IIA, 2022.
44

They should be built-in rather than bolt-on, meaning the processes are integrated into
routine practices rather than something additional to be completed after the work is done.
Quality assurance refers to the way we do things rather than something extra we do.
There are many components contributing to quality.
• A commitment to continuous improvement as reflected in the internal audit strategic
plan and the behaviors of auditors, audit managers, and the head of the function.
• The competency of internal auditors as well as their training and continuing
professional education.
• The leadership and direction given by audit managers.
• Processes for audit and auditor supervision, performance evaluation, and feedback.
• The design and requirements of policies, manuals, and templates.
• Systematic reviews of every aspect both internally (through ongoing monitoring and
periodic self-assessment) and externally (sometimes referred to as EQA (external
quality assessment) or QAR (quality assessment review), conducted at least once
every five years, either as a full review or an independently validated selfassessment).
The approach, therefore, includes the need both to look backward in order to evaluate actual
performance and to look forward to set goals for improvement.
Aside from the requirements of the IPPF, internal audit functions may have additional
organizational requirements to follow. They may also choose to adopt other standards and
benchmarks, such as ISO. However, an important check on any quality system is a costbenefit
analysis. At some point, extra rigor can be counter-productive, adding bureaucracy
for limited gain in performance.
2C.1: Reflection
Why is quality assurance so important for internal audit?
What are the best ways of measuring the quality of internal audit?
Who is responsible for internal audit quality?
45

2C.2 Elements of Internal Audit Quality Assurance
There is no single blueprint for quality assurance. Procedures should be appropriate for the
size, resources, priorities, and maturity of the function and the needs and expectations of the
organization it serves. The IPPF sets minimum expectations but practices should be
relevant, right-sized, and tailored. It is about more than mere compliance with the wording of
the Standards. It requires a dedicated mindset to delivering superior services.
According to the International Professional Practices Framework, the quality assurance and
improvement program (QAIP) for the internal audit function should include:
• Ongoing and periodic assessment of all aspects of assurance and advisory services
provided.
• Rigorous, comprehensive processes.
• Continuous supervision and testing of work undertaken.
• Periodic validations of conformance with the Definition of Internal Auditing, the Code
of Ethics, and the Standards.
The head of the internal audit function is required to:
• Develop and maintain a quality assurance and improvement program (QAIP)
(Standard 1300 – Quality Assurance and Improvement Program).
• Discuss the form and frequency of external assessments and the qualifications and
independence of assessors with the board and encourage board oversight of
external assessments to reduce potential conflicts of interest (Standard 1312 –
External Assessments).
• Communicate results of the QAIP to senior management and the board (Standard
1320 – Reporting on the Quality Assurance and Improvement Program).
• Disclose any nonconformance with the Code of Ethics of Standards and its impact
with senior management and the board (1322 – Disclosure of Nonconformance).
Any quality program needs to be kept up to date, reviewed regularly, and adjusted as
internal and external conditions change.
The QAIP is intended to ensure the following, as described in the IIA’s Practice Guide:
Quality Assurance and Improvement Program:
• Conformance with the Definition of Internal Auditing, the Code of Ethics, and the
Standards.
• The adequacy of the internal audit activity’s charter, goals, objectives, policies, and
procedures.
• The contribution to the organization’s governance, risk management, and control
processes.
• Completeness of coverage of the entire audit universe.
• Compliance with applicable laws, regulations, and government or industry standards
to which the internal audit activity may be subject.
• The risks affecting the operation of the internal audit activity itself.
• The effectiveness of continuous improvement activities and adoption of best
practices.
46

• Whether the internal audit activity adds value, improves the organization’s
operations, and contributes to the attainment of objectives. 27
The external assessment (EQA/QAR) or validation of the self-assessment must be
conducted by a competent and independent party. Self-assessment with independent
validation is appropriate for smaller internal audit functions. Peer reviews must meet these
same requirements as follows:
• All members of the assessment team who perform the external assessment are to be
independent of that organization and its internal audit activity personnel. Real,
potential, and perceived conflicts of interest should be considered.
• Individuals from within the same private sector organization but from another
department or from a related organization (such as a parent organization, an affiliate
in a group of entities, or an entity with regular oversight) are not considered
independent for purposes of conducting an external assessment.
• Within the public sector, individuals working in separate internal audit activities in a
different entity within the same tier of government may be considered independent
for purposes of conducting external assessments, as long as they do not report to the
same CAE.
• Two organizations may not review each other mutually. 28
The outcome of an external review or validation can be expressed in several ways.
• IIA Quality Assessment Manual Scale:
o Does Not Conform.
o Partially Conforms.
o Generally Conforms. 29
• IIA Capability Model for the Public Sector:
o Initial.
o Infrastructure.
o Integrated.
o Managed.
o Optimizing. 30
• DIIR (IIA–Germany) Guideline for Conducting a Quality Assessment:
o 3–Satisfactory.
o 2–Room for Improvement.
o 1–Significant Improvement Needed.
o 0–Unsatisfactory.
o Not Applicable. 31
• IIA Ambition Model:
o 1 – Initial.
o 2 – Infrastructure.
o 3 – Integrated.
o 4 – Managed.
o 5 – Optimizing. 32
27
Practice Guide: Quality Assurance and Improvement Program, The IIA, 2012.
28
Practice Guide: Quality Assurance and Improvement Program, The IIA, 2012.
29
The Institute of Internal Auditors’ Quality Assessment Manual for the Internal Audit Activity, 6th Edition.
30
Internal Audit Capability Model (IA-CM) for the Public Sector, The IIA,
31
Guidelines for Conducting a Quality Assessment (QA), Deutsches Institut für Interne Revision e.V. (IIA –Germany), 2007.
47

2C.2: Reflection
Is your internal audit unit in full conformance with IIA Standards?
Which Standards are the hardest to conform with and why?
Are some Standards more important than others when you consider the priorities for your
organization?
Do your stakeholders know the quality assurance and improvement program for the
internal audit unit?
Have you ever used one or more of the models referenced (IIA Quality Assessment
Manual, IIA Capability Model for the Public Sector, DIIR Guideline for Conducting a Quality
Assessment, and IIA Ambition Model) for a self-assessment or peer assessment of the
internal audit unit?
32
Global Perspectives & Insights, From Conformance to Ambition: Applying the Internal Audit Ambition Model, The IIA, 2020.
48