What is a QAIP?
A QAIP is established by the chief audit executive (CAE) to evaluate and ensure the internal audit function conforms with the Standards, achieves performance objectives, and pursues continuous improvement. The program includes internal and external assessments. Under Principle 8 – Overseen by the Board, the board receives assurance about the quality of the performance of the CAE and the internal audit function through the QAIP, including the board’s direct review of the results of the external quality assessment. Under Principle 12 – Enhance Quality, quality is a combined measure of conformance with the Standards and the achievement of the internal audit function’s performance objectives, which is a key element of a QAIP.
Which Standards related to a QAIP are evaluated during a quality assessment?
8.3 Quality
The chief audit executive must develop, implement, and maintain a QAIP that covers all aspects of the internal audit function. At least annually, the CAE must communicate the results of the internal quality assessment to the board and senior management. The results of external quality assessments must be reported when completed. In both cases, such communications include:
- The internal audit function’s conformance with the Standards and achievement of performance objectives.
- If applicable, compliance with laws and/or regulations relevant to internal auditing.
- If applicable, plans to address the internal audit function’s deficiencies and opportunities for improvement.
8.4 External Quality Assessment
The CAE must develop a plan for an external quality assessment and discuss the plan with the board. The external assessment must be performed at least once every five years by a qualified, independent assessor or assessment team. The requirement for an external quality assessment may also be met through a self-assessment with independent validation. When selecting the independent assessor or assessment team, the CAE must ensure at least one person holds an active Certified Internal Auditor® (CIA®) designation.
12.1 Internal Quality Assessment
The CAE must develop and conduct internal assessments of the internal audit function’s conformance with the Standards and progress toward performance objectives. The CAE must establish a methodology for internal assessments, as described in Standard 8.3 Quality, that includes:
- Ongoing monitoring of the internal audit function’s conformance with the Standards and progress toward performance objectives.
- Periodic self-assessments or assessments by other persons within the organization with sufficient knowledge of internal audit practices to evaluate conformance with the Standards.
- Communication with the board and senior management about the results of internal assessments.
Based on the results of periodic self-assessments, the CAE must develop action plans to address instances of nonconformance with the Standards and opportunities for improvement, including a proposed timeline for actions. The CAE must communicate the results of periodic self-assessments and action plans to the board and senior management.
12.2 Performance Measurement
The CAE must develop objectives to evaluate the internal audit function’s performance. The CAE must consider the input and expectations of the board and senior management when developing the performance objectives. The CAE must develop a performance measurement methodology to assess progress toward achieving the function’s objectives and to promote the continuous improvement of the internal audit function. When assessing the internal audit function’s performance, the CAE must solicit feedback from the board and senior management as appropriate. The CAE must develop an action plan to address issues and opportunities for improvement.
12.3 Oversee and Improve Engagement Performance
The CAE must establish and implement methodologies for engagement supervision, quality assurance, and the development of competencies.
- The CAE or an engagement supervisor must provide internal auditors with guidance throughout the engagement, verify work programs are complete, and confirm engagement workpapers adequately support findings, conclusions, and recommendations.
- To assure quality, the CAE must verify whether engagements are performed in conformance with the Standards and the internal audit function’s methodologies.
- To develop competencies, the CAE must provide internal auditors with feedback about their performance and opportunities for improvement.
The extent of supervision required depends on the maturity of the internal audit function, the proficiency and experience of internal auditors, and the complexity of engagements.
The CAE is responsible for supervising engagements, whether the engagement work is performed by the internal audit staff or by other service providers. Supervisory responsibilities may be delegated to appropriate and qualified individuals, but the CAE retains ultimate responsibility.
These standards ensure that the internal audit activity is continuously improving and conforming to the highest professional standards.
About IIA Quality Services
IIA Quality Services’ mission is to Elevate Internal Audit Quality Around the World by elevating professionalism within internal auditing and conformance to the Global Internal Audit Standards™ by providing expert resources, insight and assessment services to internal audit functions. IIA Quality Services’ experts provide full-scope external quality assessments, validations of self-assessments, and gap assessments.
Need further insights into your QAIP? Let IIA Quality Services be your trusted advisor. theiia.org/Quality