The Overloaded QAIP Coordinator
A five-person internal audit team in a mid-sized water utility has a QAIP that exists mostly on paper. The audit manager, who also serves as the QAIP coordinator, performs all engagement-level reviews herself. Last year she reviewed 11 of 14 engagements, but her review notes for 6 of them consisted only of the phrase 'looks fine.' The chief audit executive (CAE) wants to claim conformance with the attribute standards on quality and has asked you, an external consultant, to assess the QAIP. The manager says, 'We have a QAIP - we review every engagement and we have a charter.' The team has no documented QAIP manual, no supervision checklists, and no metrics. The CAE is under board pressure to show a clean QAIP before the next audit committee meeting in six weeks.
1. Identify the most significant structural weakness in this QAIP and explain why the manager's claim of 'we have a QAIP' does not withstand scrutiny.
Read the worked answer
The core weakness is that the QAIP is not designed, documented, or resourced as a program - it is a set of informal habits. A defensible QAIP requires:
- Documented policies and procedures covering the full range of QAIP activities (not just engagement review).
- Defined roles and competencies for those performing quality work, with independence from the work being reviewed.
- Consistent, evidenced review with substantive conclusions, not one-line sign-offs.
- Ongoing monitoring metrics and a mechanism to escalate and remediate deficiencies.
Here, the coordinator reviews her own team's work with no independence safeguard, the review content is vacuous ('looks fine'), and there is no manual, checklist, or metric. The manager is conflating the existence of an activity with an effective program. Under a maturity lens, this is ad hoc/repeatable at best, not defined or managed. The charter alone establishes authority, not quality.
2. The CAE asks whether the team can be 'conformant' in time for the board meeting. Draft the guidance you would give, including what can realistically be achieved in six weeks and what cannot.
Read the worked answer
Be direct with the CAE about the difference between remediation progress and conformance.
Achievable in six weeks:
- Draft a QAIP manual defining scope, roles, review criteria, and escalation.
- Introduce a substantive engagement-review checklist with required evidence of conclusions.
- Establish a small set of ongoing-monitoring metrics (e.g., review completion rate, review depth, remediation closure time).
- Separate the reviewer role from the reviewed work where feasible (e.g., peer review or CAE review of the manager's own engagements).
- Document a remediation plan with owners and dates.
Not achievable in six weeks:
- A credible claim of full conformance. Six weeks of new activity does not demonstrate that the program is operating effectively over time.
- A completed internal assessment of the QAIP with meaningful evidence.
Recommendation: Report to the board honestly - describe the gap, the remediation plan, and a target date for an internal assessment. Overstating conformance to satisfy board pressure is itself a quality failure and a governance risk.
3. The manager argues that because she is the most experienced auditor, she should remain the sole reviewer. Evaluate this argument.
Read the worked answer
Experience is necessary but not sufficient, and it is being used to justify a conflict of interest and a single point of failure.
- Independence: Reviewing work she supervised or performed compromises objectivity. Even where she did not perform the work, she is accountable for it.
- Coverage and depth: One person cannot provide substantive review across all engagements without becoming a bottleneck - evidenced by the one-line notes.
- Sustainability: If she leaves, the QAIP collapses. A program should be institutionalized, not person-dependent.
Better design: retain her expertise as a technical resource, but introduce layered review (engagement-level self-review, peer review, CAE review of high-risk engagements) and rotate reviewers. Her experience should inform the criteria and coaching, not monopolize the review function.