The External Assessment Scope Dispute
A regional credit union's internal audit function is preparing for its first external quality assessment (EQA). The CAE proposes to scope the EQA to the last 18 months of engagements and to exclude the two most recent engagements because they are 'still being finalized.' The function has 9 auditors, an active co-sourcing arrangement for IT audits, and a QAIP that was implemented 14 months ago. The proposed external assessor is a former partner of the firm that provides the co-sourced IT auditors. The audit committee chair asks you, as an independent advisor, whether the proposed scope and assessor are appropriate. The CAE notes that a narrower scope will reduce cost and finish before year-end.
1. Assess the proposed scope limitation. What should a defensible EQA scope cover, and why is excluding recent engagements problematic?
Read the worked answer
A defensible EQA scope should cover the full QAIP and the audit activity's conformance with the standards, not just a sample of completed engagements. Key points:
- The QAIP itself - its design, documentation, resourcing, and operating effectiveness - must be in scope, not only engagement outputs.
- Coverage period should be long enough to demonstrate sustained conformance and should be clearly stated; arbitrarily truncating to 18 months to save cost weakens the conclusion.
- Excluding the two most recent engagements is problematic because those are the most current evidence of how the function operates today. 'Still being finalized' is not a valid exclusion - the EQA can assess the engagement through its current stage, including supervision and review.
- Co-sourced work must be included, since the function is accountable for the quality of work performed on its behalf.
A scope that excludes current work and the QAIP design cannot support a conclusion on conformance. The cost saving is achieved by reducing assurance, which defeats the purpose.
2. Evaluate the proposed external assessor's independence and recommend how to proceed.
Read the worked answer
The proposed assessor has a clear independence problem: a former partner of the firm supplying co-sourced IT auditors creates a familiarity and self-interest threat. Even if the individual has left the firm, the relationship and reputational ties remain, and the co-sourced work is in scope.
Recommendation:
- Disclose the relationship to the audit committee and document the threat analysis.
- Either select a different assessor with no relationship to the co-sourcing firm, or, if the individual is retained, apply safeguards that the committee accepts (e.g., a different firm reviews the co-sourced IT work, and the assessor's prior firm relationship is disclosed in the report).
- Confirm the assessor's independence in writing before engagement.
The cleanest path is a different assessor. Independence is not a box to be managed around when a straightforward alternative exists.
3. The CAE wants to finish before year-end for budget reasons. How should you weigh timing against assessment quality?
Read the worked answer
Timing and budget are legitimate considerations but subordinate to the integrity of the conclusion.
- An EQA completed on a truncated scope, by an assessor with an independence issue, produces a conclusion the committee cannot rely on - and may need to be redone, costing more.
- If year-end is a hard constraint, options include: extending the timetable into the next period with a documented rationale, or conducting a phased assessment (interim findings now, full conclusion later) with the committee informed of the limitation.
- The CAE should present the trade-off to the audit committee rather than decide unilaterally.
Quality of assurance is the product being purchased; discounting it to meet a calendar is a false economy.