CIAQM cheat sheet

Quality management = coordinated activities to direct and control an organization with regard to quality (planning, control, assurance, improvement).

Deming's PDCA: Plan (set objectives), Do (implement), Check (monitor/measure), Act (standardize or correct) - the improvement cycle underlying most QM frameworks.

ISO 9000 defines quality as the degree to which a set of inherent characteristics fulfills requirements; 'grade' is a separate category of requirement level.

ISO 9001 is built on seven principles: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, relationship management.

Juran's trilogy: quality planning, quality control, quality improvement - three managerial processes spanning the quality lifecycle.

Crosby: quality means conformance to requirements; the measure is cost of nonconformance, and the goal is 'zero defects'.

Cost of quality splits into conformance (prevention + appraisal) and nonconformance (internal + external failure); total CoQ = all four categories.

Process approach: inputs → activities → outputs with controls and resources; understanding process interactions is required for consistent results.

The chief audit executive (CAE) is responsible for the internal audit activity's quality management program, including resourcing and reporting results.

IIA Standard 1100 requires the CAE to develop and maintain a quality assurance and improvement program covering all aspects of the internal audit activity.

Independence and objectivity are foundational: quality management must not be structured so that engagement supervisors assess their own work without escalation.

Engagement-level quality control includes proper planning, supervision, working paper review, and evidence standards before report issuance.

The CAE must confirm annually to senior management and the board the organizational independence of the internal audit activity.

Internal assessments include ongoing monitoring of engagements plus periodic self-assessments; both feed the QAIP and improvement actions.

Quality management covers the full audit lifecycle: risk assessment and plan, engagement execution, communication, and follow-up on recommendations.

The CAE must disclose any nonconformance with the Code of Ethics or Standards that affects the activity's conclusions or operations.

QAIP scope is all-encompassing: it covers every aspect of the internal audit activity's operations and is not limited to individual engagements.

QAIP components: (1) internal assessments - ongoing monitoring and periodic self-assessments; (2) external assessments; (3) reporting and follow-up on results.

Ongoing monitoring is the day-to-day supervision, review, and measurement of engagements; it is continuous and performed by the audit activity itself.

Periodic self-assessments are conducted at planned intervals (typically annually) and may include self-assessment tools or peer review by internal staff.

Internal assessments must be performed at least annually and results reported to the board; the QAIP is reviewed for continued adequacy.

The QAIP must include an action plan to address identified deficiencies and a process to monitor and verify remediation.

An 'internal assessment' is not the same as an 'internal audit of the QAIP'; both can exist, but only the former is a required QAIP element.

Documentation of QAIP design, execution, and results must be retained to support the CAE's annual conclusion on conformance.

External assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization.

An external assessment may be a full external assessment or a self-assessment with independent external validation; both satisfy the requirement.

Independence for external assessment means no conflict of interest and no obligation to, or affiliation with, the organization or its audit activity.

External assessors must possess competence in internal auditing and knowledge of the IIA Standards; the CAE cannot dictate the assessment's conclusions.

Internal assessments consist of ongoing monitoring plus periodic self-assessments; they are required regardless of whether an external assessment is performed.

The external assessment report provides an overall opinion and grades conformance: 'generally conforms', 'partially conforms', or 'does not conform'.

'Generally conforms' means the activity meets the intent of all Standards with only minor deficiencies; 'does not conform' means significant deficiencies exist.

Results of external assessments, including the overall opinion, must be reported to senior management and the board.

The CAE must report QAIP results to senior management and the board, including scope, conclusions, and any nonconformance with the Standards.

Reporting must disclose the results of both internal and external assessments, plus the status of improvement plans and remedial actions.

Any nonconformance that affects the internal audit activity's ability to fulfill its mandate must be communicated promptly and escalated to the board.

Communication should be timely, objective, clear, and aligned with the audience: operational detail for management, governance-level summary for the board.

Continuous improvement is embedded in the QAIP cycle: measure → identify deficiency → plan action → implement → verify → re-measure.

Deficiencies must be tracked to closure; unresolved items are re-reported and escalated if remediation timelines slip.

The CAE's annual report should state whether the activity conforms with the Code of Ethics and the Standards, based on QAIP evidence.

Improvement metrics (cycle time, review findings, conformance scores) should be defined in advance so progress is measurable and comparable over time.