Quality Management in the Internal Audit Function
Inside the audit function, quality management operates at two levels: the engagement level and the function level. Engagement-level controls include supervision, working-paper review, and sign-off before a report is issued. Function-level controls include policies and manuals, resourcing and competence management, and periodic performance measurement.
Supervision is the connective tissue. It should be proportionate to the experience of the auditor and the risk of the engagement, and it must be documented so a reviewer can see what was reviewed, by whom, and when. A common exam trap is assuming review must happen only at the end; effective supervision is continuous and includes coaching during fieldwork. Another trap: confusing supervisory review (a management control performed as work progresses) with quality assessment (an evaluation of conformance).
Competence management includes recruitment, continuing professional development, and periodic skills assessment. Objectivity safeguards - rotation, declaration of interests, restrictions on operational duties - are also quality controls because impaired objectivity degrades quality even when the paperwork is flawless.
Worked example: a new auditor drafts a high-risk procurement engagement. Supervision should include an early planning review, mid-fieldwork check-ins, a documented working-paper review before the draft report, and evidence the reviewer's comments were resolved. If the file shows only a signature on the final report, the supervision is deficient regardless of the conclusion reached.
Rule of thumb: if a quality control leaves no evidence, treat it as not performed.