A Quality Program Held Together by a Checklist
Metro Transit Authority's internal audit activity has four auditors and a co-sourced CAE three days a week. It completed 18 engagements last year. Working papers are stored in shared folders; only two engagements have documented supervisory review, and one contains an unsigned review note questioning a $2.4 million revenue sample. The CAE's self-assessment checklist is a copy of last year's and has no engagement-level testing. Client surveys average 3.1/5 on 'timely communication.' An external quality assessment is required this year. The CFO says a full external assessment is unnecessary and proposes a one-day peer review by a former colleague. The audit committee asks the CAE for a QAIP status report and wants to know whether the activity 'conforms' with the Standards. The CAE has a $25,000 budget and 60 days.
1. Does Metro Transit Authority's current QAIP satisfy the requirements for internal and external assessments? Identify the specific gaps and the effect on the CAE's ability to state conformance.
Read the worked answer
The QAIP is not functioning as a quality program. A QAIP should cover all engagements and include ongoing supervision, periodic internal assessments, and an external assessment at least every five years. Here, only two of 18 engagements have documented supervisory review, and one review note is unsigned. That is evidence that review is not occurring consistently or is not being completed. Shared folders without version control or sign-off further weaken evidence of supervision.
The self-assessment is not a credible periodic internal assessment. Copying last year's checklist and omitting engagement-level testing means the CAE is not evaluating work against methodology, evidence, or reporting requirements. Client surveys are useful feedback but cannot substitute for technical review. A 3.1/5 score on timely communication may signal a process problem, but it is not a conformance test.
External assessment is not optional. The CFO's proposal for a one-day peer review by a former colleague is unlikely to meet the requirement if it is too limited in scope, lacks independence, or does not evaluate the full activity against the Standards and Code of Ethics. A former colleague may also create a familiarity threat. The review must be performed by a qualified, independent assessor or team, and it must cover the QAIP, engagement work, and reporting.
Conformance cannot be asserted on this evidence. The CAE should avoid saying the activity 'conforms' until the gaps are assessed and remediated. If an external assessment has not yet occurred and internal monitoring is incomplete, the honest statement is that conformance is not yet demonstrated, with a plan and timeline. Overstating conformance would mislead the audit committee and undermine the QAIP's purpose.
2. Evaluate the CFO's proposed one-day peer review and the CAE's options for the external assessment. What characteristics must the reviewer or team have, and what should be reported?
Read the worked answer
The one-day peer review is probably insufficient. A one-day review may be useful as a gap assessment or readiness exercise, but it is unlikely to provide the scope, evidence, and independence of a full external quality assessment. The reviewer must be qualified in internal auditing and the relevant industry or technical areas, independent of the activity and the organization, and free from conflicts such as a close prior relationship with the CAE. A former colleague can be independent in an organizational sense, but the familiarity threat must be evaluated and documented.
Options. The strongest option is a full external assessment by a qualified independent assessor or team. A second option is a self-assessment with independent validation, if the validation is performed by a qualified independent reviewer and covers the same scope. The CAE should not label a limited peer review as an external assessment if it does not test conformance with the Standards and the Code of Ethics.
Minimum characteristics: independence from the internal audit activity and its management; competence in internal audit, governance, risk, and control; a defined scope including the QAIP, engagement planning, fieldwork, reporting, and follow-up; access to working papers and staff; and a written report.
Reporting. The results should go to the CAE, senior management, and the audit committee. The report should describe the scope, the conclusion on conformance, significant deficiencies, and recommendations. If the review is limited, the report must say so and must not be presented as a full external assessment. The CAE should also prepare an action plan with owners and dates for each finding.
3. Draft the core contents of the CAE's QAIP status report and improvement plan to the audit committee. Include how to handle the unsigned review note and the conformance statement.
Read the worked answer
Status report structure. The report should cover: the QAIP's scope and governance; the results of ongoing and periodic internal assessments; the status of the external assessment; key quality indicators such as review completion, report timeliness, and client feedback; significant gaps; root causes; resource constraints; and the remediation plan with owners, dates, and evidence of completion.
Handle the unsigned review note before reporting closure. The CAE should determine whether the note was resolved, whether the $2.4 million revenue sample was properly tested, and whether the engagement conclusion is affected. If the review was incomplete, the work should be re-performed or independently reviewed. The file should contain a signed, dated review record. The audit committee should be told what happened and what was done, without minimizing it.
Conformance statement. The CAE should state conformance only if the evidence supports it across the activity. If significant gaps remain, the report should say that conformance is not yet demonstrated or that the activity does not conform in specific areas, followed by the remediation plan. A vague 'substantially conforms' should be avoided unless the meaning is defined and supported.
Improvement plan priorities: implement engagement-level supervisory checklists and sign-offs; require documented review before report issuance; perform periodic internal assessments on a sample of engagements; replace the stale self-assessment with risk-based testing; establish quality metrics; obtain audit committee support for an independent external assessment or validated self-assessment; and report progress quarterly. The plan should be realistic for four auditors and a part-time CAE, with the audit committee informed of resource trade-offs.