Quality Assurance and Improvement Program
QAIP questions test the mechanics of quality assurance: what the program must cover, how internal and external assessments differ, the five-year clock, the three conformance ratings, and who must be told about the results.
Program design
- Standard 1300: the CAE must develop and maintain a QAIP covering all aspects of the internal audit activity, providing reasonable assurance of conformance with the Standards and the Code of Ethics.
- The program also evaluates efficiency and effectiveness and identifies improvement opportunities; quality is about conformance, improvement about performance.
- Standard 1310: internal assessments include ongoing monitoring of engagements, such as supervision and workpaper review, plus periodic self-assessments.
- Ongoing monitoring is a CAE responsibility; every engagement is supervised and reviewed, not only those selected for a periodic self-assessment.
External assessment
- Standard 1312: an external assessment must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization.
- The clock runs from the date of the previous external assessment; a new CAE does not restart it, though a self-assessment with independent validation can be used in limited circumstances.
- Standard 1320: the CAE communicates results to the board and senior management; 1322 requires disclosure of any nonconformance that affects the activity's ability to perform its work.
- Conclusions use three ratings: generally conforms, partially conforms, does not conform. 'Generally conforms' is the expected baseline, not a perfect score.
Worked example
An audit committee asks whether the quality review done three years ago can be counted when the CAE left and a new CAE took over eight months ago. Yes. The requirement is five years from the last external assessment, and CAE turnover does not reset it. What the new CAE must do is ensure the next assessment is scheduled to stay within five years of the prior one and that internal assessments have continued in the interim.
Traps that cost marks
- Assuming the QAIP is only the external assessment, or only the annual review.
- Believing a peer organization's internal audit team is automatically ineligible; it can qualify if it is independent of the organization.
- Reporting results only to the CAE.
- Treating 'generally conforms' as a finding that requires remediation.