Quality Assurance and Improvement Program
Purpose and scope
A quality assurance and improvement program evaluates whether the internal audit activity conforms with the Definition of Internal Auditing and the Standards, and whether it adds value. It covers all aspects of the activity - assurance and consulting engagements alike - and it is mandatory, not optional.
Internal assessments
Two elements: ongoing monitoring (supervision, engagement-level reviews, checklists, client feedback) and periodic self-assessments, which are broader in scope and may be performed by the CAE or a designated team.
External assessments
An external assessment must be completed at least once every five years by a qualified, independent assessor or assessment team from outside the organization. Two acceptable forms exist: a full external assessment, or an internal self-assessment with independent external validation. The assessor must be competent in the profession and free of any real or apparent conflict of interest - a provider whose other contracts depend on management's goodwill, or a former partner now selling services to the organization, is not suitable.
Reporting and follow-up
Results, including the conclusion (generally conforms, partially conforms, or does not conform), go to senior management and the board, together with action plans for deficiencies. If nonconformance with the Code of Ethics or the Standards affects the activity's overall ability to perform its responsibilities, disclose it to senior management and the board, and consider disclosure to external parties such as regulators or the external auditor.
Traps
Three years instead of five; labelling a review by colleagues from another department as an external assessment; treating a QAIP as covering only completed engagements.
Rule of thumb
External means outside the organization, independent of it, and at least once every five years.