An EQA Approaching While Quality Deficiencies Are Known
The CAE of a federal department is preparing for an external quality assessment (EQA) in eight months. A self-assessment finds that 20% of engagement files lack evidence of supervisory review; one high-risk IT engagement issued a report with an overall satisfactory rating while the workpapers recorded an unresolved scope limitation; and 6 of 12 recommendations from last year have no follow-up evidence. The EQA provider offers a pre-assessment gap review. The minister's office asks for the EQA results before they are final. The audit committee chair wants a clean opinion and suggests limiting the EQA scope to engagements completed after the new methodology was adopted. The CAE has one quality assurance manager who also leads engagements. The department's charter requires an EQA every five years; the last one was six years ago.
1. Evaluate the self-assessment findings against QAIP requirements and identify root causes and risks.
Read the worked answer
The findings point to failures across the QAIP, not isolated paperwork. Twenty percent of files without supervisory review means engagement supervision is not consistently evidenced, so the activity cannot demonstrate conformance. The satisfactory rating despite an unresolved scope limitation is more serious: it suggests the report did not reflect the workpapers, which undermines reporting integrity and may mislead the audit committee. Six of twelve recommendations without follow-up evidence means monitoring is not operating.
Root causes may include the new methodology, insufficient review capacity, the QA manager's dual role, pressure to issue favorable ratings, and weak tone at the top. The CAE should classify these as QA deficiencies, assess their effect on past engagements, and report them to the audit committee.
The self-assessment itself is useful, but it needs independent validation because the QA manager also leads engagements and may review their own work. The EQA will likely find the same issues; hiding them increases risk.
2. Recommend remediation actions and decisions about the EQA scope and the pre-assessment provider.
Read the worked answer
Remediation should address causes, not just add signatures. Conduct a retrospective review of high-risk files, prioritizing the IT engagement; determine whether the report needs correction or supplemental communication to the committee. Assign an independent reviewer who did not lead the engagement. Implement a review checklist with evidence of review before report issuance, a report-quality review step, and a follow-up tracker with owners and dates. Train supervisors and engagement leads on the new methodology and on scope limitations. Report progress quarterly to the audit committee with metrics.
On the EQA, do not limit the scope to post-methodology engagements; the EQA should cover the full period required by the charter and professional standards. A pre-assessment gap review can be useful, but if the same provider later performs the EQA, assess the self-review threat and use a different provider or clear safeguards. The EQA must be independent and objective.
3. How should the CAE respond to the minister's office and the audit committee chair?
Read the worked answer
Respond to the minister's office in writing: preliminary EQA results are confidential and not final; the report will be provided to the audit committee through the established process, and the minister will receive the final report as required by law or charter. Do not release draft results selectively.
To the chair, explain that the CAE cannot accept a scope limitation designed to produce a clean opinion; the EQA's scope is defined by the charter and professional requirements, not by the desired result. Offer the chair a remediation plan and regular progress reports instead. If the chair insists, document the request and escalate to the board or head of the entity, and seek legal advice.
The CAE should also avoid leading the QA response personally if it creates a self-review threat; use the QA manager only for engagements they did not lead, or bring in an independent reviewer. The goal is credible assurance, not a favorable label.