Quality Assurance, Continuous Improvement, and Audit Management
Quality and management items test the quality program architecture and the CAE's operational duties: planning, resourcing, policies, coordination and board reporting.
Core rules
- Standard 1300 requires a quality assurance and improvement program covering all aspects of the internal audit activity and designed to add value.
- 1310 internal assessments combine ongoing monitoring (supervision, workpaper review, checklists, cycle-time metrics) with periodic self-assessments.
- 1312 requires an external assessment at least once every five years by a qualified, independent assessor or team from outside the organization.
- 1320 reports quality program results to senior management and the board; 1321 permits a statement of conformance only where those results support it; 1322 requires disclosure of significant nonconformance and its impact.
- Management duties under 2000 include risk-based plans (2010), policies and procedures (2040), resource management (2030), coordination with other assurance providers (2050) and reporting to the board (2060).
Worked example
An external assessment finds 30 percent of workpapers were never reviewed. This is an activity-level supervision weakness. The CAE performs root-cause analysis (reviewer capacity), sets dated corrective actions, discloses the nonconformance and impact in the quality report to the board, and defers a blanket "conforms" statement until remediation is verified. Had the gap affected one engagement only, disclosure would belong in that engagement's report instead.
Traps
Self-conducting the mandatory external assessment; treating the quality program as only post-engagement review; claiming conformance while corrective action is open; measuring plan completion while ignoring engagement quality.