Internal Quality Assessment That Finds the Reviewers Asleep
Brightpath Insurance's internal audit activity has nine auditors and completed 15 engagements last year. The CAE is preparing for an external quality assessment next year and runs an internal quality review of six files. Results: three files have no evidence of supervisory review before the draft report was issued; two used a sampling template that selected 60 items from a population of 4,800 but documented no basis; one file's workpapers were dated after the report; and the client survey average is 3.1 out of 5, with comments about auditors who do not understand underwriting. Two of the nine auditors do not hold a relevant qualification, and continuing professional education records show an average of 12 hours per auditor, with no fraud-related training in two years. The CAE's own engagement file was not reviewed. The audit committee charter requires conformance with the IPPF and an annual internal assessment.
1. Identify the conformance issues and their severity under the quality assurance standards.
Read the worked answer
The file review shows conformance problems, not just housekeeping. Three files with no evidence of supervisory review before the draft report indicate a failure of engagement supervision and review, which goes to the reliability of the conclusions. Two files with a 60-item sample from 4,800 and no documented basis raise a planning and evidence issue: the sample may be defensible, but without the basis the file cannot show that it was. A workpaper dated after the report suggests the file was completed retrospectively, which undermines the evidence trail. The CAE's own file was not reviewed, so the internal assessment has a self-review gap. The 12-hour CPE average and lack of fraud training raise a competence question, especially for an insurance audit activity. The client survey score and comments point to communication and business-understanding gaps, which are quality issues but less severe than unreviewed reports. The CAE should classify these by severity and root cause, not merely count them; unreviewed reports and retrospective workpapers are significant and should be remediated before the external assessment.
2. Design a quality assurance and improvement program that would prevent recurrence, including roles, timing, and metrics.
Read the worked answer
Build the QAIP around prevention, detection, and correction. Prevention: a pre-issuance review gate with documented reviewer sign-off; templates that require the sampling basis and population definition; workpaper standards that require contemporaneous dating; and a CPE plan that covers insurance underwriting, fraud, and data analytics. Detection: ongoing supervision on every engagement, plus periodic file reviews selected on risk rather than six convenient files, including a review of the CAE's file by an independent qualified reviewer, such as a peer CAE or co-sourced firm. Correction: a remediation log with root cause, owner, due date, and retest; report results to the audit committee. Metrics should include percentage of files with pre-issuance review, review notes closed before report, sampling documentation completeness, CPE compliance, survey trends, and repeat issues. This is continuous improvement: the results should change the next cycle's review scope. The external assessment should be used as a check, not the first real review.
3. How should the CAE report the internal assessment results to the audit committee, including the gap involving the CAE's own file?
Read the worked answer
Report the internal assessment in writing with scope, methodology, sample selection, results, severity, root cause, and remediation plan. Disclose the three unreviewed files, the sampling documentation gaps, the workpaper dating issue, the CPE shortfall, and the survey results. Do not omit the CAE's own file. If an independent reviewer has not yet reviewed it, state that limitation and say when the review will occur; better, arrange the independent review before the committee meeting. Explain what will change and who owns it. The audit committee should also be told whether the issues affect any issued reports and whether re-performance is needed. Transparency here protects the credibility of the external assessment. The CAE should ask the committee to note the plan and to approve any co-sourcing or peer review needed. Self-certification without disclosure would be inconsistent with the quality standards and would weaken the committee's trust.