Quality Assurance and Continuous Improvement
This domain tests how the internal audit function assures conformance, measures its performance, and improves through internal and external assessment.
Core rules and concepts
- A quality assurance and improvement program covers all internal audit activities and provides reasonable assurance of conformance with the standards and effectiveness of the function.
- Internal assessments include ongoing supervision of engagements and periodic self-assessments of the function.
- External assessments occur at least every five years and must be performed by a qualified, independent assessor or assessment team. Internal staff cannot substitute for this independence.
- Results, including conformance conclusions and improvement actions, are communicated to the board and senior management.
- Performance measures should reflect quality and impact, such as remediation rates, cycle time, and stakeholder feedback, not only the number of reports issued.
- Improvement actions need owners, deadlines, and verification.
Worked example
A small audit team plans to satisfy its external assessment by asking a colleague from the finance department to review its work. That reviewer is not independent of the audit function and may lack assessment qualifications. A qualified external assessor or peer review team is required. The resulting report and action plan must go to the audit committee, with follow-up on gaps.
Traps that cost marks
Scheduling external assessment annually instead of at least every five years; using internal staff as the external assessor; limiting quality review to individual engagements; and failing to report results or track improvement actions.