The Institute Refines Its Quality Assurance and Improvement Program Practice Advisories

Using feedback from practitioners, The IIA provides further direction on developing and maintaining a quality assessment program of internal audit activities.

To help CAEs interpret internal audit's responsibilities regarding Standard 1300: Quality Assurance and Improvement Program from The IIA's International Standards for the Professional Practice of Internal Auditing, The Institute amended four Practice Advisories (PAs). Although the guidance is not intended to represent all the procedures necessary for a comprehensive quality program, it is a recommended set of quality assessment practices that The Institute suggests internal auditors consider when developing or assessing their quality programs.

According to Standard 1300, "CAEs should develop and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity and continuously monitors its effectiveness. This program includes periodic internal and external quality assessments and ongoing internal monitoring." Each part of the program should be designed to help the internal auditing activity add value and improve the organization's operations and to provide assurance that the internal audit activity is in conformity with the Standards and the Code of Ethics.

The amended PAs - 1310-1: Quality Program Assessments, 1311-1: Internal Assessments, 1312-1: External Assessments, and 1312-2 Self-assessment With Independent Validation - are the result of feedback from practitioners who have implemented the Standards; Standard 1300 was effective January 2002 for ongoing and periodic internal assessments, while an external assessment was required by January 2007 and at least every five years thereafter.

Summary of Revisions
PA 1310-1: Quality Program Assessments. The updated PA provides clarity to the definition and timing requirements of quality program assessments and expands on the two recommended external assessment approaches: a full external assessment and an independent external review of the internal self-assessment. The PA suggests that while there may be circumstances where a full external review is not deemed necessary, it provides maximum benefit and accountability to internal auditors and their stakeholders. The CAE should involve senior management and the board in determining the best approach to take.

The updated PA also describes specific areas that internal auditors should evaluate during a quality assessment review to determine the extent to which the auditing activity adds value and improves the organization's operations. It also indicates that the CAE should report to the board on the quality program efforts at least annually.

PA 1311-1: Internal Assessments. Internal assessments include ongoing reviews of the performance of the internal audit activity and periodic reviews performed through self-assessment or by other persons within the organization who have knowledge of internal audit practices and the Standards. The amended PA:

• Suggests that when performing the ongoing internal assessment, selective peer reviews of work papers by audit staff – who are not involved in the respective audits – may be used in the process.
• Recommends that the CAE establish a structure for reporting results of internal assessments that maintains appropriate credibility and objectivity when communicating the results on an internal assessment.
• States that the CAE should also report the results of internal assessments - including action plans and their successful implementation - at least annually to the board, as well as share this information with appropriate persons outside the activity such as senior management and external auditors.

PA 1311-1 also suggests that a periodic internal assessment performed within a short time prior to an external assessment can serve to facilitate and reduce the cost of the external assessment. Although the periodic internal assessment should not communicate any assurances on the outcome of the subsequent external quality assessment, the report may offer suggestions and recommendations to enhance the internal audit activities' practices. The PA also clarifies that if the external assessment takes the form of a self-assessment with independent validation, the periodic internal assessment can serve as the self-assessment portion of this process.

1312-1: External Assessments. The overview section of this PA has been expanded to clarify the scope of the external assessment process. Reiterating the requirement to perform an external assessment at least every five years, the PA suggests that the potential need for more frequent external assessments, as well as the qualifications and independence of the external reviewer or review team, should be considered and discussed with the board. The PA also:

• Revises the general qualification section for external reviewers, deleting examples of specific professional qualifications.
• Expands and clarifies independence requirements while emphasizing the need to be free of conflicts of interest, either real or apparent.
• Expands communication of results by adding the organization's external auditors to the report distribution.

1312-2: External Assessments: Self-assessment With Independent Validation.The updated PA takes into account CAE concerns that an external assessment by an independent reviewer may be burdensome for smaller internal audit activities, or that there may be circumstances where a full external assessment by an independent team is not deemed appropriate or necessary. The PA provides examples of such circumstances to help CAEs consider the process that may be best for their situation. The text of the validation process is also streamlined somewhat to provide further clarity.

Download the amended PAs below:
1310-1: Quality Program Assessments
1311-1: Internal Assessments
1312-1: External Assessments
1312-2: Self-assessment with Independent Validation

Additional IIA Resources
Frequently Asked Questions about Quality Assessment
www.theiia.org/guidance/quality/quality-faq/

Quality Resources
www.theiia.org/guidance/quality/quality-assessment-resources/

IIA Practice Advisories
www.theiia.org/guidance/standards-and-practices/professional-practices-framework/practice-advisories/