Skip Ribbon Commands
Skip to main content

​Quality Assurance

The International Standards for the Professional Practice of Internal Auditing (Standards) 1300 series require a Chief Audit Executive (CAE) to develop and maintain a Quality Assurance and Improvement Program (QAIP). A QAIP is designed to enable an evaluation of the internal audit activity’s conformance with the Definition of Internal Auditing and the Standards and an evaluation of whether internal auditors apply the Code of Ethics. The program also assesses the efficiency and effectiveness of the internal audit activity and identifies opportunities for improvement.

The required elements of a QAIP include ongoing and periodic internal assessments which lay the foundation for external assessments   and together establish conformance with the Standards. If you have not yet established a QAIP, a good first step on the path to quality is to conduct an internal quality assessment. This will establish a benchmark of the internal audit activity and can be used to establish metrics. These metrics will indicate improvement in areas of conformance with the Standards.

Added Value

The QAIP not only provides a means for evaluation of conformance with the Standards, but evidence to the audit committee and management that the internal audit activity is concerned about the organization’s internal controls, ethics, governance, and risk management processes. It builds stakeholder confidence and documents a commitment to quality, leading practices, and the internal auditors’ mindset for professionalism.

Inquire about external quality assessment services from The IIA.. 

 

Downloads and Links

Quality-Assessment-Web-Ad.JPGQuality Assessment Manual

The Quality Assessment Manual for the Internal Audit Activity, published by the Internal Audit Foundation, continues to be the principal methodology and set of practical tools recommended for evaluation of the QAIP in order to assess conformity to the Standards, leading practices and, equally important, to reveal opportunities for enhancing the effectiveness and value of internal audit activities.

To purchase the Quality Assessment Manual for the Internal Audit Activity, please visit the IIA Bookstore.

Sample Quality Assurance Improvement Program
Model Audit Committee Charter
Model Internal Audit Activity Charter
Maturity Model

 

 Frequently Asked Questions

 
FAQ
  •   What is an External Quality Assessment (EQA)?
    An external quality assessment, or EQA, evaluates conformance with the Definition of Internal Auditing, the International Standards for the Professional Practice of Internal Auditing (Standards), and an evaluation of whether internal auditors apply the Code of Ethics.
  •   What are the approaches for an EQA?
    Regardless of an organization's industry or the internal audit activity's complexity or size, there are two recommended approaches to EQAs. The first approach - an independent review team (QA) - involves an outside team under the leadership of an experienced and professional project manager. The team members should be competent professionals who are well versed in best internal audit practices.
     
    The second approach seeks out an objective outside party for independent validation of the internal self assessment and report completed by the internal audit activity (SAIV). This approach brings in a competent independent evaluator who is well versed in quality assessment methodology to validate the aforementioned self-assessment of the internal audit activity. In addition to reviewing the self-assessment, the validator substantiates some of the work done by the self-assessment team, makes an on-site visit, interviews senior management, and either co-signs the CAE's report regarding conformance to the Standards, or issues a separate report on the disparities.
  •   Why undergo an External Quality Assessment (EQA)?
    EQAs are necessary in order to provide full objectivity. In addition to enabling you to state that your IA activities "Conform with the International Standards for the Professional Practice of Internal Auditing," they build stakeholder confidence by documenting the internal audit activitys commitment to quality and best practices, and the internal auditors' mindset for professionalism. Obtaining an EQA also provides evidence to the board, management, and staff that the internal audit activity is concerned about the organization's internal controls, governance, and risk management processes.
  •   When does an Internal Audit Activity need to have an EQA performed?
    It is mandatory that every internal audit activity undergo an EQA conducted by an independent team or independent validator once every five years to comply with Standard 1312. The clock starts ticking for the five-year period when an internal audit activity formally adopts the International Standards for the Professional Practice of Internal Auditing (Standards).
     
    Adoption of the Standards establishes the intent of the internal audit activity to comply, and as a result, is considered the starting point of the five-year period before an EQA is required. Evidence to examine to support the date of the adoption of the Standards would include audit committee minutes, updates to the audit charter, evidence of the use of the phrase "conducted in conformance with the Standards" in audit reports, etc.
  •   Who can conduct an EQA?
    The International Professional Practices Framework (IPPF) defines the required competency of the EQA assessors. Interpretation of Standard 1312 from the International Standards for the Professional Practice of Internal Auditing (Standards) contained in Practice Advisory 1312-1:

    Performing and communicating the results of an external assessment require the exercise of professional judgment. Accordingly, an individual serving as an external assessor should:

    • Be a competent, certified audit professional (e.g., CIA, CPA, CA, or CISA) who possesses current, in-depth knowledge of the Standards.
    • Be well-versed in the best practices of the profession.
    • Have at least three years of recent experience in the practice of internal auditing at a management level.
    • Competence and experience, such as that gained from working previously as a team member on an external quality assessment, successful completion of The IIA's quality assessment training course or similar training.
    • CAE or comparable senior internal audit management experience.
  •   How do I obtain knowledge about internal and external assessments?
    Start by purchasing the Quality Assessment Manual or attending seminars such as The IIA’s Internal Audit Quality Assessment and Performing External Quality Assessments of the Internal Audit Activity, available in locations around the world.
  •   Where do I start?
    If you have not yet established a Quality Assurance and Improvement Program, a good first step on the path to quality is to conduct an internal quality assessment. This will establish a benchmark of your internal audit activity that can be used to establish metrics. These metrics will indicate improvement in areas of partial conformance or nonconformance with the Standards.
     
    To receive a proposal for EQA services, please e-mail institute.relations@theiia.org so that we may evaluate your needs and direct you to the appropriate IIA Institute that performs such services.


An updated edition of the International Professional Practices Framework (IPPF) guide, more commonly known as the Red Book, is now available. Visit the IIA Bookstore for more information.