By Basil Woller, Basil Woller & Associates LLC
No matter what the profession, the significance of quality assurance cannot be underestimated. This is especially applicable to internal auditors. Various mandatory standards set by The Institute of Internal Auditors (IIA) underscore the importance of a quality assurance and improvement program (QAIP). While the concept of a QAIP has been in place since January 1, 2002, only recently are we starting to see these programs fully implemented with all of the required components.
This is likely due to the fact that, as a profession, we are in the “second cycle” of reviews and many organizations have put QAIPs into effect as a result of a conformance gap in their first external quality assessment. More importantly, I believe that CAEs are recognizing the effectiveness that a fully functioning QAIP can have upon quality, efficiency and effectiveness of internal audit processes and the ability to provide high quality internal audit services to their various stakeholders.
Under The IIA’s Standard 1300, CAEs are required to establish and maintain a quality assurance and improvement program that includes both internal and external assessment components. Also embedded in the Standard are requirements where the CAE communicate results of assessments to senior management and the audit committee. While these requirements are not new, we learned from experience in terms of what works and what does not when implementing these components. As a result, a fully functioning QAIP has embedded into it leading internal audit practices in terms of how to establish internal and external assessment components and the associated communication requirements.
Interrelated Components
An internal quality assessment is comprised of the following interrelated components: ongoing monitoring and periodic internal assessment. Ongoing monitoring provides the CAE with assurance that the processes in place to ensure quality are delivered on an audit-by-audit basis and are in place and working effectively. Effective ongoing monitoring programs typically utilize quality checklists to ensure that planning, execution, reporting and administration are conducted consistently and completely on each audit.
Layered on top of these quality tools are defined levels of supervisory review and approval, definition, tracking and reporting of key performance indicators (KPIs) and stakeholder feedback (usually in the form of a customer feedback process). As of January 1, 2009, the Standards now require the results of these ongoing internal assessments be communicated to senior management and the board at least annually. The biggest challenges that I see when conducting external quality assessments are defining how and what to report with respect to ongoing monitoring results. The most effective processes make full use of metrics that are established and regularly tracked – ones that are meaningful to the CAE and his/her stakeholders. Getting input upfront when deciding what metrics to use ensures that reports are on target with expectations.
An internal periodic assessment has a different but interrelated focus to internal ongoing monitoring. Whereas internal ongoing monitoring focuses on processes in place to ensure quality on an audit-by-audit basis, internal periodic assessments focus on evaluating conformance with internal auditing standards. Many organizations have erroneously focused the internal periodic assessment component of their QAIP solely upon the Performance Standards (how they execute their audits). Their program evaluates adherence to the Standards and internal audit methodology across the breadth of their internal audit work for a given period. What these programs fail to do is address the Attribute Standard components that make up the infrastructure supporting the internal audit activity. A well-designed periodic program provides the CAE with information related to conformance with the full range of Standards. The best programs are those that document a systematic and disciplined approach to the internal periodic assessment process. Thus, the QAIP should define how to accomplish the internal periodic assessment and define the scope of activity for each interim year between the external quality assessments. For example:
- Year 1: Self-assessment of conformance with the Standards in anticipation of the external quality assessment. Remediation of any identified conformance gaps prior to the external assessment.
- Year 2: Remediation of additional gaps identified in external assessment and evaluation of their effectiveness.
- Year 3: Evaluation of Attribute Standards – ensure changes to the Standards and underlying guidance are incorporated into methodology as appropriate.
- Year 4: Evaluation of Performance Standards – ensure changes to the Standards and underlying guidance, as well as leading internal audit practices, are incorporated into methodology.
- Year 5: Targeted assessment from a conformance perspective related to a specific area of interest (i.e., risk assessment and annual audit planning, reporting processes, monitoring and follow-up processes, etc.)
These are just examples of what might be covered each year. There is additional non-mandatory guidance provided in The IIA’s Practice Advisories. Ultimately, the CAE is now required to communicate the results of the internal periodic assessment when it occurs.
Opening the Door to New Ideas
The last major requirement of the QAIP is the external assessment component. With a fully functioning program that has internal assessment components in place to ensure quality on an audit-by-audit basis and a periodic view as to conformance, the external assessment becomes an opportunity to obtain new ideas from outside the organization on ways to improve overall quality, efficiency and effectiveness. There should not be any surprises since the periodic assessment provides insight into conformance. So in effect, the external assessment is a non-event from a compliance perspective. A new requirement went into effect on January 1, 2011 to ensure that the reviewer or review team is qualified in the practice of internal auditing and the quality assessment process. This continues to reinforce the value-add dimension of the external quality assessment. Consistent with a requirement in place since 2002, the CAE must report the results of the external quality assessment to senior management and the audit committee when it occurs.
The value of an established and fully functioning QAIP is evidenced by the differences I see in internal audit activities where a program is in place and operating effectively and where a program is either not in place or does not have all the required elements. Internal and external assessments are clearly linked and complimentary. CAEs who embrace this concept generally have internal audit activities that are of high quality and operate consistent with The IIA’s Standards, Code of Ethics and Definition of Internal Auditing. They do not have to worry about that next external review because they already know the conformance answer. They can focus on new and innovative ways to better service to their stakeholders and provide meaningful results. Quality for them is not just a program; it is a part of their organizational culture and philosophy.
About the Author
Basil Woller is a former Managing Director with Protiviti where he led their global external quality assessment practice. He is a recognized thought leader in the internal auditing profession and currently serves on the Board of Directors of the Institute of Internal Auditors. Basil formed his company, Basil Woller & Associates, LLC to focus on providing quality assessment services to internal audit organizations. He is a Certified Internal Auditor, is accredited in quality assessment and validation, and conducts quality assessment training for The IIA. He can be contacted at Basil.Woller@gmail.com or 281-799-9606.
Download the article:
