According to standards set forth by the Institute of Internal Auditors (IIA), quality assessment review best practices should include an independent and external audit assessment at least every five years. An organization's officers, senior executives and board of directors expect accurate and timely accounting and consulting services. Risk and audit professionals are responsible for ensuring that the internal audit process is up to the job. Comprehensive quality assessment review policies are essential to accomplishing that mission.
Quality Assessment Review: An Overview
A quality assessment review, or a "QAR" in industry parlance, is an external (third-party) audit of an organization's internal audit processes. Quality assessment review processes involve thoroughly examining and evaluating a target company's internal audit activities. The goal of a QAR is to determine whether the company conforms to the standard and accepted domestic and international accounting standards in its regular testing and auditing program.
Generally, a QAR assesses the effectiveness of audit procedures in their primary function, providing accurate and relevant information to decision-makers and other interested parties.
More specifically, the quality and review risk assessment (among other things) accomplishes the following:
- Establish internal audit benchmarks and implement "best-practice" solutions in the event of problems, failures or inadequacies.
- Verify audit activities conform with IIA (or other applicable accounting board standards) and satisfy IIA Standard #1312, which recommends an external (third-party) QAR at least every five years.
- Demonstrate to the board of directors, senior company executives, staff, bankers and other interested parties that audit, risk and accounting procedures are taken seriously and updated.
- Build "goodwill" and confidence with equity and debt investors and the public by exercising professionalism and promoting an environment of quality in auditing, risk mitigation and accounting.
- Appropriately identify and manage risk.
- Recognize and address any legal, regulatory or legislative issues affecting or may affect the organization.
- Promote interaction with industry governance groups such as trade associations and accounting standards bureaus or organizations.
- Promote continuous improvement and modernization of internal control structures.
- Facilitate the reaching of company goals and objectives.
- Ensure organizational compliance with all applicable laws, industry standards, company policies and regulations.
- Promote efficient, cost-effective acquisition of materials and resources.
- Enhance human resources security and important company (intellectual and real) property.
In addition to identifying risks, a QAR can also be beneficial in recognizing opportunities. Enhancing an internal audit's efficiency improves an organization's overall value. In short, a better audit equates to better information provided to the board and key decision-makers. When armed with higher-quality data, expecting better decisions that lead to higher productivity and, ultimately, higher profit is not unreasonable.
Choosing a QAR Consultant
Quality assessment review procedures demand that a QAR review be fully independent, necessitating an external, third-party consultant rather than in-house accounting staff. Therefore, choosing the right consultant is imperative.
Experience
The first thing to look for in a QAR accounting consultant is experience. Thankfully, many respected professional firms have decades of experience in audit assessment and a solid reputation. However, the number of years in the business is one of many aspects to experience. Therefore, companies should look for consultants with expertise in a large and diverse collection of industries who have proven themselves to be capable and flexible.
Specialization
While breadth and depth are important for adaptability, companies will want to ensure the QAR firm they choose has specific experience in their industry. They must also be familiar with the working of specialized business units within an industry and company.
Technology Savvy
Any QAR team should include technology specialists with knowledge and skills in all applicable technological disciplines.
Leadership
The best QAR teams have direct, high-level (officer) executive involvement in every assessment they perform. Companies are within their rights to demand it.
Size
The number of consultants and the number of clients they serve matters. Especially the number of professionals they employ dedicated to risk management and the number of successful QARs they've accomplished.
Highly Professional
Any company that holds itself as a QAR firm should be affiliated or aligned with the IIA and support credible industry-standard bureaus such as the Financial Accounting Standards Board, the Governmental Accounting Standards Board and the American Institute of CPAs.
Responsibilities of a Quality Assessment Review Consultant
An Annual Review Plan
A QAR is more than a stagnant critique of a firm's internal audit apparatus. The QAR team is responsible for developing an annual review plan that incorporates appropriate risk mitigation methodologies. The plan should be submitted and reviewed with the target firm's audit committee for approval and to be updated when necessary.
Implementation
Good QAR consultants don't just deliver an assessment and write up a plan; they also help management implement the annual review plan and work on special projects if such help is needed.
Change Management
The finished quality assessment review should include a detailed evaluation of any merging or consolidation functions and planned changes in services, products, processes or overall operations.
Answer Questions
All top consultants have professional staff with the right skills and intimate knowledge of a company's past and current QARs. They should be available and ready to answer any question a company might have about their assessment.
New Information
In today's dynamic business and regulatory environment, it's critical that the QAR team stays on top of changing circumstances and notifies the audit committee of new issues that might affect the company, even to the point of issuing a new or updated report if necessary.
Follow Up
Quality assessment review is not just about identifying problems; it's about fixing them, so it's crucial to monitor the status of any failures or deficiencies.
Do the Job Right
QAR professionals should consider the size and scope of assessments before they undertake them and ensure the proper number of auditors, consultants, accountants and staff are assigned to the task.
Authorization
The QAR should have all the authority and access it needs to do a high-quality, complete job. In general, they will need the following authorizations:
- Full access to data, records, functions and personnel
- Access to members of the audit committee
- Sufficient resources (time and budget) to accomplish the objective of the review
- Full cooperation (and assistance if necessary) when and where assessments are performed
Their authority is not, however, unlimited. Outside QAR staff should not be authorized to do any of the following.
- Perform operational or management functions for the company or any of its partners or affiliates.
- Report assessment results or accounting transactions to external parties (unless legally obligated not to).
- Have any supervisory capacity over internal employees (unless personnel has been temporarily assigned as subordinates to QAR firm).
Templates, Guides and Tools Are Encouraged
The quality assessment review protocol is a somewhat burdensome obligation that needs to be undertaken at least every five years, and it's only one of the jobs of risk, audit and accounting professionals.
That said, there is some good news for busy accounting pros at modern, dynamic firms who might otherwise feel overwhelmed; we're here to help. KnowledgeLeader is a best-in-class, subscription-based provider of accounting and consulting tools and other valuable information and resources. If a quality assessment review is in your future, check out our website at www.knowledgeleader.com to see what we offer.
Our library has hundreds of resources dedicated to the subject of quality assurance. They include guides, training, templates, checklists, questionnaires, articles and more. We recommend the KnowledgeLeader Quality Assurance Review Plan Report for implementing QAR. It's a 26-page, step-by-step guide on reviewing a quality assessment and implementing suggested improvements.