Section C: Quality of Internal Audit Function

It is the internal audit profession's global voice, recognized authority, acknowledged leader, chief advocate, and principal educator. Members work in internal auditing, risk management, governance, internal control, information technology audit, education, and security.

Institute of Internal Auditors (IIA)

It organizes the authoritative body of knowledge, promulgated by The Institute of Internal Auditors, for the professional practice of internal auditing. It addresses current internal audit practices while enabling practitioners and stakeholders globally to be flexible and responsive to the ongoing needs for high-quality internal auditing in diverse environments and organizations of different purposes, sizes, and structures.

The International Professional Practices Framework (IPPF)

Three Major Parts of IPPF

1. Global Institute of Audit Standards

2. Topical Requirements

3. Global Guidance

They are the guide the worldwide professional practice of internal auditing and serve as a basis for evaluating and elevating the quality of the internal audit function.

Global Institute of Audit Standards

These are designed to enhance the consistency and quality of internal audit services related to specific audit subjects and to support internal auditors performing engagements in risk areas. Internal auditors must conform with the relevant requirements when the scope of an engagement includes one of the identified topics.

Topical Requirements

It supports the Standards by providing nonmandatory information, advice, and best practices for performing internal audit services. It is endorsed by The IIA through formal review and approval processes.

Global Guidance

These provide detailed approaches, step-by-step processes, and examples on subjects

Global Practice Guides

These provide auditors with the knowledge to perform assurance or consulting services related to an organization's information technology and information security risks and controls.

Global Technology Audit Guides (GTAG)

According to Principle 12: Enhance Quality. The chief audit executive is responsible for the internal audit function’s conformance with the Global Internal Audit Standards and continuous performance improvement. _______ is a combined measure of conformance with the Global Internal Audit Standards and the achievement of the internal audit function’s performance objectives.

Quality

_________ and _________ is designed to evaluate and promote the internal audit function’s conformance with the Standards, achievement of performance objectives, and pursuit of continuous improvement.

Quality assurance and improvement program (QAIP)

They are responsible for ensuring that the internal audit function is continuously seeking improvement. This requires developing measures to assess the performance of internal audit engagements, internal auditors, and the internal audit function. These measures form the basis for evaluating progress toward performance objectives including continuous improvement.

Chief Audit Executive

According to this Standard, the CAE must develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the internal audit function.

Standard 8.3: Quality

Improvement program includes two types of assessments:

1. External Assessments (Standard 8.4)

2. Internal Assessments (Standard 12.1)

How often does the CAE must communicate the results of internal quality assessment to the board and senior management?

At least annually

The results of the external quality assessments must be reported when ________.

completed

Internal and external quality assessments include:

• The internal audit function’s conformance with the Standards and achievement of performance objectives.

• If applicable, compliance with laws and/or regulations relevant to internal auditing.

• If applicable, plans to address the internal audit function’s deficiencies and opportunities for improvement.

Essential Conditions Board (Quality)

• Discuss with the chief audit executive the quality assurance and improvement program, as outlined in Domain IV: Managing the Internal Audit Function.

• Approve the internal audit function’s performance objectives at least annually

• Assess the effectiveness and efficiency of the internal audit function. Such an assessment includes:

  • Reviewing the internal audit function’s performance objectives, including its conformance with the Standards, laws and regulations; ability to meet the internal audit mandate; and progress towards completion of the internal audit plan.

  • Considering the results of the internal audit function’s quality assurance and improvement program.

  • Determining the extent to which the internal audit function’s performance objectives are being met.

Essential Conditions Senior Management(Quality)

• Provide input on the internal audit function’s performance objectives.

• Participate with the board in an annual assessment of the chief audit executive and internal audit function.

The chief audit executive’s communications to the board and senior management regarding the internal audit function’s quality assurance and improvement program should include:

• The scope, frequency, and results of internal and external quality assessments conducted under the direction of, or with the assistance of, the chief audit executive.

• Action plans that address deficiencies and opportunities for improvement. Actions should be agreed upon with the board.

• Progress toward completing the agreed-upon actions

An assessment of the internal audit function’s quality may consider:

• The level of contribution to the improvement of governance, risk management, and control processes.

• Productivity of internal audit staff (for example, planned hours compared to actual hours on projects or time used on audit projects compared to administrative time).

• Compliance with internal audit laws and/or regulations.

• Cost efficiency of the internal audit processes.

• Strength of relationships with senior management and other key stakeholders.

• Other performance measures.

According to Standard 8.4: External Quality Assessment, the CAE must develop a plan for an external quality assessment and discuss the plan with the board. The external assessment must be performed at least ____________ by a qualified, independent assessor or assessment team. The requirement for an external quality assessment may also be met through a self-assessment with independent validation.

once every five years

When selecting the independent assessor or assessment team, the CAE must ensure at least one person holds an active ____________________ designation.

Certified Internal Auditor

Essential Conditions Board (External Quality Assessment):

• Discuss with the CAE the plans to have an external quality assessment of the internal audit function conducted by an independent, qualified assessor or assessment team.

• Collaborate with senior management and the chief audit executive to determine the scope and frequency of the external quality assessment.

• Consider the responsibilities and regulatory requirements of the internal audit function and the chief audit executive.

• Review and approve the CAE’s plan for the performance of an external quality assessment. Such approval should cover, at a minimum:

  • The scope and frequency of assessments.

  • The competencies and independence of the external assessor or assessment team.

  • The rationale for choosing to conduct a self-assessment with independent validation instead of an external quality assessment.

• Require receipt of the complete results of the external quality assessment or self-assessment with independent validation directly form the assessor.

• Review and approve the chief audit executive’s action plans to address identified deficiencies and opportunities for improvement, if applicable.

• Approve a timeline for completion of the action plans and monitor the CAE’s progress.

Essential Conditions Senior Management (External Quality Assessment):

• Collaborate with the board and the CAE to determine the scope and frequency of the external quality assessment.

• Review the results of the external quality assessment, collaborate with the CAE and board to agree on action plans that address identified deficiencies and opportunities for improvement, if applicable, and agree on a timeline for completion of the action plans.

The external quality assessment should include a comprehensive review of the adequacy of the internal audit function’s:

• Conformance with the Global Internal Audit Standards.

• Mandate, charter, strategy, methodologies, processes, risk assessment, and internal audit plan.

• Compliance with applicable laws and/or regulations.

• Performance criteria and measures as well as assessment results.

• Competencies and due professional care, including the sufficient use of tools and techniques, and focus on continual development.

• Qualifications and competencies, including those of the CAE role, as defined by the organization’s job description and hiring profile.

• Integration into the organization’s governance processes, including the relationships among those involved in positioning the internal audit function to operate independently.

• Contribution to the organization’s governance, risk management, and control processes.

• Ability to meet expectations articulated by the board, senior management, and stakeholders.

External Quality Assessments may be accomplished through:

• Full External Assessment; or

• Self-Assessment with Independent Validation

Self-Assessment with Independent Validation typically includes:

• A comprehensive and fully documented internal assessment that emulates the external quality assessment process in terms of evaluating the internal audit function’s conformance with the Standards.

• Validation by a qualified, independent external quality assessor or assessment team. The independent validation should determine that the internal assessment was conducted completely and accurately.

• Benchmarking, leading practices, and interviews with key stakeholders, such as board members, senior management, and operational management.

Important qualifications of the assessment team to consider:

• At least one person holds an active Certified Internal Auditor designation.

• Experience with and knowledge of the Standards and leading internal audit practices.

• Experience as a chief audit executive or comparable senior level of internal audit management.

• Experience in the organization’s industry or sector.

• Previous experience performing external quality assessments.

• Completion of external quality assessment training recognized by The Institute of Internal Auditors.

• Attestation by assessment team members that they have no conflict of interest, in fact or appearance.

Individuals from another department of the organization, that is organizationally separate from the internal audit function, are considered independent for the purpose of conducting an external assessment (T/F)

False

Individuals that are not considered independent for the purpose of conducting an external assessment:

• Individual from another department of the organization

• Individuals from a related organization (parent organization, affiliate in the same group of entities, entity with regular oversight, supervision, or quality assurance responsibilities with respect to the subject organization)

• In public sector, individuals that report to the same chief audit executive.

• Reciprocal peer assessments between two organizations.

According to Standard 12.1: Internal Quality Assessment, the CAE must develop and conduct internal assessments of the internal audit function’s conformance with the GIAS and progress toward performance objectives.

The CAE must establish a methodology for internal assessments that includes:

• Ongoing monitoring of the internal audit function’s conformance with the Standards and progress toward performance objectives.

• Periodic self-assessments of assessments by other persons within the organization with sufficient knowledge of internal audit practices to evaluate conformance with the Standards.

• Communication with the board and senior management about the results of internal assessments.

If nonconformance with the Standards affects the overall scope or operation of the internal audit function, the chief audit executive must disclose it to ____________________

the board and senior management the nonconformance and its impact.

It involves the day-to-day supervision, review, and measurement of the internal audit function. It is incorporated into the routine policies and practices used to manage the internal audit function and includes the process, tools, information necessary to evaluate conformance with the Standards.

Ongoing Monitoring

Additional mechanisms commonly used for ongoing monitoring include:

• Checklists or automated tools to provide assurance on internal auditors’ compliance with established methodologies and to facilitate consistent performance of internal audit services in conformance with the Standards. These may be especially important for use in internal audit function with limited staff resources for supervision.

• Feedback from internal audit stakeholders regarding the efficiency and effectiveness of the internal audit team. Feedback may be solicited immediately after the engagement or periodically (for example, semi-annually or annually) through survey tools or discussions between the chief audit executive and management.

• Other measurements that may be valuable in determining the efficiency and effectiveness of the internal audit function include metrics indicating the adequacy of resource allocation (such as budget-to-actual variance), the timeliness of engagement completion, the achievement of the internal audit plan, and survey of stakeholder satisfaction.

These provide a more holistic, comprehensive review of the Standards and the internal audit function. These address conformance with every standard, whereas ongoing monitoring may focus on the standards relevant to performing engagements.

Periodic Self-Assessments

Periodic self-assessments evaluate:

• The adequacy of the internal audit function’s methodologies.

• How well the internal audit function supports the achievement of the organization’s objectives.

• The quality of internal audit services performed and supervision provided.

• The degree to which stakeholder expectations are met and performance objectives are achieved.

According to this Standard, the CAE must develop objectives to evaluate the internal audit function’s performance. The CAE must consider the input and expectations of the board and senior management when developing the performance objectives.

The CAE must develop a performance measurement methodology to assess progress toward achieving the function’s objectives and to promote the continuous improvement of the internal audit function.

Standard 12.2: Performance Measurement

These are measurable values that show how effectively a company or individual is achieving key business objectives. These help organizations assess progress toward goals, identify areas for improvement, and guide strategic decisions.

Key Performance Indicators (KPIs)

According to Standard 12.3: Oversee and Improve Engagement Performance, the CAE must establish and implement methodologies for _________, _________, and ___________.

engagement supervision, quality assurance, and the development of competencies.

What is the objectives of the Quality Assurance and Improvement Program (QAIP)?

• To assess conformance with the GIAS

• Continuous performance improvement

What are the components of QAIP?

• Internal Quality Assessment

• External Quality Assessment

Who is responsible for the quality of Internal Audit Function?

The Chief Audit Executive

External Quality Assessment

• Frequency:

• Who perform:

• Components:

• Frequency: Once every five years

• Who perform: Qualified and independent assessor

• Components: Full External Quality Asessment and Self Assessment with Independent Validation (SAIV)

Internal Quality Assessment

• Frequency:

• Who perform:

• Components:

• Frequency: At least annually

• Who perform: Internal Individuals who are knowledgeable with Standards

• Components: Periodic Self Assessment and Ongoing Monitoring

Performance Objectives include:

• Inputs from the board and senior management

• Monitored progress

• Action plans

Supervision

• Extend may vary

• CAE has ultimate responsibility

• Engagements are performed in accordance with Methodologies

• Opportunities for development

The IIA’s Quality Assessment Manual for the Internal Audit Function must be used as the basis for periodic assessments (T/F)

False (not mandatory)

The conclusions of periodic internal assessments are intended to assist in achieving conformity to the Standards (T/F)

True

According to the International Professional Practices Framework, a review team must express an opinion on which of the following when performing an external assessment of an internal audit function?

I. Conformance with the Global Internal Audit Standards.

II. Effectiveness of continuous improvement activities.

III. Feedback from internal audit customers and other stakeholder groups.

IV. Efficiency and effectiveness of the internal audit function's administration processes.

I only (GIAS 2024 requires the external review team to provide an opinion on conformance with the Global Internal Audit Standards. While effectiveness and feedback are useful, they are not required components of the formal opinion.)

The results of self-assessments with independent external validation are shared with the board upon completion, and monitoring of recommended improvements should be reported monthly (T/F)

True

The requirements for reporting quality assessment results are the same for external assessments and self-assessments with independent external validation (T/F)

False

An internal auditor may perform a peer review of a colleague’s workpapers, as long as the auditor wasn’t involved in the audit under review (T/F)

True (IIA allows internal assessments to include self-assessments and periodic peer reviews, provided the reviewers maintain objectivity and are not part of the audit being reviewed. This supports internal objectivity and continuous improvement, especially when resources for external reviews are limited.)

Which of the following processes or tools can be used as ongoing internal assessments of the performance of the internal audit function?

I. Analyses of audit plan completion and cost recoveries.

II. Selective peer reviews of work papers by staff involved in the respective audits.

III. Self-assessment of the internal audit function with on-site validation by a qualified independent reviewer.

IV. Feedback from audit customers and stakeholders.

I, II, IV

Ongoing assessments typically include:

I. Audit plan completion analysis and performance metrics

II. Selective internal peer reviews

IV. Stakeholder feedback mechanisms

According to IIA guidance, it is the most likely obstacle to undertaking a quality assurance and improvement program by the internal audit function?

Lack of independence and objectivity