The new IIA Global Internal Audit Standards, effective January 9, 2025, provide a comprehensive framework for a Quality Assurance and Improvement Program (QAIP).
A QAIP is established by the chief audit executive to evaluate and ensure the internal audit function conforms with the Global Internal Audit Standards, achieves performance objectives, and pursues continuous improvement. The program includes internal and external assessments.
- Under Principle 8 – Overseen by the Board, the board receives assurance about the quality of the performance of the chief audit executive and the internal audit function through the quality assessment and improvement program, including the board’s direct review of the results of the external quality assessment.
- Under Principle 12 – Enhance Quality, quality is a combined measure of conformance with the Global Internal Audit Standards and the achievement of the internal audit function’s performance objectives which is a key element of a QAIP.
Specific Standards Related to the QAIP
8.3 Quality
The chief audit executive must develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the internal audit function.
At least annually, the chief audit executive must communicate the results of the internal quality assessment to the board and senior management. The results of external quality assessments must be reported when completed. In both cases, such communications include:
- The internal audit function’s conformance with the Standards and achievement of performance objectives.
- If applicable, compliance with laws and/or regulations relevant to internal auditing.
- If applicable, plans to address the internal audit function’s deficiencies and opportunities for improvement.
8.4 External Quality Assessment
The chief audit executive must develop a plan for an external quality assessment and discuss the plan with the board. The external assessment must be performed at least once every five years by a qualified, independent assessor or assessment team. The requirement for an external quality assessment may also be met through a self-assessment with independent validation. When selecting the independent assessor or assessment team, the chief audit executive must ensure at least one person holds an active Certified Internal Auditor® designation.
12.1 Internal Quality Assessment
The chief audit executive must develop and conduct internal assessments of the internal audit function’s conformance with the Global Internal Audit Standards and progress toward performance objectives.
The chief audit executive must establish a methodology for internal assessments, as described in Standard 8.3 Quality, that includes:
- Ongoing monitoring of the internal audit function’s conformance with the Standards and progress toward performance objectives.
- Periodic self-assessments or assessments by other persons within the organization with sufficient knowledge of internal audit practices to evaluate conformance with the Standards.
- Communication with the board and senior management about the results of internal assessments.
Based on the results of periodic self-assessments, the chief audit executive must develop action plans to address instances of nonconformance with the Standards and opportunities for improvement, including a proposed timeline for actions. The chief audit executive must communicate the results of periodic self-assessments and action plans to the board and senior management.
12.2 Performance Measurement
The chief audit executive must develop objectives to evaluate the internal audit function’s performance. The chief audit executive must consider the input and expectations of the board and senior management when developing the performance objectives.
The chief audit executive must develop a performance measurement methodology to assess progress toward achieving the function’s objectives and to promote the continuous improvement of the internal audit function.
When assessing the internal audit function’s performance, the chief audit executive must solicit feedback from the board and senior management as appropriate.
The chief audit executive must develop an action plan to address issues and opportunities for improvement.
12.3 Oversee and Improve Engagement Performance
The chief audit executive must establish and implement methodologies for engagement supervision, quality assurance, and the development of competencies.
- The chief audit executive or an engagement supervisor must provide internal auditors with guidance throughout the engagement, verify work programs are complete, and confirm engagement workpapers adequately support findings, conclusions, and recommendations.
- To assure quality, the chief audit executive must verify whether engagements are performed in conformance with the Standards and the internal audit function’s methodologies.
- To develop competencies, the chief audit executive must provide internal auditors with feedback about their performance and opportunities for improvement.
The extent of supervision required depends on the maturity of the internal audit function, the proficiency and experience of internal auditors, and the complexity of engagements.
The chief audit executive is responsible for supervising engagements, whether the engagement work is performed by the internal audit staff or by other service providers. Supervisory responsibilities may be delegated to appropriate and qualified individuals, but the chief audit executive retains ultimate responsibility.
These standards ensure that the internal audit activity is continuously improving and conforming to the highest professional standards.