Quality Assurance and Improvement Program (QAIP) in Internal Audit

Photo by FORTYTWO on Unsplash

Quality internal audit is determined not only by the number of engagements completed, but also by conformance with professional standards and the value it brings to the company.

Quality Assurance and Improvement Program (QAIP) helps the internal audit unit evaluate the quality of audit work, measure performance, and identify opportunities for improvement. Read this article to the end to understand the components of internal audit QAIP, the quality assessment process, and how to improve internal auditor performance.

Why Does an Internal Audit Unit Need QAIP?

QAIP is a quality assurance and improvement program that covers every aspect of the internal audit function. It assesses conformance with professional standards and the achievement of performance objectives.

Under the Global Internal Audit Standards issued by The Institute of Internal Auditors (IIA), the head of internal audit is responsible for developing and maintaining the QAIP. The program includes internal assessments and external assessments.

Internal audit QAIP helps the company recognize process weaknesses, improve auditor competence, and refine its methodology. The evaluation results also serve as the basis for developing the internal audit function.

Assuring Conformance with the Global Internal Audit Standards

The Global Internal Audit Standards are the professional reference for running the internal audit function. The standards, issued by the IIA, took effect on 9 January 2025.

Internal audit QAIP helps the internal audit unit evaluate whether its work practices conform with these standards. The evaluation also covers the achievement of performance objectives and compliance with applicable requirements.

Aspects that can be evaluated include:

• Audit methodology: alignment of procedures with standards and internal policies.
• Documentation: completeness of evidence and working papers.
• Auditor competence: adequacy of knowledge and skills.
• Engagement management: quality of planning, supervision, and reporting.
• Audit results: contribution of recommendations to organizational improvement.

Who Audits the Internal Auditors?

The quality of the internal audit function is assessed through internal and external mechanisms. Both help evaluate conformance with standards and identify opportunities for improvement.

The Chief Audit Executive (CAE) is responsible for developing and maintaining the QAIP. Internal assessments are carried out through ongoing monitoring and periodic evaluations by people with sufficient knowledge.

Meanwhile, external assessments are carried out by a qualified independent assessor. Under the Global Internal Audit Standards, this assessment must be conducted at least once every five years.

Key Components of an Audit Quality Assurance Program

An audit quality assurance program combines internal assessments, external assessments, and improvement follow-up. Together they help the company monitor quality and ensure evaluation results are acted upon.

QAIP needs to be supported by a methodology, an evaluation schedule, documentation, performance indicators, and a reporting mechanism. Its implementation must also fit the organization's operational complexity and risks.

Internal Assessment: Ongoing Monitoring and Periodic Evaluation

Internal assessments identify quality gaps through ongoing monitoring and periodic evaluation. Monitoring can take place throughout the audit engagement cycle.

For example, a supervisor reviews working papers, checks the sufficiency of evidence, and ensures conclusions are supported by test results. Periodic evaluations can cover methodology, performance achievement, supervision, and follow-up on recommendations.

Internal assessment activities can include:

1. Reviewing a sample of working papers from completed engagements.
2. Checking the consistency of audit methodology application.
3. Evaluating stakeholder feedback.
4. Comparing performance achievement with targets.
5. Documenting gaps and improvement opportunities.

Internal assessment results need to be communicated to the board and senior management as required by the standards. Reporting covers conformance with standards, achievement of performance objectives, and plans to address deficiencies.

External Assessment: Why Is an Independent Assessment of Internal Audit Required?

An external assessment provides an independent perspective on the quality of the internal audit function. The process helps the organization identify weaknesses that may not be visible through internal assessments. In the government sector, a similar mechanism is known as APIP peer review.

The Global Internal Audit Standards require an external assessment at least once every five years. It can take the form of a full external assessment or a self-assessment with independent validation.

Selecting the assessor should consider competence, experience, understanding of the standards, and potential conflicts of interest. At least one member of the assessment team must hold an active Certified Internal Auditor (CIA) certification.

The scope can cover methodology, risk-based planning, competence, resource use, and audit's contribution to governance. The assessment results become the basis for corrective actions.

How Is Internal Auditor Performance Evaluated Effectively?

Photo by Vitaly Gariev on Unsplash

Performance evaluation of internal auditors should measure the quality of work, not just the number of engagements. The indicators used must reflect the objectives of the audit function and the organization's risk profile.

The company can combine quantitative indicators with qualitative assessment. This approach helps avoid evaluations that focus only on how fast audits are completed.

Key Performance Indicators (KPI) and Working Paper Quality Evaluation

Key Performance Indicators (KPI) help the internal audit unit monitor the achievement of performance objectives. Indicators should be aligned with strategy, stakeholder needs, and risk priorities.

Examples of performance indicators that can be used:

These indicators are examples, not a mandatory KPI list from the IIA. The company needs to set consistent definitions, targets, data sources, and measurement periods.

Working paper evaluation should check the link between audit objectives, test procedures, evidence, findings, and conclusions. Adequate documentation makes audit results easier to trace and account for.

Addressing Quality Assessment Findings Through Corrective Action Plans

A QAIP assessment can uncover nonconformance with standards, documentation weaknesses, or processes that are not yet effective. These findings need to be addressed through measurable corrective action plans.

The handling steps can be as follows:

1. Identify the root cause: determine the main cause of the finding.
2. Set priorities: consider the level of risk and impact.
3. Assign an owner: designate who will carry out the action.
4. Set deadlines: create realistic completion targets.
5. Monitor progress: check progress and evidence of implementation.
6. Validate results: ensure the action addresses the cause of the problem.

For example, inconsistent documentation of audit evidence can be addressed by revising the working paper guide and training auditors. The supervisor then reviews a sample of subsequent engagements to assess whether the improvement is effective.

Follow-up results need to be documented and reported through the organization's oversight mechanism. If problems remain unresolved, the head of internal audit needs to communicate the obstacles and next steps.

Conclusion

The Quality Assurance and Improvement Program (QAIP) helps the internal audit unit maintain quality, evaluate conformance with standards, and improve performance continuously. The program includes internal assessments, external assessments, and improvement follow-up.

Implementing internal audit QAIP requires a clear methodology, relevant performance indicators, adequate documentation, and consistent oversight. Digital system support can help manage these processes according to the organization's needs.

If your company wants to evaluate its needs for digitalizing the internal audit process, visit Audithink or schedule a demo.

FAQ