Quality Assurance and Improvement Program

Introduction
The Quality Assurance and Improvement Program (QAIP) is how an internal audit function checks its own work. It gives the chief audit executive (CAE), senior management and the board evidence that internal audit conforms with professional standards, follows the Code of Ethics (Ethics and Professionalism principles under the 2024 Global Internal Audit Standards) and keeps improving. QAIP is tested often in the CIA Challenge Exam because it connects professionalism, governance, independence and reporting. Many of the questions turn on precise details, such as how often assessments happen, who may perform them and who receives the results.

1. Why the QAIP Is Important
- Credibility and trust: Internal audit assures others about governance, risk management and control. Stakeholders need assurance that internal audit's own work is reliable.
- Conformance evidence: Internal audit may state that it conforms with the Standards only if QAIP results support that statement.
- Continuous improvement: The QAIP finds weaknesses in methodology, staffing, tools and reporting. It also drives corrective action.
- Governance oversight: The board uses QAIP results to judge the effectiveness and efficiency of internal audit, and the performance of the CAE.
- Accountability: The QAIP shows the value internal audit adds and whether it meets stakeholder expectations.
- Risk reduction: It lowers the risk of poor-quality engagements, wrong conclusions, ethical lapses and damage to reputation.

2. What the QAIP Is
The QAIP is a program that the CAE develops, implements and maintains. It covers all aspects of the internal audit activity.

Under the 2017 IPPF (Standards 1300 to 1322):
- 1300: The CAE must develop and maintain a QAIP covering all aspects of the internal audit activity.
- 1310: The QAIP must include both internal and external assessments.
- 1311: Internal assessments include ongoing monitoring and periodic self-assessments.
- 1312: External assessments must be conducted at least once every five years.
- 1320: The CAE must communicate QAIP results to senior management and the board.
- 1321: Use of the phrase 'Conforms with the International Standards' must be supported by QAIP results.
- 1322: Nonconformance that affects the overall scope or operation of internal audit must be disclosed to senior management and the board.

Under the 2024 Global Internal Audit Standards (effective January 9, 2025):
- Standard 8.3 Quality: The CAE must develop, implement and maintain a QAIP. It includes external and internal assessments. Results must be communicated to the board and senior management at least annually.
- Standard 8.4 External Quality Assessment: An external assessment is required at least once every five years. It is performed by a qualified, independent assessor or team that includes at least one person holding an active CIA designation.
- Standard 12.1 Internal Quality Assessment: Internal assessments consist of ongoing monitoring and periodic self-assessments.
- Standard 12.2 Performance Measurement: The CAE develops objectives and measures to evaluate internal audit performance.
- Standard 4.1 Conformance with the Standards: This covers the conformance statement and the disclosure of nonconformance.

What the QAIP evaluates:
- Conformance with the Standards, including the Definition of Internal Auditing and Code of Ethics under the 2017 IPPF, or Ethics and Professionalism under the 2024 GIAS.
- The adequacy of the internal audit charter, mission, strategy and methodology.
- Efficiency and effectiveness of internal audit.
- Whether internal audit adds value and improves organizational operations.
- Whether stakeholder expectations are met.

3. How the QAIP Works

A. Internal Assessments
(1) Ongoing monitoring is built into the day-to-day supervision, review and measurement of internal audit work. Examples:
- Engagement supervision and documented review of workpapers.
- Standard audit manuals, checklists, templates and procedures.
- Feedback surveys from auditees and stakeholders after engagements.
- Key performance indicators, such as plan completion, cycle time, recommendations accepted and staff certifications.
- Budget and timeline tracking.
- Approval of the engagement plan and the final report.

(2) Periodic self-assessments are more in-depth reviews, usually done annually or on a set schedule. Features:
- They are performed by members of the internal audit activity. Under the 2017 IPPF they may also be performed by other people in the organization with sufficient knowledge of internal audit practices.
- They assess conformance with the Standards and Code of Ethics, the charter, and the quality of supervision.
- They often follow the same approach as an external assessment, which helps prepare for one.
- They may include benchmarking against leading practices.

B. External Assessments
- Frequency: At least once every five years. The board may require them more often, for example when there is a new CAE, major change or a regulatory requirement.
- Two approaches:
(a) a full external assessment by a qualified, independent external team; or
(b) a self-assessment with independent external validation (SAIV), where internal audit performs the assessment and a qualified independent external assessor validates it.
- Assessor qualifications: Competence in internal audit practice and in the external assessment process. Under the 2024 GIAS, at least one team member must hold an active CIA.
- Independence: The assessor must have no actual or perceived conflict of interest and must not be part of the organization or under its control. Common exam points:
- Staff from another department of the same organization are not independent for an external assessment.
- A reciprocal (two-way) peer review between two organizations impairs independence.
- A review rotated among three or more organizations is generally acceptable.
- Board involvement: The CAE discusses with the board the form and frequency of the assessment, and the qualifications and independence of the assessor, including potential conflicts. Under the 2024 GIAS, the board must approve the plan for the external assessment and oversee it.

C. Reporting QAIP Results
- Recipients: Senior management and the board.
- Contents: Scope and frequency of internal and external assessments, qualifications and independence of the assessors, conclusions, and corrective action plans.
- Internal assessment results: Reported at least annually.
- External assessment results: Reported when the assessment is completed, together with an action plan.
- Conformance rating scale commonly used in external assessments:
- Generally conforms: the highest rating.
- Partially conforms: deficiencies exist, but they do not prevent internal audit from performing its responsibilities.
- Does not conform: deficiencies are significant enough to seriously impair internal audit's work.

D. Conformance Statements and Nonconformance
- Internal audit may state that its work is performed 'in conformance with the Standards' only if the QAIP, including a current external assessment, supports that statement.
- If no external assessment has been done within five years, the conformance statement should not be used.
- When nonconformance affects the overall scope or operation of internal audit, the CAE must disclose to senior management and the board:
- the nonconformance;
- the reasons for it; and
- its impact.
- For an individual engagement, the report should disclose which requirement was not met, the reasons and the impact on the engagement.

E. Who Is Responsible
- The CAE owns the QAIP, even when internal audit is outsourced or co-sourced. Responsibility for quality cannot be delegated away.
- The board oversees the QAIP and receives the results.
- Every internal auditor contributes through quality work and ongoing monitoring.

4. Exam Tips: Answering Questions on Quality Assurance and Improvement Program

Tip 1: Memorize the numbers.
- External assessment: at least once every five years.
- Internal assessment results: reported at least annually.
- Distractors to reject: annually, every two years, every three years, or 'only when requested by the board'.

Tip 2: Tell the assessment types apart.
- Ongoing monitoring is routine and built into work: supervision, checklists, KPIs, surveys.
- Periodic self-assessment is a deeper, scheduled internal review.
- External assessment requires an independent party from outside the organization.
- If a question describes workpaper review by the engagement supervisor, the answer is ongoing monitoring, not an external assessment.

Tip 3: Test independence carefully.
- Employees of the same organization cannot perform an external assessment, even if they work in another division, the external auditor's group or compliance.
- Reciprocal reviews between two organizations are a classic wrong answer.
- A former employee or a firm with a conflict of interest also fails the test.

Tip 4: Know the audiences.
- QAIP results go to senior management and the board.
- Answers naming only the audit committee chair, only the CFO, or only the external auditor are usually incomplete.
- Under the 2024 GIAS, stress the board's role in approving and overseeing the external assessment.

Tip 5: Know that the CAE is accountable.
- The CAE develops and maintains the QAIP.
- Outsourcing the internal audit work or the assessment does not transfer this responsibility.

Tip 6: Know the conformance and disclosure rules.
- Internal audit can claim conformance only when QAIP results support it.
- Significant nonconformance requires disclosure of the issue, the reasons and the impact to senior management and the board.
- Hiding nonconformance or 'fixing it quietly' is always wrong.

Tip 7: Remember that 'all aspects' means broad scope.
- The QAIP covers governance, the charter, staff, methodology, engagements, ethics and value added.
- Answers limited to 'workpaper review only' are too narrow.

Tip 8: Recognize improvement as part of the program.
- The QAIP is about improving, not only checking compliance.
- Look for answers involving action plans, follow-up and performance measures.

Tip 9: Read scenario questions in a set order.
Ask yourself:
(1) Is this an internal or external assessment?
(2) Is the assessor qualified and independent?
(3) Is the frequency met?
(4) Were results reported to the right parties?
(5) Is the conformance statement justified?

Tip 10: Watch for 'BEST' and 'MOST appropriate'.
- Several options may be partly true.
- Choose the one that most directly satisfies the Standard's requirement, for example 'discuss assessor qualifications and independence with the board' rather than 'obtain the CFO's approval'.

5. Sample Practice Questions

Q1. Which of the following is an example of ongoing monitoring?
A) A peer review by another company's audit team
B) Supervisory review of engagement workpapers
C) An assessment by the external financial auditor
D) A five-year independent validation
Answer: B. Supervision is built into daily operations.

Q2. Two companies agree that their internal audit departments will assess each other's quality. This arrangement:
A) Satisfies external assessment requirements
B) Is acceptable if both CAEs hold the CIA
C) Impairs independence due to the reciprocal relationship
D) Is acceptable if approved by senior management
Answer: C.

Q3. Internal audit has not had an external assessment in seven years. Which is most appropriate?
A) Continue stating conformance with the Standards
B) Cease using the conformance statement and disclose to senior management and the board
C) Perform a periodic self-assessment instead
D) Ask the external auditor to sign off
Answer: B.

Q4. Who is ultimately responsible for the QAIP?
A) The board
B) The external assessor
C) The chief audit executive
D) Senior management
Answer: C.

6. Quick Summary
- The QAIP is owned by the CAE and covers all aspects of internal audit.
- It combines internal assessments (ongoing monitoring and periodic self-assessments) with external assessments at least every five years, done by a qualified, independent assessor from outside the organization.
- Results are communicated to senior management and the board, at least annually for internal results.
- Conformance claims must be backed by QAIP results.
- Significant nonconformance must be disclosed, with its reasons and impact.
- Master these points and look out for independence and frequency traps to answer QAIP questions with confidence.