Communicating QAIP Results to the Board: A Complete CIA Exam Guide
Introduction
A Quality Assurance and Improvement Program (QAIP) only creates value when its results reach the people responsible for overseeing internal audit. Communicating QAIP results to the board and senior management closes the accountability loop. It shows whether the internal audit function conforms with the IIA Standards, whether it is achieving its performance objectives, and what is being done to fix any gaps. This topic is tested regularly on the CIA exam. Candidates are expected to know what must be communicated, to whom, how often and by whom.
1. Why It Is Important
Board oversight: The board is responsible for overseeing the internal audit function. It cannot judge whether internal audit is effective, objective and credible without reliable information on quality.
Accountability and transparency: Reporting QAIP results holds the Chief Audit Executive (CAE) accountable for the function's performance. It also shows that internal audit applies to itself the same scrutiny it applies to others.
Credibility of the conformance claim: Internal audit may state that it conforms with the Standards only if QAIP results support that statement. Communicating those results to the board gives the claim substance.
Resource and improvement decisions: QAIP findings often point to needs for more staff, training, technology or methodology changes. The board and senior management must know about these needs before they can approve them.
Disclosure of nonconformance: When nonconformance affects the overall scope or operation of the function, stakeholders need to know so they can judge how far to rely on internal audit's work.
Continuous improvement: Regular reporting creates a routine of follow-up on action plans, which drives ongoing improvement.
2. What It Is
Communicating QAIP results means the CAE formally reports the outcomes of the function's quality assessments to the board and senior management. The QAIP has two main components.
Internal assessments include:
- ongoing monitoring, such as engagement supervision, review checklists, KPIs and stakeholder feedback surveys;
- periodic self-assessments, which are evaluations of conformance performed by internal audit staff or other qualified people within the organization.
External assessments are performed at least once every five years by a qualified, independent assessor or assessment team from outside the organization. There are two forms:
- a full external assessment;
- a self-assessment with independent external validation (SAIV).
Key requirements under the Standards
Under the 2024 Global Internal Audit Standards (Principle 8, Overseen by the Board; Standard 8.3 Quality; Standard 8.4 External Quality Assessment):
- The CAE must develop, implement and maintain a QAIP.
- The CAE must communicate QAIP results to the board and senior management at least annually.
- The communication should cover conformance with the Standards and progress toward the function's performance objectives.
- For the external assessment, the CAE must discuss the following with the board:
- the plans for the assessment;
- whether it should be performed more often than every five years;
- the qualifications and independence of the assessor or team, including potential conflicts of interest.
- At least one member of the external assessment team should hold an active CIA designation.
- The full results of the external assessment must be reported directly to the board and senior management.
Under the legacy IPPF (Standards 1320, 1321 and 1322, which still appear in many study materials):
- 1320 Reporting on the QAIP: the CAE must communicate QAIP results to senior management and the board.
- 1321: use of the phrase 'Conforms with the International Standards for the Professional Practice of Internal Auditing' is allowed only if QAIP results support it.
- 1322 Disclosure of Nonconformance: when nonconformance affects the overall scope or operation of internal audit, the CAE must disclose the nonconformance and its impact to senior management and the board.
Typical content of the communication
- Scope and frequency of both internal and external assessments
- Qualifications and independence of the assessors or assessment team, including potential conflicts of interest
- Conclusions of the assessors, including the overall conformance opinion (traditionally Generally Conforms, Partially Conforms or Does Not Conform)
- Significant findings, observations and recommendations
- Corrective action plans, responsible owners and timelines
- Status of previously reported action plans
- Performance metrics and progress against performance objectives
3. How It Works
Step 1, Plan: The CAE designs the QAIP and, for external assessments, discusses the scope, timing and choice of assessor with the board in advance.
Step 2, Assess: Ongoing monitoring runs continuously. Periodic self-assessments occur at defined intervals, and the external assessment occurs at least every five years.
Step 3, Analyze: The CAE pulls together the results, identifies areas of conformance and nonconformance, and develops action plans.
Step 4, Report: The CAE communicates results to the board and senior management.
- Internal assessment results are reported at least annually, often through a dedicated report or as part of a periodic report to the audit committee.
- External assessment results are reported once the assessment is complete. The assessor's report is typically presented in full, and the assessor sometimes presents it directly to the board.
Step 5, Follow up: The CAE reports progress on corrective actions in later communications until the issues are resolved.
Step 6, Disclose nonconformance when required: If nonconformance affects the overall scope or operation of the function, the CAE discloses the nonconformance and its impact. The CAE should also stop claiming conformance with the Standards until the issue is corrected.
Example: An external assessment concludes that internal audit 'Partially Conforms' because it has no documented risk-based planning methodology. The CAE should:
- present the full assessment report to the audit committee and senior management;
- explain the impact of the gap;
- present an action plan with deadlines;
- stop using the conformance statement in engagement reports until the gap is closed;
- report on remediation progress at subsequent meetings.
4. How to Answer Exam Questions on This Topic
Questions usually take one of these forms:
- Who is responsible for communicating QAIP results? Answer: the CAE.
- To whom are the results communicated? Answer: the board and senior management, not only one of them, and not external regulators by default.
- How often? Answer: internal assessment results at least annually; external assessments at least every five years.
- What must be disclosed? Answer: scope, frequency, assessor qualifications and independence, conclusions, and corrective action plans.
- When must nonconformance be disclosed? Answer: when it affects the overall scope or operation of the internal audit function.
- When may the function claim conformance? Answer: only when supported by QAIP results, including an external assessment within the last five years.
Exam Tips: Answering Questions on Communicating QAIP Results to the Board
Tip 1: Remember the pairing 'board and senior management'. Options naming only one party, or naming external auditors or regulators as the primary recipients, are usually wrong.
Tip 2: Memorize the frequencies: annually for communicating QAIP results, and at least every five years for external assessments. Watch for distractors such as 'every three years' or 'only when requested by the board'.
Tip 3: The CAE owns the QAIP and its communication. Do not pick the audit committee chair, the external assessor or the CFO as the party responsible.
Tip 4: Know the disclosure checklist using the mnemonic SQCA: Scope and frequency, Qualifications and independence of assessors, Conclusions, and corrective Action plans.
Tip 5: The nonconformance disclosure trigger is impact on the overall scope or operation of the function, not every minor deviation. Minor issues go through normal QAIP reporting.
Tip 6: The conformance statement is allowed only when supported by QAIP results. If no external assessment has occurred within five years, the function cannot claim conformance.
Tip 7: The CAE should discuss the external assessment with the board before it happens, covering scope, frequency, and the assessor's qualifications and independence. Questions may test this proactive step.
Tip 8: Be alert to independence traps. An assessor from another department of the same organization, or a firm with a conflict of interest, is not acceptable for an external assessment.
Tip 9: When several answers look right, choose the one that best supports board oversight, transparency and improvement. Answers that delay, hide or soften findings are wrong.
Tip 10: Know both the legacy numbering (1300 to 1322) and the 2024 Global Internal Audit Standards (Domain III, Principle 8, Standards 8.3 and 8.4). Check which framework your exam window uses.
Summary
The CAE must communicate QAIP results, from both internal and external assessments, to the board and senior management at least annually. The communication covers scope, frequency, assessor qualifications and independence, conclusions and action plans. External assessments occur at least every five years. Significant nonconformance must be disclosed together with its impact. This reporting supports board oversight, validates any conformance claim and drives continuous improvement, and these are the principles to rely on when answering exam questions.
