Ongoing Monitoring in the Internal Audit Quality Assurance and Improvement Program (QAIP): A Complete CIA Exam Guide
Introduction
Ongoing monitoring is one of the building blocks of the internal audit activity's Quality Assurance and Improvement Program (QAIP). It is the routine, day-to-day way an internal audit function checks that its own work meets the IIA's requirements and its own policies. On the CIA exam, candidates must recognize ongoing monitoring, separate it from other types of quality assessment, and know who performs it, how and when.
1. Why Ongoing Monitoring Is Important
Internal auditors assess the quality of other people's processes. To be credible, they must show that their own work is reliable. Ongoing monitoring matters for several reasons.
• Quality is built in. Problems are caught during an engagement, before a weak report reaches management or the board.
• It supports conformance. It is a required part of internal assessments in the IIA framework. Without it, the internal audit activity cannot say its work conforms with the Standards.
• It builds stakeholder trust. The board, senior management and external auditors who rely on internal audit work gain confidence from evidence of consistent quality control.
• It drives continuous improvement. Metrics and feedback show where training, methods or resources need to improve.
• It prepares the function for other assessments. A strong ongoing monitoring process makes periodic self-assessments and external quality assessments smoother. Fewer surprises arise because issues have already been found and fixed.
• It supports accountability. The Chief Audit Executive (CAE) uses the results to report on internal audit performance to senior management and the board.
2. What Ongoing Monitoring Is
Ongoing monitoring is the continuous, routine oversight, review and measurement of the internal audit activity's performance. It is part of everyday supervision and work practices, not a separate exercise done once a year.
Where it fits in the QAIP structure
Under the 2017 International Standards for the Professional Practice of Internal Auditing:
• Standard 1300: The CAE must develop and maintain a QAIP that covers all aspects of the internal audit activity.
• Standard 1310: The QAIP must include both internal and external assessments.
• Standard 1311 Internal Assessments: These must include (a) ongoing monitoring of the performance of the internal audit activity, and (b) periodic self-assessments or assessments by other persons within the organization who know internal audit practices well enough.
• Standard 1312: External assessments must be done at least once every five years by a qualified, independent assessor or assessment team from outside the organization.
• Standards 1320, 1321 and 1322: These cover reporting on the QAIP, use of the phrase about conforming with the Standards, and disclosure of nonconformance.
Under the Global Internal Audit Standards (2024):
• Standard 8.3 Quality requires the CAE to develop, implement and maintain a QAIP.
• Standard 12.1 Internal Quality Assessment requires both ongoing monitoring and periodic self-assessments.
• Standard 8.4 covers external quality assessments, at least once every five years.
The core idea is the same in both frameworks: ongoing monitoring is the continuous half of the internal assessment.
Key characteristics
• Continuous and routine: It happens all the time, as part of normal operations.
• Embedded: It is built into the internal audit activity's policies, procedures, tools and supervision.
• Performed internally: It is carried out by internal audit management, supervisors and staff.
• Engagement and activity focused: It covers individual engagements and the overall performance of the function.
3. How Ongoing Monitoring Works
Common tools and methods
• Engagement supervision: Supervisors guide staff and review work at every phase: planning, fieldwork and reporting.
• Work program and workpaper review: Reviewers confirm that evidence is sufficient, reliable, relevant and useful, and that conclusions are supported.
• Checklists and templates: Standard tools help confirm that required steps and approvals were completed.
• Approval sign-offs: The engagement plan, work program and final report are approved by the right level of management before moving forward.
• Audit policies and manual: The methodology is documented, kept current and followed.
• Feedback from audit clients and stakeholders: Post-engagement surveys capture views on value, communication and professionalism.
• Key performance indicators (KPIs): Examples include:
- percentage of the audit plan completed
- cycle time from fieldwork end to report issuance
- budgeted versus actual hours
- percentage of recommendations accepted and implemented
- staff certifications and training hours
- stakeholder satisfaction scores
• Project budgets, timekeeping and scheduling systems: These monitor efficiency.
• Staff performance evaluations after engagements.
Step-by-step flow
1. Set expectations: Define standards, methodology, KPIs and review requirements in the audit manual.
2. Perform and supervise: Supervisors review work as engagements progress.
3. Measure: Collect KPI data, client feedback and review results.
4. Analyze: Find trends, gaps and nonconformance.
5. Act: Correct issues, update methods and provide training.
6. Report: The CAE communicates QAIP results, including ongoing monitoring, to senior management and the board. Internal assessment results should be reported at least annually.
How it relates to the other QAIP components
• Ongoing monitoring
- Frequency: continuous, day-to-day
- Performed by: internal audit management and supervisors
- Focus: individual engagements and daily operations
• Periodic self-assessment
- Frequency: periodic, often annual
- Performed by: members of the internal audit activity, or other qualified persons within the organization
- Focus: broader conformance with the Standards, the Code of Ethics or Principles, and the charter
- Role: it also validates that ongoing monitoring is working
• External assessment
- Frequency: at least once every five years
- Performed by: a qualified, independent assessor or team from outside the organization
- Format: a full external assessment, or a self-assessment with independent external validation
4. Common Points of Confusion
• Ongoing monitoring vs. continuous auditing: Continuous auditing is a technique for auditing the organization's data and controls. Ongoing monitoring is the internal audit activity checking the quality of its own work.
• Ongoing monitoring vs. management's continuous monitoring: Management monitors its own controls, which is a first or second line activity. That is not the QAIP.
• COSO ongoing evaluations: COSO's Monitoring Activities component uses a similar term for internal control over the organization. Do not confuse it with internal audit's QAIP.
• Internal assessments alone are not enough: To state that the internal audit activity conforms with the Standards, an external assessment must also have been completed within the last five years.
5. Exam Tips: Answering Questions on Ongoing Monitoring
Tip 1: Spot the keywords.
• Words such as routine, day-to-day, continuous, integral, embedded, supervision, workpaper review, checklists, KPIs, client surveys point to ongoing monitoring.
• Words such as periodic, annual, self-assessment, other persons within the organization point to periodic self-assessment.
• Words such as outside the organization, independent assessor, five years, independent validation point to external assessment.
Tip 2: Remember the structure. QAIP = internal assessments (ongoing monitoring + periodic self-assessments) + external assessments. Questions often test whether you can place an activity in the correct category.
Tip 3: Know who is responsible. The CAE is responsible for the QAIP. Ongoing monitoring is carried out within the internal audit activity, mainly through supervisors and management. An answer naming external auditors or regulators as the performers of ongoing monitoring is wrong.
Tip 4: Engagement supervision is the classic example. If a question asks for the best example of ongoing monitoring, choose supervisory review of workpapers or engagement approvals. Do not choose an annual review or an outside peer review.
Tip 5: Watch the timing distractors. The five-year requirement applies only to external assessments. Ongoing monitoring has no fixed interval because it is continuous. Results of internal assessments are reported to the board at least annually.
Tip 6: Do not mix up subjects. If the scenario is about evaluating management's controls, the topic is not QAIP ongoing monitoring. Ask yourself: is internal audit assessing its own quality, or someone else's?
Tip 7: Link to the purpose. When asked why ongoing monitoring exists, choose answers about ensuring conformance, continuous improvement and quality built into the work. Avoid answers about detecting fraud or satisfying regulators.
Tip 8: Conformance statements need more. If a question asks whether the CAE may say the activity conforms with the Standards based only on ongoing monitoring, the answer is no. External assessment results are also required.
Tip 9: Read for the best answer. Several options may sound reasonable. Pick the one that is most directly part of everyday operations and most closely tied to the IIA requirement.
6. Practice Questions
Question 1: Which of the following is the best example of ongoing monitoring in a QAIP?
A. A peer review by an outside audit firm every five years
B. Supervisory review and sign-off of engagement workpapers
C. An annual review of conformance by the compliance department
D. The external auditor's evaluation of internal audit work
Answer: B. Supervisory review is a routine, day-to-day part of engagement execution. A is an external assessment, C is a periodic assessment, and D is not part of the QAIP.
Question 2: Internal assessments must include which of the following?
A. External validation and benchmarking
B. Ongoing monitoring and periodic self-assessments
C. Continuous auditing and fraud risk assessments
D. Board evaluations and regulatory reviews
Answer: B.
Question 3: A CAE tracks report cycle times, budget-to-actual hours and post-engagement survey scores. This is best described as:
A. External quality assessment
B. Continuous auditing
C. Ongoing monitoring
D. Periodic self-assessment
Answer: C. These are routine performance metrics, which are typical ongoing monitoring tools.
Summary
Ongoing monitoring is the continuous, embedded part of internal audit's internal assessments. It works through supervision, review, checklists, KPIs and stakeholder feedback. It keeps quality high every day and supports continuous improvement. It is complemented by periodic self-assessments and external assessments at least every five years. On the exam, look for routine and day-to-day clues, place each activity in the right QAIP category, and do not confuse internal audit's quality monitoring with management's monitoring of controls.
