Purpose of the Quality Assurance and Improvement Program

Purpose of the Quality Assurance and Improvement Program (QAIP): A Complete CIA Part 3 Guide

Introduction
The Quality Assurance and Improvement Program (QAIP) is how an internal audit function checks its own work. Internal auditors spend their careers evaluating whether other functions are effective, efficient and compliant. The QAIP turns that same discipline inward. For the CIA exam, you need to know why the QAIP exists, what it contains, how it operates and who is responsible for it. Questions often test the purpose of the program rather than procedural detail, so understanding the 'why' is essential.

1. Why the QAIP Is Important
The QAIP matters for several reasons:
• Credibility and trust: The board, senior management and external stakeholders rely on internal audit's assurance. A QAIP shows that this assurance is produced to a professional standard.
• Conformance with the Standards: The Institute of Internal Auditors (IIA) requires every internal audit function to have a QAIP. Without one, the function cannot credibly claim conformance with the Standards.
• Continuous improvement: The QAIP is designed to improve the function, not only to catch errors. It helps internal audit add more value over time.
• Accountability to the board: Results are communicated to senior management and the board. This supports the board's oversight of internal audit.
• Risk management for internal audit itself: Poor-quality audits can lead to missed risks, wrong conclusions and reputational damage. The QAIP reduces this risk.
• Professional reputation: External assessments benchmark the function against leading practice. This strengthens its standing within the organization.

2. What the QAIP Is
The QAIP is a program developed and maintained by the Chief Audit Executive (CAE). It covers all aspects of the internal audit activity. Its core purposes are:
• To evaluate conformance with the IIA's Standards. Under the 2017 IPPF this meant the Definition of Internal Auditing, the Standards and the Code of Ethics. Under the 2024 Global Internal Audit Standards it means the Standards, which now include the ethics principles.
• To assess efficiency and effectiveness of the internal audit activity.
• To identify opportunities for improvement.
• To evaluate achievement of the internal audit mandate and charter, including progress toward the function's objectives and performance measures. This is emphasized in the 2024 Standards.

Standards references
• 2017 IPPF: Standard 1300 (Quality Assurance and Improvement Program), 1310 (Requirements of the QAIP), 1311 (Internal Assessments), 1312 (External Assessments), 1320 (Reporting on the QAIP), 1321 (Use of 'Conforms with the Standards') and 1322 (Disclosure of Nonconformance).
• 2024 Global Internal Audit Standards: Principle 8 (Overseen by the Board), especially Standard 8.3 (Quality) and 8.4 (External Quality Assessment). Also Principle 12 (Enhance Quality): Standard 12.1 (Internal Quality Assessment), 12.2 (Performance Measurement) and 12.3 (Oversee and Improve Engagement Performance).

3. How the QAIP Works
A. Internal assessments
Internal assessments have two parts:
• Ongoing monitoring: This is built into day-to-day operations. Examples include engagement supervision, workpaper review, standard methodologies and checklists, and feedback surveys from audit clients. It also includes key performance indicators such as cycle time, recommendations accepted and plan completion.
• Periodic self-assessments: These are carried out by members of the function or by others in the organization who know internal audit practices. They evaluate conformance with the Standards and the effectiveness of the function, often annually.

B. External assessments
• External assessments must be conducted at least once every five years.
• They are performed by a qualified, independent assessor or assessment team from outside the organization.
• There are two forms:
  1. A full external assessment.
  2. A self-assessment with independent external validation (SAIV).
• The CAE must discuss the following with the board:
  - the form and frequency of the assessment;
  - the qualifications and independence of the assessor, including any potential conflicts of interest.
• Under the 2024 Standards, the board should approve the plan for the external assessment. At least one assessor must hold an active CIA designation.
• Independence means no actual or perceived conflict of interest. For example, a former employee within a recent period, or another unit of the same organization, would not qualify.

C. Reporting results
• The CAE communicates QAIP results to senior management and the board. This covers internal assessments periodically and external assessments upon completion.
• Reports include the scope and frequency of assessments, the qualifications and independence of assessors, conclusions, and corrective action plans.

D. Conformance claims and disclosure
• The function may state that it 'conforms with the Standards' only if the results of the QAIP support that statement. This includes an external assessment within the past five years.
• When nonconformance affects the overall scope or operation of the function, the CAE must disclose to senior management and the board:
  - the nature of the nonconformance;
  - the reason for it;
  - its impact.

E. Responsibility
• The CAE is responsible for developing, maintaining and owning the QAIP.
• The board oversees it and receives the results.
• Individual auditors contribute through their engagement work and supervision.

4. Key Distinctions to Remember
• Quality assurance vs. improvement: Assurance confirms conformance and effectiveness. Improvement drives enhancement. The QAIP does both.
• Ongoing vs. periodic: Ongoing monitoring is continuous and embedded in daily work. Periodic reviews are point-in-time self-assessments.
• Internal vs. external: External assessments add objectivity and benchmarking. They are mandatory at least every five years.
• Scope: The QAIP covers the entire internal audit activity, including governance, staffing, methodology and engagements. It is not limited to individual engagements.

Exam Tips: Answering Questions on Purpose of the Quality Assurance and Improvement Program
1. Remember the three-part purpose. The QAIP evaluates conformance with the Standards, assesses efficiency and effectiveness and identifies opportunities for improvement. If an answer choice captures these, it is usually correct.
2. Reject narrow answers. Be wary of options saying the purpose is only to detect fraud, evaluate individual auditors' performance for compensation, satisfy external regulators or reduce audit costs. These are not the primary purpose.
3. Know the numbers. External assessments are required at least once every five years. Internal assessments are ongoing plus periodic.
4. Identify who is responsible. The CAE develops and maintains the QAIP. The board receives the results and provides oversight. If a question asks who 'owns' the QAIP, choose the CAE.
5. Classify activities correctly. Supervision, workpaper review and client surveys are ongoing monitoring. An annual internal review against the Standards is a periodic self-assessment. A review by an outside firm is an external assessment.
6. Test independence of assessors. Questions may describe an assessor from a sister subsidiary, a recently retired CAE of the same company or the external financial auditor with conflicts. These are not sufficiently independent. Choose the option with no conflict of interest.
7. The 'conforms' statement. It is allowed only when QAIP results, including a current external assessment, support it. If no external assessment occurred within five years, the claim cannot be made.
8. Nonconformance disclosure. When nonconformance affects overall scope or operation, disclose the nature, reason and impact to senior management and the board. Do not hide it, and do not merely fix it silently.
9. Look for the 'improvement' angle. When two answers seem correct, the one stressing continuous improvement and value-add is often preferred over one focused purely on compliance.
10. Watch for 'all aspects'. The QAIP covers the whole internal audit activity. Answers limiting it to 'engagement workpapers only' are typically wrong.
11. Be aware of both frameworks. Know the 2017 IPPF numbers (1300 series) and the 2024 Global Internal Audit Standards (Standards 8.3, 8.4 and 12.1 to 12.3). Focus on concepts, which are consistent across both.
12. Use elimination. Read the question stem for keywords such as 'primary purpose', 'most appropriate' and 'best evidence'. Then eliminate options that are too narrow, assign responsibility to the wrong party or misstate frequency.

Quick Summary
The QAIP is the CAE's program for ensuring that internal audit conforms with the Standards, operates efficiently and effectively, and continuously improves. It relies on ongoing monitoring, periodic self-assessments and an independent external assessment at least every five years. Its results are reported to senior management and the board, and it supports any claim of conformance with the Standards. Master the purpose, the components, the responsibilities and the reporting rules, and you will handle QAIP questions confidently.