Quality Assurance and Improvement Program (QAIP): Preparing for an External Quality Assessment

Every professional internal audit function must adhere to standards that maintain objectivity, credibility, and continuous enhancement. Among these requirements is the Quality Assurance and Improvement Program (QAIP), a framework ensuring ongoing monitoring of the internal audit activity’s quality. An essential component of the QAIP is an External Quality Assessment (EQA), mandated by The Institute of Internal Auditors (IIA) at least once every five years. Yet many Chief Audit Executives (CAEs) and audit leaders find the EQA process challenging—unsure how best to prepare, gather evidence, or address potential gaps before the review begins.

This comprehensive guide demystifies the EQA process for internal audit leaders. We’ll explore what external reviewers typically look for, how to align your internal audit practices with IIA Standards, and a detailed roadmap for prepping your function so you can benefit from the assessment. Beyond mere compliance, a well-orchestrated QAIP and a successful EQA can significantly enhance your team’s credibility, refine processes, and reinforce stakeholder confidence—particularly the audit committee’s belief in your function’s effectiveness.

---

Why External Quality Assessments Matter

The IIA Standards and Mandatory EQA

Under the IIA’s International Standards for the Professional Practice of Internal Auditing, every internal audit function must develop and maintain a QAIP covering all aspects of the internal audit activity. This includes both:

1. Ongoing Internal Monitoring – Day-to-day reviews of methodology, workpaper quality, performance metrics, and continuous improvements.
2. Periodic Self-Assessments – Structured internal reviews evaluating conformance with standards.
3. External Quality Assessment (EQA) – At least every five years, an independent party must review and report on the internal audit function’s conformance with IIA Standards and best practices.

Benefits of a Successful EQA

1. Enhances Credibility: Demonstrates to senior management, the board, or the audit committee that your function meets global professional norms.
2. Identifies Improvement Areas: External reviewers can uncover blind spots or inefficiencies in your processes—often suggesting new tools, methods, or alignment with cutting-edge practices.
3. Fosters Stakeholder Trust: Directors, external regulators, or shareholders may take confidence in an IA function recognized as globally conforming.
4. Encourages Ongoing Professional Growth: Teams get insights into advanced techniques or training needs, promoting a culture of continuous excellence.

Potential Consequences of Not Preparing

• Non-Conformance Findings: If you have known gaps—like incomplete documentation or unclear independence lines—unaddressed, the EQA might reveal them publicly, undermining your credibility.
• Delays or Extra Cost: Last-minute scrambles to assemble evidence can extend the review or lead to incomplete outcomes.
• Missed Opportunities: Without proactive enhancements before the EQA, you risk an unproductive “check-the-box” exercise, rather than gleaning real strategic value.

Thus, putting concerted effort into preparation ensures you meet the letter of the Standards and realize the full advantage: a stronger, more agile internal audit function.

---

Understanding the Components of QAIP and EQA

1. QAIP – Encompasses:

• Ongoing Monitoring: Routine checks on engagement performance, timely documentation reviews, staff feedback, and Key Performance Indicators (KPIs).
• Periodic Self-Assessments: Formal reviews (annually or every other year) examining alignment with IIA Standards or departmental policies.
• External Assessments: Independent appraisals, either as a full external or a self-assessment validated by an external reviewer.

2. External Quality Assessment – Evaluates:

• Conformance with IIA Code of Ethics and Standards: Independence, objectivity, proficiency, and due professional care.
• Audit Planning and Execution: Engagement scoping, resource allocation, fieldwork quality, and risk-based approaches.
• Reporting and Follow-Up: Clarity in communications, timeliness, and the procedure for verifying management’s actions.
• Organizational Positioning: Is the CAE’s reporting structure conducive to independence? Are there conflicts of interest?
• Use of Technology and Tools: Data analytics adoption, documentation solutions, or GRC tools, as relevant.
• Continuous Improvement: Whether the internal audit function actively pursues training, innovation, and process refinements.

Reviewers compile observations, assign a rating (often “Generally Conforms,” “Partially Conforms,” or “Does Not Conform”), and share improvement suggestions, typically culminating in a formal report for management and the board.

---

Step-by-Step Preparation for an External Quality Assessment

1. Initiate Self-Assessment and Gap Analysis

Before external reviewers arrive, an internal self-check is vital:

1. Assemble an Internal QA Team
   • Choose senior auditors or managers intimately familiar with the function’s methods and the IIA Standards.
   • If needed, engage an objective internal champion from compliance or risk management to ensure impartial oversight.
2. Review Existing Policies and Procedures
   • Check that your internal audit charter is current, reflecting changes in the function’s scope, authority, or reporting lines.
   • Revisit your QAIP documentation: how do you track performance metrics, staff competency, or internal peer reviews?
3. Compare Against the IIA Standards
   • Focus on areas commonly under scrutiny: engagement planning, independence, continuing professional education, documentation completeness, and follow-up on recommendations.
   • Mark any self-identified shortfalls: e.g., “We occasionally skip supervisory sign-off on smaller engagements,” or “We do not systematically assess staff’s continuing education credits.”
4. Draft an Action Plan
   • For each potential gap, define clear corrective steps. This might involve updating templates, clarifying procedures on independence, or implementing a formal risk-based annual plan.
   • Assign owners and timelines. The external reviewers will note if you’re actively addressing known deficiencies versus ignoring them.

Outcome: A documented self-assessment that reveals where your function stands. This also shows external assessors you’re proactive and self-aware, typically a positive signal.

2. Update and Organize Documentation

Documentation is central to any internal audit activity, but thorough, easily retrievable records impress external reviewers and simplify their job:

1. IA Charter and Manuals
   • Ensure the internal audit charter references the latest IIA Standards. Outline the CAE’s independence, authority, and the function’s responsibilities.
   • If you have a departmental manual, verify it’s updated with current practices for planning, fieldwork, reporting, or using analytics.
2. Engagement Files
   • Standardize naming conventions across all engagement workpapers (digital or paper-based).
   • Confirm each file (scope memo, risk assessment, test plans, results, and final reports) is complete. Missing or unfiled documentation can invite negative commentary.
3. Performance and KPI Tracking
   • If your QAIP includes periodic metrics (like cycle times, budget vs. actual hours, or stakeholder satisfaction), centralize these metrics.
   • Provide an easy-to-navigate summary so reviewers can see trends and any improvement actions taken.
4. Evidence of Changes or Enhancements
   • Keep records of recent improvements (e.g., newly introduced data analytics procedures, staff training, or a revised risk-based approach). This demonstrates continuous improvement to the EQA team.

Outcome: A well-organized library of up-to-date policies, engagement documentation, and performance data that EQA reviewers can reference quickly. This fosters an impression of diligence and competence.

3. Address Known Gaps Through a Pre-EQA Improvement Phase

Any issues uncovered during your self-assessment or discovered organically—like incomplete continuing education records or suboptimal stakeholder engagement—should be corrected before the official EQA. Common examples:

• Improving Independence
  • If the CAE functionally reports to the CFO in practice, but the Charter says they should report to the audit committee, rectify the reporting lines or clarify them in official documents.
  • Document how conflicts of interest are avoided or mitigated.
• Sharpening Risk-Based Audit Planning
  • If your annual audit plan lacks a formal risk assessment linking engagements to strategic risks, incorporate a documented risk scoring methodology.
  • Communicate the revised plan to senior leadership or the audit committee to show you’re adopting best practices.
• Formalizing Follow-Up Procedures
  • Some teams fail to systematically track management action plans. Introduce a robust follow-up schedule with due dates, progress tracking, and escalation protocols.
• Enhancing Workpaper Consistency
  • If your staff uses varying templates for engagement scoping or testing, unify them into a single consistent format. Provide training to ensure uniform adoption.
• Professional Development
  • If staff lacks certain certifications or continuing education hours, schedule training or reimburse relevant programs. The EQA team often checks staff qualifications and the function’s investment in skill-building.

Acting on these improvements pre-emptively not only aligns you with the IIA Standards but also underscores a commitment to quality and progress. The EQA team is likely to see partial improvements positively, even if you’re in the process of fully implementing new measures.

4. Select an External Reviewer

The IIA Standards permit multiple approaches:

• A Full External Assessment by a qualified, independent reviewer or review team.
• A Self-Assessment with Independent External Validation.

Key Considerations:

1. Reviewer Qualifications: Check whether the individuals have prior CAE experience, recognized certifications (CIA, CRMA), or strong familiarity with your industry.
2. Independence: Avoid conflicts of interest (e.g., if the prospective reviewer provided consulting services to your function recently, it may compromise perceived objectivity).
3. Methodology: Different reviewers approach the EQA differently—some do intense onsite visits, others rely heavily on interviews plus sampling. Ask about their methodology upfront.
4. Timeline and Budget: Clarify the project scope, the number of interviews or engagements they’ll review, and cost implications. Ensure the schedule aligns with your board or management’s expectations.

In many cases, you may choose a reputable consulting firm with robust internal audit practices or an IIA-approved provider. Some CAEs also prefer peer reviews (reciprocal arrangements with another organization’s CAE) to contain costs, though formal independence must be preserved.

5. Coordinate Logistics and Communicate with Stakeholders

Once your chosen EQA reviewer is onboarded, plan the actual review timeline:

• Define the Scope: Confirm which engagements from the past year or two they’ll examine in detail. Provide them with a list of completed audits, along with the associated objectives, risk levels, or complexities.
• Interview Schedules: The reviewer typically wants to speak with key stakeholders—like the CFO, audit committee chair, a sample of senior managers, and internal audit staff at various levels. Coordinate these interviews, ensuring minimal disruptions.
• Share Preliminary Documentation: Send or grant secure access to relevant policies, procedures, and selected engagement files, so the review team can prep before interviews.
• Brief Your Internal Audit Team: Let them know what to expect from the EQA process, encouraging openness and honest discussions. If your function fosters a blame-free culture, staff members will provide genuine feedback to reviewers.

Establish a single point of contact for the external assessors (often the CAE or a designated audit manager) to streamline queries and requests.

---

The External Quality Assessment in Practice

On-Site or Virtual Fieldwork

EQA teams typically spend anywhere from a few days to a few weeks (depending on the size of your IA function) analyzing documentation, interviewing staff and stakeholders, and validating conformance to the IIA Standards. This can be on-site or partially remote:

1. Documentation Review
   • The assessors examine your QAIP, engagement workpapers, staff training records, and performance metrics.
   • They might pick random samples of engagements or focus on your highest-risk, highest-complexity ones.
2. Interviews
   • The EQA team meets with the audit committee chair or key board members to gauge satisfaction with your function and independence.
   • Senior management discussions reveal whether internal audit is recognized as adding strategic value.
   • Internal audit staff interviews highlight culture, skill levels, and consistency of methodology.
3. Observing or Spot-Checking
   • Some EQA teams might virtually observe a portion of your daily QA or engagement close-out meeting to see real-time processes.
   • If compliance with certain procedures is questioned, they could do in-depth sampling or ask for demonstration of your data analytics approach.

Preliminary Feedback

Many external reviewers offer a preliminary debrief near the end of their on-site or virtual visit:

• Immediate Observations: The EQA lead might highlight major strengths, such as robust risk-based planning or advanced analytics usage.
• Potential Areas of Non-Conformance: They’ll flag where you need adjustments—for example, if your function lacks documentation for continuing professional education.
• Opportunity for Clarification: If the reviewer misunderstood a procedure or missed certain evidence, this is your chance to correct any misconceptions.

---

Post-Assessment: Report, Ratings, and Action Plans

The Formal EQA Report

Most EQA teams provide a structured report referencing:

1. Overall Conformance Rating: Typically “Generally Conforms,” “Partially Conforms,” or “Does Not Conform” to the IIA Standards.
2. Detailed Observations: Broken down by standard category (e.g., independence, proficiency, engagement planning).
3. Recommendations: Practical suggestions for bridging gaps, adopting best practices, or further innovating.
4. Commendations or Strengths: Areas where you exceed typical industry norms—helpful to highlight successes internally.

Board and Stakeholder Communication

• Share the Report: Typically, the CAE presents EQA findings to the audit committee, plus senior management. Summaries might appear in the function’s annual report or organizational governance updates.
• Positive Messaging: Emphasize that the EQA is part of your ongoing improvement journey. Even if some partial conformance findings exist, show that you already have or will implement a plan to fix them.
• Reassurance: Boards often want confirmation that the function’s independence and objectivity remain intact—highlight any reviewer feedback endorsing the function’s governance alignment.

Follow-Up and Ongoing Enhancement

• Develop a Formal Action Plan: Align each recommendation with a timeline and responsible owners. Possibly integrate these tasks into your QAIP or departmental improvement roadmap.
• Monitor Progress: Similar to how you track management action plans from internal audits, track your own improvement steps from the EQA.
• Align With Next EQA Cycle: The impetus from an EQA shouldn’t be a one-off. Instead, treat these insights as part of a multi-year maturity strategy, ensuring future external assessors see consistent growth.

---

Additional Tips for a Successful EQA Experience

1. Involve the Audit Committee Early
   • Boards want transparency about external reviews. Proactively mention your approach, selection of reviewers, and readiness. Their buy-in can facilitate additional resources if needed.
2. Facilitate Openness
   • Encourage staff and stakeholders to be candid with reviewers. EQA isn’t an exercise in blame but a chance to refine your function.
   • Provide safe channels for staff to share their experiences or concerns confidentially.
3. Document Lessons Learned
   • After the EQA, hold an internal “lessons learned” meeting. Summarize what worked well (like robust data analytics) and what you want to improve (like more consistent follow-up processes).
   • Keep a knowledge repository for staff reference so the entire team grows from the EQA feedback.
4. Consider a Mock Review
   • Some organizations do a short pilot with an external consultant or internal peer to identify major weaknesses before the official EQA.
   • This preview can drastically reduce negative surprises or time spent scrambling during the actual external assessment.
5. Celebrate Milestones
   • If the EQA results show “Generally Conforms,” applaud the team’s collective effort. Use the momentum to champion new training or tool investments.

---

Final Thoughts

An External Quality Assessment isn’t just about fulfilling a five-year compliance requirement. When approached thoughtfully, it can become a catalyst for:

• Elevated Stakeholder Confidence: Management and boards see that your internal audit function aligns with global best practices.
• Refined Methodologies: EQA feedback spurs improvements in risk-based planning, documentation, analytics adoption, and follow-up.
• Empowered Audit Staff: Team members get professional validation and a renewed sense of pride, seeing tangible examples that they’re part of a best-in-class function.
• Enhanced Organizational Value: By reinforcing independence, credibility, and alignment with strategic goals, your internal audit department becomes a stronger partner in driving governance, risk management, and ethical culture.

In short, the QAIP—and specifically the EQA—should be a cornerstone of your continuous improvement journey. With deliberate preparation—self-assessments, tackling known gaps, thorough documentation, and judicious choice of external reviewers—you’ll emerge from the EQA with not just a compliance check, but a blueprint for the next stage of your internal audit maturity. Ultimately, the most successful CAEs and audit managers see the EQA as a rewarding opportunity to sharpen their team’s relevance and value proposition in today’s evolving corporate landscape.

---