A quality assurance and improvement program is the part of an internal audit function that audits the function. Every chief audit executive knows one is required, most functions have a document called one, and a surprising number of those documents describe a program that has never actually run: a self-assessment that was performed once before the last external assessment, a set of performance measures nobody reports, and an engagement review process that consists of a manager’s initials. The Global Internal Audit Standards made the requirement harder to fake by naming its parts. Principle 8 puts the board in charge of quality and of the external assessment; Principle 12 requires internal assessment, performance measurement, and engagement-level oversight; and Standard 15.1 lets a report claim conformance only when the program supports the claim.
This playbook builds a program from nothing, in the order that works: what the Standards actually require and where the evidence has to live, the four layers of a working program and how they fit an annual cycle, the ongoing monitoring that runs inside every engagement, the periodic self-assessment against the Standards, the external assessment cycle from decision to board report, the annual quality report the board should see, and how all of it scales down to a function of three people without becoming theater. A six-person function, MidState Beverage’s, builds its program in ninety days as the worked example. The companion QAIP documentation kit supplies the workbook, checklist, and metrics sheet; the external quality assessment guide goes deeper on the assessment itself.
In this guide
- What the Standards require, and where the evidence lives
- The four layers and the annual cycle
- Layer 1: ongoing monitoring inside every engagement
- Layer 2: performance measures the board can read
- Layer 3: the periodic self-assessment against the Standards
- Layer 4: the external assessment cycle
- Reporting quality to the board, and disclosing nonconformance
- Right-sizing: what a three-person function does and skips
- Worked example: MidState builds its program in ninety days
- Common mistakes
What the Standards require, and where the evidence lives
The requirements are spread across three principles and one engagement standard, and the program should be designed backward from them: each requirement needs a place in the function’s records where an assessor can find the evidence that it was met. The table lists the requirements as the Standards state them, who carries them, and the artifact that proves them. The Domain III guide and Domain IV guide give the full text and context.
| Standard | Requirement | Who | Evidence an assessor will look for |
|---|---|---|---|
| 8.3 Quality | The CAE develops, implements, and maintains a quality assurance and improvement program covering all aspects of the function and conformance with the Standards; the board oversees it and receives the results | CAE; board | The written program; board minutes showing it was discussed and results received |
| 8.4 External Quality Assessment | An external assessment at least once every five years by a qualified, independent assessor or team, or a self-assessment with independent validation; the CAE discusses scope, frequency, and assessor qualifications with the board and communicates results and the action plan | CAE proposes; board approves | The engagement letter, assessor qualifications, the report, the action plan, board minutes |
| 12.1 Internal Quality Assessment | Ongoing monitoring of engagement performance plus periodic self-assessments of conformance with the Standards; results communicated to the board and senior management at least annually, with an action plan for nonconformance | CAE; quality lead or a manager not involved in the work assessed | Engagement QC records; the self-assessment workbook with ratings and evidence; the annual quality report |
| 12.2 Performance Measurement | Objectives and performance measures for the function, evaluated against the mandate, strategy, and plan, with results communicated to the board and used to improve | CAE | The measures, targets, the periodic results, and the board pack pages that carried them |
| 12.3 Oversee and Improve Engagement Performance | Supervision and review of every engagement so that objectives are met, quality is assured, and staff develop; documentation of the review | Engagement supervisors; CAE | Reviewer sign-offs and review notes cleared in the workpapers; coaching records |
| 9.3 Methodologies | Established methodologies that conform to the Standards and are updated when the Standards, the organization, or quality results change | CAE | The audit manual with revision history tied to assessment findings |
| 15.1 Final Engagement Communication | A report may state it was conducted in conformance with the Standards only when the program’s results support the statement; nonconformance affecting the engagement is disclosed | CAE | The conformance statement wording and the quality results that support it |
| Topical Requirements | Conformance is assessed as part of the quality program whenever the function performs assurance over a topic with a requirement in force | CAE; quality lead | Topical requirement checklists in the relevant engagement files; coverage in the self-assessment |
Two points of emphasis. The program covers “all aspects” of the function, which means governance and management as well as engagements: the charter, the plan, resources, and board communication are assessed alongside workpapers. And the board’s role is active: it does not merely receive the results, it discusses the scope and frequency of the external assessment and the qualifications of the assessor, which the charter guide suggests writing into the charter so that the conversation happens on schedule rather than when someone remembers.
The four layers and the annual cycle
A working program has four layers that operate at different frequencies and answer different questions. Ongoing monitoring runs inside every engagement and asks whether this piece of work meets the function’s standard. Performance measurement runs quarterly and asks whether the function is delivering what it promised. The periodic self-assessment runs annually and asks whether the function conforms to the Standards. The external assessment runs at least every five years and asks whether the function’s own answers can be believed. Each layer feeds the next, and the annual cycle below is how they fit together in a function that also has audits to deliver.
| Layer | Frequency | Question answered | Performed by | Output | Where it goes |
|---|---|---|---|---|---|
| 1. Ongoing monitoring | Every engagement, at planning, fieldwork, and reporting checkpoints | Does this engagement meet our standard and the Standards? | Engagement supervisor and manager; CAE spot checks | Cleared review notes, QC checklist, post-engagement survey, lessons log | Engagement file; quarterly roll-up to the CAE |
| 2. Performance measurement | Quarterly, with an annual view | Is the function delivering its plan, on time, to a quality the stakeholders recognize? | CAE or audit operations lead | Scorecard against targets | Audit committee pack each quarter |
| 3. Periodic self-assessment | Annually, light; in depth every two to three years and in the year before an external assessment | Do we conform to each standard, and what is the evidence? | Someone not involved in the work assessed: quality lead, a rotating manager, or a peer CAE for small functions | Standard-by-standard ratings with evidence and an action plan | Annual quality report to the board and senior management |
| 4. External assessment | At least every five years | Are the function’s own conclusions about its conformance reliable? | Qualified, independent assessor or team; or independent validation of the self-assessment | Assessment report with an overall opinion and recommendations; the CAE’s action plan | Board, senior management; conformance statement supported for the following cycle |
The cycle for a calendar-year function looks like this: quality checkpoints run inside every engagement all year; the scorecard is reported in each quarterly committee pack; the self-assessment is performed in the fourth quarter, after the year’s engagements have produced a full set of files to assess and before the next year’s plan and budget are set, so that its action plan can be resourced; the annual quality report goes to the committee with the year-end pack; and the external assessment is scheduled so that its fieldwork follows a full self-assessment by a few months. The internal audit department guide shows where the quality role sits in functions of different sizes.
Layer 1: ongoing monitoring inside every engagement
Ongoing monitoring is the layer most functions already half-have and rarely document. Supervisory review exists, but it is evidenced by initials; the reviewer’s notes are cleared and deleted; nobody asks the auditee what they thought; and the lessons from a difficult engagement live in the manager’s memory. Turning that into a program means three things: a checklist at each phase that records the review, a post-engagement survey and lessons entry, and a quarterly roll-up so the CAE sees the pattern rather than the incident.
| Checkpoint | What the reviewer confirms | Standards touched | Evidence retained |
|---|---|---|---|
| Planning | Objectives and scope link to the risk assessment; criteria identified; resources and hours set; the planning memo approved; Topical Requirement applicability decided; independence and objectivity confirmed for the team | 13.1 to 13.6; 2.1, 7.1; Topical Requirements | Signed planning memo; staffing memo with objectivity confirmations; the planning memo template carries the checklist |
| Fieldwork | Work program steps performed and cross-referenced; evidence sufficient, reliable, relevant, and useful; populations reconciled; exceptions investigated; workpapers meet the documentation standard; review notes raised and cleared | 14.1, 14.6; 12.3 | Reviewer sign-off on each workpaper; cleared review notes retained, not deleted |
| Reporting | Findings meet the five Cs with root causes; ratings consistent with the scale; recommendations address causes; management responses adequate; report meets the seven communication attributes; conformance statement supported | 14.2 to 14.5; 11.2; 15.1 | CAE approval; rating consistency check; report QC checklist |
| Close-out | Hours against budget with variance explanation; auditee survey issued and returned; lessons recorded; file locked and complete within the retention rule | 12.2, 12.3 | Time report; survey; lessons log entry; file completion certificate |
The one practice that changes the layer from paperwork into quality is retaining cleared review notes. A file that shows what the reviewer questioned and how the auditor resolved it is evidence of supervision that an assessor can read; a file with only initials is not. The workpaper best practices guide covers the documentation standard the fieldwork checkpoint enforces, and the auditee survey, six questions at most, gives the function the only external view of its work it will get between assessments.
Layer 2: performance measures the board can read
Standard 12.2 asks for measures against the mandate, the strategy, and the plan, and the mistake most functions make is choosing measures of activity: reports issued, hours charged, findings raised. Those tell the board the function was busy. The measures below tell it whether the function was effective, and each one has a target and a reason the board should care. Six to eight measures on one page, reported every quarter with the trend, is the right size; a dashboard of thirty is not read.
| Measure | Definition | Target range | What it tells the board |
|---|---|---|---|
| Plan delivery | Engagements reported by year end as a percentage of the approved plan, with deferrals explained | 85 to 95 percent | Whether promised coverage was delivered |
| Budget accuracy | Actual hours against budget by engagement | Within 10 percent on most engagements | Whether the function estimates honestly and the plan is realistic |
| Report cycle time | Days from end of fieldwork to draft, and draft to final | Draft within 15 business days; final within 10 of the draft | Whether findings reach management while they matter |
| Actions past due | Open management actions past their agreed date, as a percentage of open actions, and the count past due twice | Under 10 percent; none past due twice without escalation | Whether management acts and whether audit follows up |
| Validation coverage | High-rated actions closed on validated evidence as a percentage of high-rated actions closed | 100 percent | Whether closed means fixed; see the issue validation guide |
| Auditee survey | Average score on professionalism, understanding of the business, and fairness of findings | Consistently positive, with the fairness score tracked separately | Whether the function is respected as well as feared |
| Quality findings closed | Actions from the self-assessment and external assessment closed on schedule | All closed by the following annual report | Whether the program improves anything |
| Staff development | Credentials held or in progress; CPE compliance; retention against the organization’s rate | Every auditor with a development plan and CPE on track | Whether the function can keep the people it trained |
Layer 3: the periodic self-assessment against the Standards
The self-assessment is a standard-by-standard review of whether the function does what each standard requires, with evidence, a rating, and an action for every gap. It uses the three-level conformance scale that external assessors use, generally conforms, partially conforms, and does not conform, so that the function’s own view and the assessor’s are comparable. It is performed by someone who did not do the work being assessed: in a large function the quality lead, in a mid-sized one a manager assessing another manager’s engagements, in a small one a peer chief audit executive from another organization on a reciprocal basis. The CAE reviews and signs the result but does not rate their own function alone.
| Step | What is done | Time for a mid-sized function | Output |
|---|---|---|---|
| 1. Scope | Decide the year: a light assessment of the domains most likely to have changed, or the full Standards in depth; always full in the year before an external assessment | Half a day | Assessment plan |
| 2. Governance and management review | Read the charter, plan, risk assessment, budget, board papers, and methodologies against Domains III and IV; interview the CAE and the committee chair | Two to three days | Ratings and evidence for Principles 6 to 12 |
| 3. Engagement file review | Select a sample of completed engagements across auditors and types, usually five to eight, and review each against Domain V from planning memo to follow-up | One day per file | Ratings and evidence for Principles 13 to 15, with file-level observations |
| 4. Ethics and staff survey | Confirm Domain II practices: annual ethics attestations, objectivity confirmations, competence records, CPE | Half a day | Ratings for Principles 1 to 5 |
| 5. Stakeholder input | Short interviews with three to five executives and the committee chair on the function’s value and independence | One day | Qualitative input; often the most useful part of the exercise |
| 6. Rate and plan | Assign the conformance level to each standard with the evidence cited; write an action for each partial or nonconformance with owner and date | One day | The completed workbook and action plan |
| 7. Report | Summarize in the annual quality report; disclose nonconformance that affects the function’s scope or operation | Half a day | Board paper |
The engagement file review is the heart of it and the part that most functions under-scope. Five files reviewed properly, each against every applicable standard, tell an assessor more than a fifty-question survey answered by the CAE. The free Self-Assessment Hub on this site structures the standard-by-standard review; the documentation kit has the workbook layout with the evidence columns that make the ratings defensible.
Layer 4: the external assessment cycle
The external assessment is required at least once every five years, and the Standards allow two forms: a full external assessment by a qualified, independent assessor or team, or a self-assessment with independent validation, in which the function performs the full assessment and an independent assessor tests its work and opinion. The full form is the norm for larger and regulated functions; the validated self-assessment is a legitimate and cheaper route for smaller ones, provided the validator is independent and competent and the board agreed to the approach. Both end in a written report with an overall conformance opinion, and the report is the document the audit committee will cite when asked whether its internal audit function is any good.
| Stage | Timing before fieldwork | What happens | Decision or output |
|---|---|---|---|
| Board discussion | 18 months | The CAE proposes scope, form (full or validated self-assessment), timing, and assessor qualifications; the board discusses and approves, as Standard 8.4 requires | Minuted approval; budget line |
| Assessor selection | 12 months | Candidates: the IIA’s quality services, a peer team of experienced CAEs, or a firm with assessors who hold the CIA and have led assessments; independence confirmed (no recent consulting to the function, no reporting relationship) | Engagement letter; assessor qualifications on file for the board |
| Full self-assessment | 6 to 9 months | The function performs the in-depth self-assessment described above, closes what it can, and documents the rest with dated action plans | Self-assessment workbook; action plan; a candid list of known gaps |
| Document request | 2 months | The assessor requests the charter, plan, risk assessment, methodologies, sample of files, board papers, staff records, surveys, prior assessment; the function assembles them in the order of the Standards | Indexed evidence pack |
| Fieldwork | 0 | File reviews, interviews with the CAE, staff, executives, and the committee chair, and a stakeholder survey; one to three weeks depending on size | Preliminary observations meeting |
| Report | Plus 1 to 2 months | Overall opinion, standard-by-standard conformance, recommendations, and successful practices; the CAE’s action plan attached | Board paper; the basis for the conformance statement for the next five years |
| Follow-up | Plus 12 months | Actions tracked in the function’s own issue log and reported closed in the next annual quality report | Closed actions; next cycle date set |
Two practical notes. The function should never be surprised by an external assessment’s findings; if the self-assessment was honest, the assessor’s report confirms it and adds perspective, and an assessment that finds something the self-assessment missed is itself a finding about the program. And the fee is real money, a five-figure sum for a full assessment of a small function and more with size and geography, which is why the board approves it eighteen months out and why the validated self-assessment exists. The external assessment guide covers the preparation in detail.
Reporting quality to the board, and disclosing nonconformance
The board sees quality in three places: the scorecard in every quarterly pack, the annual quality report, and the external assessment report when it arrives. The annual report is the one most functions do not produce, and the Standards’ requirement that internal assessment results reach the board at least annually makes it mandatory rather than optional. It is short, four to six pages, and it follows the outline below; the audit committee deck template shows where it sits in the year-end pack.
| Section | Content | Length |
|---|---|---|
| Conformance statement | Whether the function conforms to the Global Internal Audit Standards, on what basis (the self-assessment and the most recent external assessment), and any nonconformance | One paragraph |
| Program summary | What the program consisted of this year: engagements reviewed, self-assessment scope, surveys, external assessment status and next date | Half a page |
| Self-assessment results | Conformance by domain, the standards rated partial or nonconforming, and the actions with owners and dates | One to two pages |
| Performance measures | The year’s scorecard against targets with trend and commentary | One page |
| Improvements made | Methodology changes, training, tooling, and prior-year quality actions closed | Half a page |
| Stakeholder feedback | Survey results and the themes from executive interviews, including criticism | Half a page |
| Resources and independence | Any impairment, resource shortfall, or scope limitation and its impact, as Standards 7.1, 8.2, and 10.1 require | One paragraph |
| Next year | The program plan and the external assessment date | One paragraph |
Nonconformance disclosure has a defined content. When the function does not conform to a standard in a way that affects its overall scope or operation, the CAE communicates to the board and senior management the standard concerned and the circumstances, the actions taken or planned, the impact on the function’s work and on stakeholders’ reliance, and the rationale for the position. The same content, scaled to the engagement, goes into any report whose engagement was affected. Functions are reluctant to write these paragraphs and should not be: a disclosed, planned, dated nonconformance is a program working; an undisclosed one found by an assessor is a governance failure.
Right-sizing: what a three-person function does and skips
The Standards apply in full to every function, but they require conformance, not bureaucracy, and a three-person function that runs the program below conforms as fully as a hundred-person one with a quality department. The table sets out what changes with size and what does not.
| Element | One to three people | Four to ten | Ten to thirty | Thirty or more |
|---|---|---|---|---|
| Engagement QC | The head reviews every file against a one-page checklist; co-source reviewer for the head’s own work | Manager review with retained notes; CAE spot-checks | Two-level review; quality lead samples files | Quality team samples files across regions; standardized QC tooling |
| Performance measures | Four measures on half a page, quarterly | Six to eight measures, quarterly | Scorecard with trend, quarterly | Scorecard by portfolio and region |
| Self-assessment | Annual, performed with a reciprocal peer CAE; the head does not self-rate alone | Annual, performed by a manager over another manager’s work; full every two to three years | Annual by the quality lead; full before each external assessment | Rolling program by the quality team; every domain each year |
| External assessment | Validated self-assessment with an independent validator, every five years | Validated self-assessment or full assessment, board’s choice | Full external assessment every five years | Full external assessment; often more frequent by policy |
| Board reporting | Annual quality report, two pages; scorecard in the pack | Annual report, four pages | Annual report with domain detail | Annual report plus a quality dashboard |
| Documentation | One workbook, one checklist, one metrics sheet | The documentation kit as published | Audit management system modules | Dedicated quality management tooling |
| What never scales down | A written program approved by the board; retained evidence of supervision; someone other than the CAE alone rating conformance; the five-year external assessment; the annual report to the board; disclosure of nonconformance | |||
Worked example: MidState builds its program in ninety days
MidState Beverage’s internal audit function is six people: a chief audit executive, a manager, two seniors, a staff auditor, and an analytics auditor. When the audit committee asked, after the FY27-01 route cash report, whether the function conformed to the Standards, the honest answer was that the only evidence was a questionnaire the previous chief audit executive had completed alone, with nothing behind the answers. The CAE built the program in ninety days alongside the plan, on a budget of about 120 hours, and the sequence below is the one that worked. The first external assessment was scheduled for FY28, eighteen months out, with the board’s approval minuted.
| Days | Work | Hours | Result |
|---|---|---|---|
| 1 to 15 | Write the two-page program document; adopt the engagement QC checklist at three checkpoints; instruct managers to retain cleared review notes; add a six-question auditee survey to every report | 20 | Program approved by the audit committee at its next meeting; QC live on the two engagements in fieldwork |
| 16 to 30 | Define six performance measures with targets and pull the FY26 baseline: 10 of 11 planned engagements delivered; hours within 8 percent; median 18 days to draft and 12 to final; 3 of 14 open findings past due; survey not previously collected; no quality actions to close | 15 | First scorecard in the next quarterly pack, with the baseline and targets side by side |
| 31 to 60 | Full self-assessment: the CAE and manager assess Domains III and IV together; a peer CAE from a regional bank, on a reciprocal arrangement, reviews four engagement files against Domain V; staff attestations gathered for Domain II | 60, plus the peer’s 16 | Three partial conformances: 9.4, because the risk assessment behind the plan was not fully documented; 12.2, because no performance measures had existed; 15.2, because follow-up had no defined process and closed on management’s word |
| 61 to 75 | Action plan: document the risk assessment methodology and the universe scoring; adopt the scorecard as the 12.2 measures; write the validation procedure and make validation its own engagement in the FY27 plan, which became engagement seven | 15 | All three actions owned, dated, and in the function’s own issue log |
| 76 to 90 | Annual quality report drafted to the outline above, including the three partial conformances and the statement that the function’s reports would not claim conformance until the actions closed and the FY28 external assessment confirmed it | 10 | Report to the audit committee; conformance statement deferred, honestly, for one year |
The decision that mattered was the last one. The CAE could have written “conducted in conformance with the Global Internal Audit Standards” on the next report, as the previous CAE had for years, and nobody would have challenged it. Instead the committee was told that the function had three partial conformances, what they were, when they would close, and that the statement would return when the program supported it. The committee’s reaction, recorded in the minutes, was that it was the first time anyone had shown them evidence about the function rather than assertions, and it approved the FY28 external assessment budget at the same meeting. That is what a quality program is for. The audit plan guide shows how the 9.4 action was closed, and the issue log template is where the function tracked its own three findings alongside management’s.
Common mistakes
| Mistake | What it looks like | Fix |
|---|---|---|
| A program document with no program | A policy describing monitoring, self-assessment, and measures that nobody performs | Build the four layers into the calendar with owners; the document describes what happens, not what should |
| The CAE rates the function alone | A self-assessment that is the CAE’s opinion of the CAE’s work | Someone not involved assesses; a peer CAE for small functions |
| Review notes deleted | Files show initials and nothing else | Retain cleared notes; they are the evidence of supervision |
| Activity measures | Reports issued, hours charged, findings raised | Delivery, timeliness, closure, validation, survey, quality actions closed |
| Claiming conformance on faith | The statement appears in every report; nothing supports it | Tie the statement to the assessment results; defer it when they do not support it |
| Self-assessment only before the external assessment | Once every five years, in a panic | Annual, light; full every two to three years |
| Nonconformance hidden | Known gaps left out of the board report | Disclose with circumstances, actions, impact, rationale; the disclosure is the program working |
| The external assessment as an event | No board discussion until the assessor is chosen; no self-assessment beforehand | Board discussion eighteen months out; full self-assessment first; assessor independence documented |
| Actions from quality findings untracked | Assessment recommendations acknowledged and forgotten | Log them with management’s findings, validate closure, report them closed to the board |
| Bureaucracy in a small function | A three-person team running a thirty-page quality manual | One workbook, one checklist, one metrics sheet, one annual report; the Standards require conformance, not paperwork |
A quality program is the function holding itself to the standard it holds everyone else to. Built as four layers on an annual cycle, evidenced the way the function would expect an auditee to evidence a control, and reported to the board with the same candor the function expects of management, it takes a few percent of the function’s hours and returns the one thing an internal audit function cannot buy: a board that has reason to believe what it is told.
Related guides
- The QAIP documentation kit: self-assessment workbook and quality metrics sheet
- Preparing for an external quality assessment
- Self-Assessment Hub (free tool)
- Global Internal Audit Standards overview
- GIAS Domain III: governing the function
- GIAS Domain IV: managing the function
- GIAS Domain V: performing engagements
- Inside the internal audit department
- Workpaper best practices
- Audit planning memo template
- The CAE’s audit committee deck template
- How to write an internal audit charter
- CIA Part 3: quality is Domain C
- Start here
Leave a Reply