A quality program lives or dies on four documents. The self-assessment workbook records, standard by standard, what the function does, where the evidence is, and how it rates. The engagement QC checklist records that every engagement was reviewed at the three points where review matters. The quality metrics sheet records whether the function is delivering what it promised. And the annual quality report tells the board all of it in six pages. Functions that have these four in working order find external assessments uneventful; functions that do not spend the six months before an assessment inventing them. This kit supplies all four, with the guidance to build each in Excel or Word in an afternoon and a worked example from a six-person function.
The kit is the documentation companion to the QAIP playbook, which explains what the Global Internal Audit Standards require and how the four layers of a program fit an annual cycle; this guide is the artifacts themselves. Each template is presented in full, followed by drafting guidance and the decisions that shape it, and the worked example shows MidState Beverage’s completed workbook rows, QC checklist, first quarter of metrics, and annual report as they went to its audit committee. Templates are written to be copied and adapted; the free Self-Assessment Hub on this site runs the standard-by-standard review in the browser for functions that prefer it to a spreadsheet.
In this guide
- How the four documents fit together
- Template 1: the conformance self-assessment workbook
- Template 2: the engagement QC checklist
- Template 3: the quality metrics sheet
- The six-question auditee survey that feeds the metrics sheet
- Template 4: the annual quality report outline, with model statements
- Worked example: MidState’s completed kit
- Common mistakes
How the four documents fit together
| Document | Standards it evidences | Completed by | Frequency | Feeds |
|---|---|---|---|---|
| Self-assessment workbook | 12.1 internal assessment; 8.3 program coverage; supports the 15.1 conformance statement | Assessor not involved in the work assessed; CAE reviews | Annually, light; in full every two to three years and before an external assessment | The annual report; the action plan; the external assessor’s starting point |
| Engagement QC checklist | 12.3 oversight of engagement performance; Domain V conformance engagement by engagement | Engagement supervisor and manager; CAE at reporting | Every engagement, three checkpoints | The file; the quarterly roll-up of QC exceptions; the workbook’s Domain V evidence |
| Quality metrics sheet | 12.2 performance measurement; 8.1 board interaction | CAE or audit operations lead | Quarterly | The committee pack; the annual report; the plan and budget for next year |
| Annual quality report | 12.1 communication of results at least annually; 8.3 and 8.4 board oversight; nonconformance disclosure | CAE | Annually, with the year-end pack | Board minutes; the conformance statement for the year; the external assessment plan |
The connection to notice is the direction of evidence. The QC checklist produces evidence for the workbook’s Domain V rows; the metrics sheet produces evidence for the workbook’s Standard 12.2 row; the workbook produces the annual report’s conformance section; and the annual report produces the board minutes that the workbook’s Principle 8 rows cite next year. A kit built this way evidences itself, which is what an assessor is looking for when they ask how the function knows its program works.
Where the kit lives matters as much as what it contains. The workbook, the metrics sheet, and the annual reports sit in one quality folder in the function’s document system, retained for at least two external assessment cycles so that trend is visible; the QC checklists sit in each engagement file, with a quarterly extract of the exception counts copied to the quality folder. An external assessor should be able to be pointed at one folder and find the program’s entire history, and a new chief audit executive should be able to read the same folder and know within an hour where the function stands against the Standards and what the last three years of committees were told. The templates and downloads directory lists the engagement templates the checklist references.
Template 1: the conformance self-assessment workbook
The workbook is one Excel file with a summary tab and one tab per domain of the Standards, five in all, plus a tab for the Topical Requirements that apply. Every standard is a row; the columns are fixed so that ratings are comparable across years and assessors. The column dictionary below is the template; the rows that follow it show how a completed entry reads.
| Column | Content | Rule |
|---|---|---|
| A. Standard | Number and title, one per row (for example, 9.4 Internal Audit Plan) | Every standard in the domain, including those that appear not to apply; “not applicable” is a rating with a rationale, not a blank row |
| B. Requirement in brief | The “must” statements condensed to two or three lines | Paraphrase from the Standard’s own text; do not soften the verbs |
| C. Evidence expected | The artifact that would demonstrate conformance if it existed | Written before the assessment starts, so the assessor looks for evidence rather than reasons |
| D. Evidence found | Reference to the actual document, file, minute, or record, with date and location | A reference, not a description; “the charter, section 4, approved 14 Feb 2026, board minutes item 7” |
| E. Assessor observations | What the evidence shows and does not show; gaps in specific terms | Facts first; the observation must support the rating without further explanation |
| F. Rating | Generally conforms; partially conforms; does not conform; not applicable | Data validation list; definitions on the summary tab |
| G. Action | What will change to reach general conformance | Required for every partial or nonconforming rating; specific enough to validate later |
| H. Owner and due date | Named role and a date | The CAE owns governance actions; managers own engagement-level ones |
| I. Status | Open, in progress, closed with date | Closed only when evidence of the changed practice exists; the workbook is re-rated at the next assessment |
| J. Prior rating | Last assessment’s rating for the same standard | Trend at a glance; a standard that stays partial for two cycles is a governance issue |
Rating definitions (summary tab). Generally conforms: the function’s practices and documentation meet the requirements of the standard in all material respects; minor deviations do not affect the standard’s intent. Partially conforms: the function is making good-faith efforts to comply, but deficiencies in practice or documentation exist that fall short of the standard’s requirements and could affect the reliability of the function’s work. Does not conform: deficiencies in practice or documentation are so significant that the function is unable to meet the requirements of the standard. Not applicable: the standard does not apply to the function’s circumstances, with the rationale recorded in column E.
Sample completed rows. 6.2 Internal Audit Charter — Requirement: a charter establishing purpose, authority, position, scope, and services, approved by the board and reviewed periodically. Evidence expected: approved charter with board minute; evidence of periodic review. Evidence found: charter v4 dated 12 Feb 2026, board minute 26-02 item 5; review clause “annually”. Observations: charter conforms to the required content; last review 19 months before assessment despite the annual clause. Rating: partially conforms. Action: present the charter for review at the next committee meeting and calendar the annual review. Owner: CAE. Due: next quarter.
9.4 Internal Audit Plan — Requirement: a risk-based plan founded on a documented risk assessment performed at least annually, considering board and management input, approved by the board, updated as risks change. Evidence expected: documented risk assessment methodology and results; board approval; evidence of updates. Evidence found: FY27 plan approved (minute 26-11 item 3); universe scoring spreadsheet; no written methodology; management input recorded in the planning memo. Observations: the risk assessment exists but its methodology is undocumented, so the basis for scores cannot be reviewed. Rating: partially conforms. Action: document the risk assessment methodology and scoring criteria in the audit manual. Owner: CAE. Due: 90 days.
15.2 Confirming the Implementation of Recommendations or Action Plans — Requirement: a process to monitor and confirm implementation, with the extent of confirmation based on significance. Evidence expected: written follow-up procedure; validation records for closed actions. Evidence found: issue log maintained; 11 of 14 closures in the period evidenced by management email only. Observations: no documented procedure; closures rest on assertion for most items. Rating: partially conforms. Action: write the validation procedure; validate high-rated actions on evidence; add validation as a planned engagement. Owner: audit manager. Due: 60 days.
Building it in Excel takes an hour: one row per standard copied from the Standards’ table of contents, data validation on the rating column, a summary tab that counts ratings by domain with COUNTIF and lists every open action, and conditional formatting that colors partial and nonconforming rows. Two design decisions matter more than the formulas. Column C is written before the assessment, so the assessor is looking for evidence they defined in advance rather than rationalizing what they find; and column D is a reference rather than a description, so that an external assessor can go straight to the document. The Domain III, Domain IV, and Domain V guides supply the requirement summaries for column B.
Template 2: the engagement QC checklist
The checklist is one page in the front of every engagement file, completed at three checkpoints by the reviewer, not the preparer. Each item is a yes, no, or not applicable with a reference to where in the file the evidence sits; a “no” requires a note on what was done about it. The value of the checklist is not the ticks; it is that a reviewer must look at each item, and that the pattern of “no” answers across the year tells the CAE where the methodology or the training is failing.
Engagement QC checklist. Engagement: ________ Reference: ________ Lead: ________ Reviewer: ________
Checkpoint A: planning (complete before fieldwork begins). A1 Engagement objectives and scope link to the risk assessment and the approved plan, or the deviation is approved. A2 The engagement risk assessment is documented and the criteria for evaluation identified. A3 The work program covers the risks in scope with test steps, sample basis, and evidence requirements. A4 Resources, hours, and dates are set and match the budget in the plan. A5 Independence and objectivity are confirmed for every team member, including the one-year rule for prior operational responsibility. A6 Applicable Topical Requirements are identified and their requirements built into the program. A7 The planning memo is approved by the manager (and the CAE where required) before fieldwork. A8 The engagement communication to the auditee has been issued. Reviewer sign-off and date: ________
Checkpoint B: fieldwork (complete before the closing meeting). B1 Every work program step is either performed and cross-referenced or documented as not performed with a reason. B2 Populations used for sampling are reconciled to source and the completeness check is in the file. B3 Evidence for each conclusion is sufficient, reliable, relevant, and useful; inquiry alone supports no conclusion. B4 Information produced by the entity and relied on has been tested for completeness and accuracy. B5 Exceptions are investigated and the cause documented before being counted. B6 Workpapers meet the documentation standard: purpose, source, procedure, result, conclusion, preparer, reviewer, dates. B7 Review notes have been raised, cleared, and retained in the file. B8 Potential findings have been discussed with the process owner before the closing meeting. Reviewer sign-off and date: ________
Checkpoint C: reporting (complete before the report is issued). C1 Each finding states condition, criteria, cause, consequence, and corrective action, and the cause is a root cause, not the condition restated. C2 Ratings follow the scale and are consistent with comparable findings this year. C3 Recommendations address the root cause and name an owner with authority. C4 Management responses and action plans are adequate, with dates; disagreements are documented. C5 The report meets the seven attributes: accurate, objective, clear, concise, constructive, complete, timely. C6 Scope limitations are disclosed. C7 The conformance statement is used only if the quality program supports it. C8 The CAE has approved the report and the distribution list. C9 Hours against budget are recorded with variance explanation; the auditee survey is issued; lessons are logged. Reviewer sign-off and date: ________ CAE sign-off and date: ________
Drafting guidance. Keep it to one page; a checklist that runs to three is skipped. Items are phrased so that “yes” is conformance, which makes the quarterly count of “no” answers a direct quality measure. Item B7, retained review notes, is the one to insist on; it is the evidence of supervision an assessor reads first. The planning items track the planning memo template, the fieldwork items the workpaper example and IPE guide, and the reporting items the report template set and the root cause guide, so that the checklist enforces the function’s own methodology rather than a separate one.
Template 3: the quality metrics sheet
The metrics sheet is one Excel tab: measures down the side, quarters across the top, a target column, and a trend. It is filled from data the function already has, the time system, the issue log, the report log, the survey responses, and the QC checklists, and it takes an hour a quarter once the sources are set up. The definitions matter more than the layout, because a measure that can be calculated two ways will be calculated the flattering way.
| Measure | Definition and calculation | Source | Target | Note |
|---|---|---|---|---|
| Plan delivery | Engagements with a final report issued in the year, divided by engagements in the approved plan as amended by the board; deferrals listed by name | Plan; report log | 85 to 95 percent | Amendments count only if the board approved them |
| Budget accuracy | Absolute variance of actual to budgeted hours, by engagement, and the share of engagements within 10 percent | Time system | Most within 10 percent | Report both the average and the worst three |
| Cycle time to draft | Business days from the last fieldwork day to the draft report, median and maximum | Report log | Median 15 or fewer | The maximum is the number the committee remembers |
| Cycle time to final | Business days from draft to final, median and maximum | Report log | Median 10 or fewer | Long tails usually mean rating disputes |
| Actions past due | Open actions past the agreed date, divided by open actions; count past due twice | Issue log | Under 10 percent; zero past due twice unescalated | Re-dating an action without escalation counts as past due |
| Validation coverage | High-rated actions closed on validated evidence, divided by high-rated actions closed | Issue log | 100 percent | Closures on assertion are reported separately |
| Rework rate | Reports returned by the CAE for substantive rework, divided by reports issued | Report log; QC checklists | Declining | The clearest internal quality signal a small function has |
| QC exceptions | “No” answers on QC checklists, by item, per quarter | QC checklists | Declining; no repeat item two quarters running | Points at methodology or training gaps |
| Auditee survey | Mean scores on professionalism, understanding of the business, fairness of findings, and usefulness, on a five-point scale; response rate | Survey | Fairness tracked separately; response rate above 60 percent | Report comments verbatim to the CAE, themes to the committee |
| Staff development | Auditors with a credential or sitting for one; CPE compliance; departures in the period | HR records | All with development plans | Compare turnover with the organization’s rate |
| Quality actions closed | Open actions from the self-assessment and external assessment, and closures in the period | Workbook | All closed by the next annual report | The measure that shows the program improves anything |
Build guidance: one row per measure with the definition in a comment, one column per quarter, a target column, a conditional-format rule that shades cells outside target, and a sparkline for trend. Report the sheet as a single page in the committee pack with three lines of commentary; the numbers should explain themselves and the commentary should explain the exceptions. The internal audit department guide shows the same measures in the context of how a function is governed.
The six-question auditee survey that feeds the metrics sheet
Three of the measures on the metrics sheet depend on a survey, and the survey is the only view of the function’s work that comes from outside it between external assessments. It is sent to the process owner and the responsible executive within a week of the final report, it takes three minutes, and it asks six questions on a five-point scale plus one open comment. Longer surveys get lower response rates and no better information.
Post-engagement survey. Engagement: ________ Issued: ________ Please rate each statement from 1 (strongly disagree) to 5 (strongly agree). 1. The audit team understood our business and processes. 2. The team conducted itself professionally and communicated clearly throughout. 3. Requests for information and people were reasonable and coordinated. 4. Findings were discussed with us before the draft report and there were no surprises. 5. The findings and ratings were fair and supported by evidence. 6. The report and recommendations are useful to us in managing the area. 7. What one thing would have made this audit more valuable? ________
Drafting guidance. Question 5 is the one to track on its own, because a low fairness score from a well-run engagement usually means a rating dispute rather than a quality problem, and the CAE should know which. Question 7 produces the comments that change methodology; they go to the CAE verbatim and to the committee as themes. Response rates above 60 percent need a personal request from the engagement lead rather than an automated email, and a survey sent after a contentious report with an Unsatisfactory rating is still sent; the scores that follow are part of the record, and a pattern of low fairness scores on hard reports with high scores on easy ones tells the CAE something about the function’s courage rather than its quality. Results are logged in the metrics sheet by engagement and reported by quarter.
Template 4: the annual quality report outline, with model statements
The annual report is the document the Standards require the board to receive at least once a year, and it is the one that functions most often skip. Six pages is the ceiling. The outline below gives each section a purpose and a length, and the model statements that follow it are the two paragraphs functions find hardest to write: the conformance statement and the nonconformance disclosure.
Annual quality assurance and improvement report to the audit committee, year ended ________.
1. Conformance statement (one paragraph). Whether the function conforms to the Global Internal Audit Standards; the basis (this year’s self-assessment and the most recent external assessment with its date); any standards rated partially or not conforming, named.
2. The program this year (half a page). Engagements subject to QC checkpoints and the count of exceptions; scope of the self-assessment (light or full) and who performed it; surveys issued and response rate; external assessment status and scheduled date; Topical Requirements assessed.
3. Self-assessment results (one to two pages). Ratings by domain in a table; each partially conforming or nonconforming standard with the observation, the action, the owner, and the date; prior-year actions closed.
4. Performance measures (one page). The metrics sheet for the year with targets and trend; commentary on the three measures furthest from target.
5. Improvements made (half a page). Methodology revisions with the reason for each; training delivered; tools adopted; changes made in response to survey feedback.
6. Stakeholder feedback (half a page). Survey results by question; themes from executive interviews, including criticism; how the function responded.
7. Independence, resources, and limitations (one paragraph). Any impairment of independence or objectivity and how it was managed; any resource shortfall and its effect on coverage; any scope limitation imposed during the year.
8. Next year (one paragraph). The program plan; the self-assessment scope; the external assessment date and form; the budget request if any.
Model conformance statement. “Internal Audit conforms to the Global Internal Audit Standards. This conclusion is based on the internal self-assessment completed in [month year], which rated the function as generally conforming to all applicable standards, and on the external quality assessment completed in [month year] by [assessor], which concluded that the function generally conforms. The next external assessment is scheduled for [year]. Engagement reports issued during the year stated that they were conducted in conformance with the Standards on this basis.”
Model nonconformance disclosure. “Internal Audit does not fully conform to Standard 15.2, Confirming the Implementation of Recommendations or Action Plans. Circumstances: during the year, 11 of 14 actions were closed on management’s confirmation without independent validation, because the function had no documented validation procedure. Actions: a validation procedure was adopted in [month]; high-rated actions closed since then have been validated on evidence, and validation of open actions is scheduled as engagement [number] in the [year] plan. Impact: the committee’s reliance on reported closures for the period before [month] is limited to management’s assertion; the function has re-opened [n] actions pending validation. Rationale: the function judged it more useful to the committee to disclose the gap and correct it than to continue reporting closures it had not confirmed. Engagement reports issued before [month] carried no conformance statement; reports issued after [month] state conformance with the exception of this standard until the [year] external assessment.”
Drafting guidance. The conformance statement is written last and copied from the evidence, never the other way round. The nonconformance disclosure follows the four elements the Standards name, circumstances, actions, impact, and rationale, in that order, and it names the standard by number so the board can read it. Functions worry that disclosure invites criticism; in practice committees respond to the disclosure as evidence of a program that works, and the audit committee deck template shows how the quality report sits alongside the year-end pack without dominating it.
Worked example: MidState’s completed kit
MidState Beverage’s six-person function built its program in ninety days, as the playbook describes, and the extracts below are what the four documents contained at the end of the first cycle. The self-assessment was performed by the CAE and manager for Domains III and IV, with a peer chief audit executive from a regional bank reviewing four engagement files for Domain V on a reciprocal basis. Three standards rated partially conforming.
| Standard | Evidence found | Observation | Rating | Action, owner, due | Status at year end |
|---|---|---|---|---|---|
| 9.4 Internal Audit Plan | FY27 plan approved (minute 26-11); universe scoring spreadsheet with 58 entities | Scoring exists; the methodology and criteria are undocumented, so the basis for the 12 high-risk ratings cannot be reviewed by anyone but the CAE | Partially conforms | Document methodology and criteria in the audit manual; CAE; 90 days | Closed; manual section 3 issued, applied to the FY28 assessment |
| 12.2 Performance Measurement | None before day 30 | No measures existed; the committee received activity counts only | Partially conforms | Adopt the metrics sheet with six measures and targets; CAE; next quarter | Closed; first scorecard in the Q1 pack with FY26 baseline |
| 15.2 Confirming Implementation | Issue log; 11 of 14 closures evidenced by management email | No procedure; closures on assertion | Partially conforms | Write the validation procedure; validate high-rated actions on evidence; plan validation as engagement 7; audit manager; 60 days | Closed for the procedure; engagement 7 validating 14 FY26 findings in Q2 and Q4 windows |
| All other applicable standards | Charter, plan, staffing memos, four engagement files, ethics attestations, committee minutes | Practices and documentation meet the requirements; minor observations on workpaper cross-referencing in one file | Generally conforms | None required; cross-referencing reminder issued | n/a |
The first quarter’s metrics sheet carried the FY26 baseline alongside the targets: plan delivery 10 of 11, hours within 8 percent, median 18 days to draft and 12 to final against targets of 15 and 10, 3 of 14 open findings past due, validation coverage not measurable for the baseline period, rework rate 2 of 11 reports, no survey data yet, five of six staff with a credential or sitting for one, and three quality actions open. The QC checklist showed two “no” answers across the quarter’s engagements, both on item B4, testing of information produced by the entity, which became the subject of the manager’s next training session and the reason the checklist earned its keep in its first three months. The annual report used the nonconformance disclosure model above for Standard 15.2, nearly word for word, and the committee approved the FY28 external assessment budget at the meeting that received it.
Common mistakes
| Mistake | What it looks like | Fix |
|---|---|---|
| Evidence described, not referenced | “We have a charter” in column D | Document name, version, date, minute reference, location |
| Evidence defined after the fact | Column C filled in during the assessment | Write expected evidence before starting; it keeps the assessor honest |
| Ratings without observations | A column of “generally conforms” with blank observations | Every rating carries the fact that supports it; blanks are not evidence |
| The checklist as a formality | All ticks, every engagement, no exceptions ever | A checklist that never records a “no” is not being used; QC exceptions are a metric |
| Metrics without definitions | “Cycle time” calculated differently each quarter | Definition and calculation fixed in the sheet; source named |
| Annual report skipped | Quality reported only when the external assessor arrives | The report is required at least annually; calendar it with the year-end pack |
| Conformance statement copied forward | Every report says “in conformance” regardless of the assessment | Copy the statement from the evidence each year; defer it when the evidence does not support it |
| Actions with no owner or date | “Improve documentation” in column G | Specific action, named role, date; validate closure like any other finding |
| Workbook rebuilt each cycle | New format every assessment, no prior ratings | Same workbook, column J carries the trend; assessors read the trend first |
Four documents, one afternoon to build, an hour a quarter and a few days a year to run. That is the whole cost of a quality program that an external assessor will confirm rather than construct, and of a board that receives evidence about its internal audit function instead of assurances.
Related guides
- Building a QAIP from scratch: the complete playbook
- Preparing for an external quality assessment
- Self-Assessment Hub (free tool)
- Global Internal Audit Standards overview
- GIAS Domain IV: managing the function
- GIAS Domain V: performing engagements
- Audit planning memo template
- Internal audit report template set
- Finding and issue log template
- Root cause analysis for audit findings
- The CAE’s audit committee deck template
- Inside the internal audit department
- Templates and downloads
- Start here
Leave a Reply