In order for your internal audit activity to be effective, it must be credible to its stakeholders. Internal auditors must be considered professionals and as professionals, internal auditors must conform to a set of professional standards: The International Standards for the Professional Practice of Internal Auditing (the Standards), as well as other elements within the International Professional Practices Framework (IPPF).
Just as external auditors are required to perform financial statement audits in accordance with auditing standards and just as external auditors are audited by the PCAOB and/or peers, internal audit departments should be audited against their professional standards. A Quality Assessment Review (QAR) helps the Chief Audit Executive (CAE) demonstrate the internal audit activity’s conformance to an organization’s stakeholders. Yes, this is an audit of the auditors.
In accordance with Standard 1312, external assessments should be conducted at least once every five years by a qualified, independent reviewer or review team from outside of the organization. The Institute of Internal Auditors (IIA) has provided two processes in which an Internal Audit (IA) Activity can conduct QARs: (1) contract a qualified, independent reviewer or review team from outside of the organization or (2) perform a self-assessment with independent (external) validation.
Option one, although more costly, consumes less of your internal audit resources. This option, when performed by experienced QAR assessors, can provide, not only assurance that the IA activity is in compliance with the Standards, but more importantly, recommendations for improvements to your IA activity.
Self-assessments with independent validation primarily provide only an assessment of the organization’s compliance with the Standards and do not consider recommendations for department efficiencies and improvements.
These reviews can have considerable value to the CAE, the Audit Committee, the management team and other parties germane to the IA activity. Note that, without such an assessment, your audit reports cannot state that audits have been performed in accordance with the Standards.
If you have any questions or need more information regarding QARs, you can contact the IIA at 407-937-1100, visit the IIA website at www.theiia.org or contact Nicole Saldamarco at Schneider Downs at 412-697-5368.
