Audit quality review

The IIA Standards require an internal audit quality assessment review once every five years. The relevant standard states that “External assessments must be conducted at least once every five years by a qualified, independent reviewer or review team from outside the organization.”

Many internal audit departments already comply with this standard and also perform their own internal audit quality assessments on a more frequent basis. In addition, many internal audit functions seek to go beyond mere compliance with The IIA Standards and include as part of the scope of their quality assessment reviews a “best practices” component to foster continuous improvement within the function.

Other internal audit functions realize that for whatever reason (new company business models, risks, regulations, new products and services issues, for example), the function needs to change substantially from its current structure.

In these cases, internal audit functions and their audit committees take a “transformation” approach and typically work with outside advisors to redirect and reorganize the function to meet current reality.

Also, the audit committee should seek the viewpoint of the company’s external auditor on the performance, competency and objectivity of its internal audit function, including the degree of coordination with the external audit firm and the degree of reliance the firm places on internal audit’s work.

The relevant standard also indicates that:

A qualified reviewer or review team consists of individuals who are competent in the professional practice of internal auditing and the external assessment process. The evaluation of the competency of the reviewer and review team is a judgment that considers the professional internal audit experience and professional credentials of the individuals selected to perform the review.

The evaluation of qualifications also considers the size and complexity of the organizations that the reviewers have been associated with in relation to the organization for which the internal audit activity is being assessed, as well as the need for particular sector, industry, or technical knowledge.

An independent reviewer or review team means not having either a real or an apparent conflict of interest and not being a part of, or under the control of, the organization to which the internal audit activity belongs.

Whatever exact form the review takes, the audit committee should be apprised of the process and the results of the review, as well as the agreed-upon actions resulting from this effort. Audit quality review includes checking how the department has been set up and specific skills of the personnel who execute the audit