________________________________________ Chapter 4: Internal Quality Assessment 25

CHAPTER 4
INTERNAL QUALITY ASSESSMENT

Overview

Internal quality assessments are a critical element in the overall quality assurance and improvement
program of an internal audit activity (IA activity). The development and implementation of effective
ongoing internal and external assessments provide the IA activity with a foundation for monitoring
and evaluating its quality program. The purpose of a quality program is to provide reasonable
assurance that the IA activity’s work conforms to the International Standards for the Professional
Practice of Internal Auditing (Standards), the Code of Ethics, the IA activity’s charter, and
other applicable standards. Reasonable assurance serves the needs of several possible constituencies,
including the chief audit executive (CAE), senior management, external auditors, the board, and
regulatory agencies. (Source: Practice Advisory 1310-1)

Examples of other applicable standards that should be considered in assessing the performance of
the IA activity include:

1. The IA activity’s objectives, policies, and procedures.

Other performance elements and potential measurement criteria include:

1. The IA activity’s methods for identifying its risk universe and its overall risk assessment/
planning process.
2. Engagement planning documents, particularly those submitted to senior management and the
board.
3. The plan of organization, statements of job requirements, position descriptions, and professional
development plans of the IA activity.
4. Continuous improvement activities and adoption of best practices.

As outlined in the Standards, internal assessments should include:

1. Ongoing reviews of the performance of the IA activity; and

Ongoing reviews of the performance of the IA activity, mentioned above, generally relate to the
element of supervision in the context of the IA activity’s quality program. The quality, level, and
depth of supervision in the IA activity can be a challenging element to evaluate due to the dynamic,
and to a great extent, intangible nature of supervision. However, adequate supervision is the most
fundamental element of a quality assurance program and provides the basis on which internal and
external assessments can be built. (Source: Practice Advisory 1311-1) The nature and responsibility
for supervision are set forth in section 2340 of the Standards and related guidance.

The core theme of Chapter 4 focuses primarily on the second point above (i.e., periodic reviews
performed through self-assessment….). For purposes of this chapter, the term “internal assessments”
shall refer to the IA activity outlined in that second point above, unless specified otherwise.

The Decision to Perform a Formal Internal Assessment

Formal internal assessments should be performed periodically (i.e., as part of a regular ongoing
program of the IA activity). The CAE will usually make the decision for an internal assessment.
Internal assessments should include consideration of the following objectives:

1. Determine whether or not the IA activity’s actions are consistent with its charter and the
expectations of the board/audit committee and senior management.
2. Provide insights into the level of audit effectiveness and efficiency. This should include evaluating
the IA activity at a high level of efficiency and effectiveness, which are essential to achieving
quality performance.
3. Determine whether or not assurance and consulting services apply best practices and add
value to the organization’s business processes.
4. Provide recommendations for improving the IA activity.
5. Demonstrate the degree of the IA activity’s conformity to the Standards.
6. Prepare the IA activity for an external review.

The Review Team

Teams should be comprised of individuals who are highly qualified in internal auditing and who can
be objective in their assessments. It generally is not feasible for an internal assessment team to be
independent of the IA activity. Staff members may find it difficult to objectively evaluate colleagues
with whom they have directly worked. An evaluation of policies and procedures can be equally
difficult, particularly if staff members have been involved in the development of such policies and
procedures. For the duration of their assignment, the internal assessment team should report
directly to the CAE, who should emphasize to the team the need for an independent and objective
frame of mind to the greatest extent practicable.
 ________________________________________ Chapter 4: Internal Quality Assessment 27

Industry and organizational knowledge is an essential attribute of internal assessment team members,
as shown by IIA research studies and external QA reviews. They should have a historical perspective
of both the industry and the organization. In this regard, perhaps no better team members exist
than those presently on staff or who have recently moved from the IA activity elsewhere in the
organization.

The professional proficiency of the internal review team is of the utmost importance to the CAE.
Thus, if possible, team members should have managerial experience as well as demonstrated
judgment and analytical skills. The following criteria may be used in the selection process:

1. Level of objectivity.
2. Knowledge of the Standards.
3. Internal auditing management skills.
4. Technical knowledge (financial, operational, management, and information technology).
5. Professional certification.
6. Industry knowledge.
7. Knowledge of the organization.
8. Availability and interest in the internal assessment project.
9. Human relations skills.
10. Communications skills.
11. Ability to provide constructive analysis, comments, and recommendations for improvement.

The number of team members and the amount of time required for internal assessments will be
dependent on the size of the IA activity, the desired completion date of the review, the scope of
work, and other relevant factors. These assessments should generally be performed in the same
manner as any other engagement in terms of planning and execution of the program. Larger
activities may have a person designated as a manager of quality assurance who will conduct or
supervise the internal assessments. In smaller activities, flexibility will be required in developing
and implementing an internal assessment program due to inherent staffing size limitations and
considerations of staff qualifications and availability.

Internal assessment team members should be rotated over time. This will allow fresh perspectives
to be brought to the process and provide a positive “quality training and awareness” to those who
participate on these ongoing projects.

Agreement should be reached early in the assignment as to how the findings and recommendations
will be recorded and reported and on the format of the final report. A balanced reporting style that
includes a discussion of positive findings as well as constructive issues and recommendations is
suggested. This will serve as a vehicle wherein both strengths and recommendations for improvement
are presented.
28 Quality Assessment Manual, 5th Edition _______________________________________

The CAE Questionnaire

The specific objectives to be covered in the internal assessment may be determined by direct
engagement of the CAE utilizing the CAE questionnaire in Tool 3 for guidance. The team leader
should consider any/all specific and general objectives when developing procedures for the
assessment and when making the overall evaluation. Objectives may be similar to those of an
external assessment. For example:

1. Assess the efficiency and effectiveness of the IA activity in light of (a) its charter, (b) the
future direction and goals of the organization, (c) expectations of the board (audit committee),
senior management, and the CAE, (d) its current needs and opportunities, and (e) risks of
performing at less than an effective level.
2. Identify opportunities and offer ideas and counsel to the CAE and staff for improving their
performance and that of the IA activity. By implementing selected “best practices,” the IA
activity will add value to management and the board and promote the image and credibility of
the IA activity within the organization.
3. Provide an opinion as to the degree of the IA activity’s conformity to the Standards.

The scope and program for the internal assessment should be modified to take into account any
ongoing internal quality assessment activities. Examples of this might include a review by one
manager of another manager’s engagement with the results reported to the CAE, internal surveys,
or assurance/consulting customer evaluations that are received on a regular basis.

Note: The CAE questionnaire may include questions that will not be applicable to every internal
assessment.

Self-assessment (Optional)

Since the internal assessment team is generally selected from the IA activity’s staff, the orientation
process is simpler than for an external assessment team. The internal assessment team will
already be familiar with the organization, the policies and procedures of the organization and the IA
activity, and should have a thorough understanding of the IA activity’s charter. Nevertheless,
completing portions of the Quality Assessment Advanced Preparation, Tool 2, Tab A, normally
prepared in full for external assessments, may be appropriate in place of or to supplement the CAE
questionnaire.

Preparation of a self-assessment may highlight additional areas for review as well as provide good
up-front survey material and documentation. A more scaled down or targeted version of the self-
assessment generally will be appropriate for internal assessments, if it is used at all. A self-
assessment can also prove to be an effective preparatory tool for potential upcoming external
assessments or possibly even regulatory examinations (if applicable), as only updates to the internal
assessment self-assessment should be needed for those external purposes.
 ________________________________________ Chapter 4: Internal Quality Assessment 29

Surveys of Audit Customers and Staff

An important aspect of a quality assessment deals with operating management’s perception of the
IA activity’s performance. Questionnaires from audit management are sometimes used to solicit
management feedback at the conclusion of an audit. If these are routinely sent after each audit, a
review of the responses by the assessment team may provide an adequate survey of the audit
customers’ perceptions regarding the IA activity’s performance. The internal assessment may also
evaluate the effectiveness of current processes for addressing ongoing customer survey feedback
(particularly any potential critical feedback or suggestions).

If questionnaires are not routinely sent to assurance and consulting customers, the assessment
team should send a customer survey (Tool 4, Tab A, or similar questionnaire) to operating and
support unit managers who have been audited or for whom consulting services have been performed
during the past 12 months. Managers who have responded to assurance and consulting
recommendations should be included in the customer survey group. The contents of the questionnaire
and the collection process should be reviewed with the CAE before sending the surveys out.

The survey of audit customers should be one of the early steps in the internal assessment, as the
customers will need time to complete and return the survey questionnaire. Responses may highlight
areas for further fieldwork or follow-up interviews during the internal assessment.

Review Activities

Chapter 2, External Quality Assessment, explains the entire QA process and procedures. This
process and these procedures may also be used, or modified, for internal assessments. The
procedures provide program guidance, with references to the applicable Tools, for determining
whether the IA activity has implemented the assessment objectives mentioned above. These
procedures may be modified by the assessment team to adapt them to the unique circumstances or
the particular objectives of the internal review. See also Chapter 5, Overview of Tools for Quality
Assessment, for additional guidance.

Review of audit workpapers is a core element of the overall internal assessment. A diverse selection/
sample of various audit types (e.g., financial, operational, IT, regulatory/compliance, etc.) and
consulting projects/activities (e.g., systems development, system conversions, business process
redesign, etc.) should be included in the internal assessment program, as deemed appropriate. In
addition, any other major ongoing services to the organization or selected internal operating processes
of the IA activity may also be targeted for review by the assessment team, based on the objectives
of the overall internal assessment program. The internal assessment team generally should avoid
heavy concentration of audits conducted by the same team or manager (unless specific
circumstances dictate otherwise). A well-balanced sample selection and workpaper/documentation
review process are key for avoiding any appearance of potential bias with respect to the structuring
of the internal assessment program.
30 Quality Assessment Manual, 5th Edition _______________________________________

Interviews

Interviews with members of the board may involve the chair and other members of the audit
committee. Interviews with executive management involve the most senior executive, the direct
reports of the most senior executive, and may include selected other senior operating and support
unit managers. These interviews elicit views on the value of internal audits, management’s
expectations, the professionalism of staff, and areas for improving the IA activity. While it is best
to conduct the interviews at the beginning of the assessment, the interviews may continue throughout
the assessment in order to accommodate the busy schedules of senior management.

Additional guidance concerning the interview process (including samples of interview forms to
consider for usage) can be found in the Interview Guides (Tools 6-11, Tab B).

Evaluation

Tool 19, Standards Compliance Evaluation Summary, and attached document provide guidance to
the internal assessment team with respect to identifying important issues and arriving at an opinion
of the degree of the IA activity’s conformance to the Standards.

Reporting and Follow-up

As mentioned earlier in this chapter, it is essential for the assessment team and the CAE to agree
on the reporting medium and format at the beginning of the assessment. This reinforces the
independence and objectivity of the team. Additional guidance is provided in Reference I (Practice
Advisories) and Tools 20 and 20B, Sample Reports, to aid in this process.

After the internal assessment team prepares a final written report, the CAE should document in
writing a response/action plan and implementation timetable for each recommendation. The CAE
may involve the IA activity’s management team and/or staff in the response/action plan process.

The response should (1) agree fully with each recommendation, (2) agree but propose an alternative
method of correction, or (3) document the reasons why no corrective action is to be taken. The
CAE’s response should be reviewed for adequacy by the internal assessment team. The team
should seek the counsel of the CAE in any instances where clarification of the responses may be
required.

If the final report is sent outside the IA activity, the CAE should also send a copy of the IA
activity’s response and implementation plan. Although not required by the Standards, the CAE
may consider reporting the results of the internal assessment to senior management and the board
(audit committee).
 ________________________________________ Chapter 4: Internal Quality Assessment 31

At least annually, the CAE should review the status of each significant area covered by the internal
assessment, along with the status of major recommendations with ongoing applicability. The results
of these periodic reviews should be documented and reported to those who received the internal
review report.

Sharing the final internal assessment report and the CAE’s written response with the audit staff
can be a valuable training tool.

Some recommendations may be of a long-term or ongoing nature. Consequently, it may be helpful

The first step in subsequent internal assessments should be to determine whether previous
recommendations from either internal or external assessments have been satisfactorily resolved.
This finding should be stated in the final internal assessment report.