Quality Assurance and
Improvement Program
Last updated: February 2014
International Standards for the Professional Practice of Internal Auditing (Standards) – 1300
Internal Audit’s Quality Assurance and Improvement Program (QAIP) is designed to provide
reasonable assurance to the various stakeholders of the Treasury Cluster’s Internal Audit activity
that Internal Audit:

Performs its work in accordance with its Charter, which is consistent with The Internal Audit
and Risk Management Policy for NSW Public Sector TPP 09-05 and The Institute of
Internal Auditors International Standards for the Professional Practice of Internal Auditing
(Standards);

Operates in an effective and efficient manner; and

Is perceived by stakeholders as adding value and improving Internal Audit’s operations.
Internal Audit’s QAIP covers all aspects of the Internal Audit activity (1300).
This Program covers:
Number
1310
1311
1312
1320
1330
1340
1
Standard
Description
Quality Program
Assessments
Internal Audit should adopt a process to monitor and assess the overall
effectiveness of the quality program. The process should include both
internal and external assessments.
Internal
Internal assessments should include:
Assessments
 Ongoing reviews of the performance of Internal Audit.
 Periodic reviews performed through self-assessment or by other
persons within the organisation, with knowledge of Internal Audit
practices and the Standards.
External
External assessments must be conducted at least once every five years by
Assessments
a qualified, independent reviewer or review team from outside the
organisation. The chief audit executive must discuss with the Board1:
 The need for more frequent external assessments; and
 The qualifications and independence of the external reviewer or review
team, including any potential conflict of interest.
Reporting on the The Chief Audit Executive should communicate the results of external
Quality Program assessments to the Board.
Use of
Internal auditors are encouraged to report that their activities are "conducted
"Conducted in
in accordance with the International Standards for the Professional Practice of
Accordance with Internal Auditing." However, internal auditors may use the statement only if
the Standards"
assessments of the quality improvement program demonstrate that the
internal audit activity is in compliance with the Standards.
Disclosure of
Although internal audit activity should achieve full compliance with the
Noncompliance Standards and internal auditors with the Code of Ethics, there may be
instances in which full compliance is not achieved. When noncompliance
impacts the overall scope or operation of the internal audit activity,
disclosure should be made to senior management and the board.
In the Treasury Cluster, “the Board” should be read as “the Secretary or relevant CEO” (since there are Cluster entities
for which the Secretary is not the CEO). For the purpose of this document “the Audit and Risk Committee” should be
read as accompanying or, where the Secretary or other CEO prefers, replacing him/her; except in the case of 1340.
The Chief Audit Executive (CAE) is ultimately responsible for the QAIP.
NSW TREASURY QAIP
1
INTERNAL ASSESSMENTS - 1311
Ongoing Reviews
Ongoing
assessments are
conducted
through
1
Supervision of
engagements.
Potential
Components Include
There is a scheduling
process for internal
audit engagements
and the associated
project management.
Internal audit
engagements are
supervised to assure
conformance with the
approved
methodology for
conducting internal
audit engagements
and conformance with
the Standards.
Assessment Criteria
There is an up-to-date
Internal Audit Manual.
Treasury Assessment
Yes – new update posted in
March 2014
When
By who
Annually –
next update
February 2015
Updated by
Internal Audit
Program Manager
(IAPM).
Approved by CAE
There is an approved
Internal Audit Plan.
Yes – last approved September
2013
Annually –
next June
2014
Approved by
Secretary.
There is a formal QA signoff process over internal
audit engagements.
Yes. Service Provider’s quality
review process completed at
front of each audit report.
Ongoing. Per
audit.
The CAE attends opening
meetings and closing
meetings for internal audit
engagements.
Yes
Service Provider.
Completed by
IAPM. Approved
by CAE
Yes. Finalisation of Internal
Audit – Checklist completed for
each engagement. Contains QA
process. Signed by CAE.
NSW TREASURY QAIP
Completed by
Service Provider
and CAE.
Ongoing. Per
Audit.
CAE
2
Ongoing
assessments are
conducted
through
2
3
Regular,
documented review
of work papers
during
engagements by
appropriate Internal
Audit staff.
Audit Policies and
Procedures used
for each
engagement to
ensure compliance
with applicable
planning, fieldwork
NSW TREASURY QAIP
Potential
Components Include
Internal audit
engagements are
supervised to assure
conformance with the
approved
methodology for
conducting internal
audit engagements
and conformance with
the Standards.
There is an Internal
Audit Manual of policy
and procedures in
place.
Internal Audit has
access to appropriate
auditing tools and
Assessment Criteria
Treasury Assessment
When
By who
Internal audit reports are
signed off by the CAE.
Yes. Signed off by CAE when
report is formally sent to the
Secretary.
Ongoing. At
completion of
audit.
CAE
There is a consistent
methodology for
conducting internal audit
engagements and for
preparing working papers.
Yes. Methodology is agreed in
detailed scope prior to each
audit and is in conformance with
the Audit Manual and Risk Mgt
Framework. (project briefs are in
conformance with Audit Manual)
Ongoing. At
beginning and
end of each
audit.
Reviewed by
IAPM. All scopes
signed off by CAE
Draft working papers reviewed
when draft report is issued. Final
working papers reviewed when
final report is issued.
There is a formal QA signoff process over internal
audit engagements.
ASAE 3000 compliance
reviewed as part of the
Finalisation of Internal Audit –
Checklist completed for each
engagement.
At the end of
each audit.
Completed by
IAPM. Approved
by CAE.
There is an up-to-date
Internal Audit Manual.
Yes – new update posted in
March 2014
Annually –
next update
February 2015
Updated by
Internal Audit
Program Manager
(IAPM). In
consultation with
Service Provider
Approved by CAE
3
Ongoing
assessments are
conducted
through
and reporting
standards.
Potential
Components Include
uses technology
where relevant.
Quality assurance and
process improvement
activities are
monitored within
Internal Audit,
including formal
quality assessment
processes.
NSW TREASURY QAIP
Assessment Criteria
Treasury Assessment
When
By who
There is a consistent
methodology for
conducting internal audits
and for preparing working
papers.
Yes – agreed in detailed scope
in conformance with Audit
Manual.
Ongoing. At
beginning of
each audit.
Reviewed by
IAPM. All scopes
signed off by CAE
Internal Audit staff and
service providers have
been trained in use of the
approved Internal Audit
methodology.
Yes – Treasury Internal Audit
Program Manager and Service
Provider core team are
chartered accountants trained in
IA methodology. In addition
Service Provider staff are
subject to an annual training
program which includes IA
methodology training.
Completed.
IAPM. E&Y staff.
There is a formal QA signoff process over internal
audit engagements.
Yes. Finalisation of Internal
Audit – Checklist completed for
each engagement. Contains QA
process. Signed by CAE.
Ongoing. Per
audit.
Completed by
IAPM. Approved
by CAE
There is consideration of
the use of data extraction
and analysis techniques,
risk assessment
tools, tools for internal
audit engagement
planning, etc.
Risk Management Toolkit for the
NSW Public Sector (TPP12-03)
used as the gold standard in
public sector.
Complete
Treasury Internal Audit single
service provider has access to
appropriate auditing tools and
uses technology where relevant.
Ongoing.
When
required.
Internal Audit
Service Provider
in consultation
with CAE
4
Ongoing
assessments are
conducted
through
4
5
Feedback from
customer survey on
individual
engagements.
Analyses of
performance
metrics established
to improve the IA
effectiveness and
efficiency.
Potential
Components Include
Assessment Criteria
Treasury Assessment
When
By who
Post-audit customer
feedback surveys of
Internal Audit
customers are used
as a mechanism for
continuous
improvement.
Internal Audit customer
comments at closing
meetings are recorded.
Yes there is a section in the
Finalisation of Internal Audit –
Checklist for recording
comments at closing meetings.
At end of each
audit.
IAPM
Internal Audit customer
feedback surveys are
requested from internal
audit customers at
completion of each
internal audit engagement.
Survey Questionnaire issued to:
 management in audited
areas;
 service providers; and
 CAE and IA team,
At end of each
audit.
IAPM
Internal Audit has
formal performance
measures in place.
Approved performance
measures are in place for
Internal Audit, and these
are monitored and
reported to the Audit
Committee (ARC).
Annual ARC assessment of
Internal Audit conducted.
Next update
meeting May
2014
IAPM and CAE
Reviewed and
approved when
issued. Formal
sign off when
forwarded to
Secretary for
approval.
CAE.
Branch Plan contains a number
of KPIs applicable to the audit
program.
Both of these will be updated
and reviewed by the CAE, at a
minimum, at planning days
conducted every 6 months.
Results reported to the ARC
annually.
6
All final reports and
recommendations
are reviewed and
approved by a
CAE.
NSW TREASURY QAIP
Final internal audit
reports and
recommendations are
reviewed and
endorsed by the CAE
prior to release.
The CAE reviews and
signs off all final internal
audit reports.
The CAE reviews draft reports
and signs off all final internal
audit reports. Formal sign-off is
at the time when report is sent
to Secretary.
5
Periodic Reviews
1
Periodic
assessments will
be conducted
through
Potential
Components Include
Feedback from
customer surveys
on internal audit
engagements
Post-audit customer
feedback surveys of
Internal Audit
customers are used
as a basis for
continuous
improvement.
Assessment Criteria
Information received from
internal audit customers in
customer feedback
surveys is used to improve
services provided by
Internal Audit.
Treasury Assessment
Client Survey Questionnaire
issued to management of
audited areas at closing
stages of each review.
When
At end of each
audit.
By who
IAPM.
Changes to Audit
Manual approved
by CAE.
Internal Audit Service
Provider is also surveyed.
Where opportunities for
improvement are identified
these are documented into
the Finalisation of Internal
Audit – Checklist and the
Internal Audit Manual
2
Annual risk
assessments for
purposes of
annual audit
planning.
A comprehensive
internal audit risk
universe of potential
topics for internal
audit engagements in
maintained and
updated.
The internal audit risk
universe is
supplemented and
updated on an
ongoing basis through
various means such
as consultation with
management.
NSW TREASURY QAIP
Internal Audit conducts an
annual risk assessment
exercise to aid its internal
audit planning.
The Internal Annual Plan
links proposed internal
audit engagements to the
operational and strategic
risks of the organisation.
There is input from
management into
development of the
Internal Annual Plan.
Yes. Service Provider
facilitated an Executive
Workshop in August 2013 to
identify key strategic risks
within the risk universe. The
2013-14 Audit Plan is based
on those risks, which include
those raised by previous
audits.
Annually – next
process to
commence with
an Executive
workshop in
March 2014.
Service Provider
/CAE/Group
Executive
Thereafter,
Executive
Workshop in
December, with a
final check by
Executive the
following June.
6
3
4
5
Periodic
assessments will
be conducted
through
Potential
Components Include
Assessment Criteria
Working paper
reviews for
internal audit
engagements in
accordance with
the Internal Audit
Manual and with
the Standards
Internal audit
engagements are
supervised to assure
conformance with the
approved
methodology for
conducting internal
audit engagements
and conformance with
the Standards.
There is an approved
methodology for
conducting internal audit
engagements.
Review of internal
audit performance
metrics and
benchmarking of
best practices,
prepared and
analysed in
accordance with
Audit Policies and
Procedures.
There are
performance
measures in place for
Internal Audit.
Follow-up of
recommendations
contained in
A follow-up database
is maintained for
internal audit
NSW TREASURY QAIP
Treasury Assessment
Approved methodology
documented in Audit Manual
and also agreed in Scope.
QA sign-off table provided
with all documents received
from internal audit service
provider
Working paper reviews are Working papers are reviewed
conducted as part of
at the end of each
ongoing internal
engagement for conformance
assessments and external with Audit Manual and ASAE
quality assessments.
3000 Compliance (Recorded
in the Finalisation of Internal
Audit – Checklist)
Approved performance
Renewed annually during
measures are in place for
branch planning and updated
Internal Audit, and these
where necessary.
are monitored and
reported to the Audit
Committee.
When
At end of each
audit.
By who
IAPM.
There is a formal QA signoff process over internal
audit engagements.
External quality
assessments benchmark
Internal Audit against
better practices in internal
auditing.
There is an audit follow-up
system in place.
There is periodic follow-up
External assessment
conducted every five years,
as per TPP 09-05. Last
review conducted in May
2011.
Register of Internal Audit
Recommendations and
Register of Audit Office
Management Letter
Current
performance
measures to be
updated May
2014.
Next external
review May 2016.
Prior to each
ARC meeting.
Updated by
Internal Audit
Program
Manager.
Reviewed by
Chief Audit
Executive on an
ongoing basis.
IAPM
7
Periodic
assessments will
be conducted
through
Potential
Components Include
internal audit
reports
recommendations and
action plans resulting
from internal audit
engagements, and
also for
recommendations
from the external
auditors.
Assessment Criteria
of outstanding audit
recommendations to
provide assurance
remedial action has been
implemented.
Periodic reports from
management on action
taken is reported to the
Audit Committee at each
meeting
There is a risk-based
follow-up approach for
audit recommendations
which have been agreed
by management.
Audit follow-up activities
are reported to the Audit
Committee.
6
Periodic activity
and performance
reporting to the
Audit and Risk
Committee.
NSW TREASURY QAIP
Periodic summary
reports are provided
to the Audit
Committee by Internal
Audit, including
results of quality
activities, internal
assessments and
external quality
Summary reports on the
work of Internal Audit are
provided to the Audit
Committee.
Details of internal
assessments are provided
to the Audit Committee
Treasury Assessment
When
By who
recommendations followed
up three week prior to Audit
and Risk Committee
meetings, with updates
reported to the ARC at
alternating meetings.
The Register of External
Bodies Reports is followed up
and reported every 6 months.
Low to Moderate risk issues
are followed up but not
reported to the ARC unless
the CAE deems necessary.
The ARC requests
explanations from senior
management where there are
significant delays in
implementing
recommendations.
Report on the Status of
Internal Audit is a standing
item at each ARC meeting.
Each audit is assessed
immediately it is completed,
by the CAE, the audited area
and EY. Noteworthy
exceptions are reported to
the ARC.
At each ARC
meeting.
Ongoing,
following each
audit
IAPM
IAPM
8
Periodic
assessments will
be conducted
through
Potential
Components Include
Assessment Criteria
assessments.
Reports of external quality
assessments are provided
to the Audit Committee.
Treasury Assessment
When
Results of the annual
assessment of the internal
audit function are reported to
the Audit and Risk
Committee annually. The
Committee contributes to the
assessment. Highlights from
this assessment appear in
the ARC’s annual report to
the Secretary.
Annually. Most
recent results
discussed at ARC
meeting of 31
October 2013.
By who
CAE
Next assessment
to report Oct
2014.
External assessment report
provided to ARC May 2011.
May 2016
7
Periodic internal assessments of conformance to the Standards.
Annually. Last review
conducted March 2013.
Next review
March 2014.
CAE/IAPM
8
Periodic internal assessments of conformance to TPP 09-05.
Annually. Last review
conducted December 2013.
Next review
December 2014
CAE.
Annually. Last assessment
November 2013.
Next assessment
November 2014
Secretary
Annually (and when a
member’s term is renewed).
Last assessment November
2013.
Next assessment
before December
2014.
ARC Chair
Annually. Last assessment
November 2013, discussed
at December ARC meeting.
Next assessment
November 2014.
ARC members
9
10
11
Periodic assessment of the Audit and Risk Committee Chairperson.
Periodic assessment of the Audit and Risk Committee members.
Periodic self-assessment of Audit and Risk Committee.
NSW TREASURY QAIP
9
Periodic
assessments will
be conducted
through
12
13
Potential
Components Include
Assessment Criteria
ARC assessment of Internal Audit activities.
ARC ensures that the Secretary is aware of any risk concerns raised by
the Committee.
Treasury Assessment
Annually. Last assessment
Sept 2013, discussed at Oct
meeting.
The Secretary provides a
“Secretary’s Report” for each
ARC meeting, and presents it
in person whenever possible.
(In 2013 there was only one
meeting where the Report
was given by a deputy.)
The ARC has access to
speak to the Secretary
privately at any time on any
issue they wish to raise.
Secretary reads and
comments on the Minutes of
each ARC meeting.
14
15
ARC Principal Department and Shared Arrangements Charters and the
Internal Audit Charter are reviewed annually and updated if TPP 09-05,
TPP 12-04 or IPPF Standards have been updated.
Audit Manual is revised annually. Updates will reflect lessons learned
from the year’s assessments.
16 Fraud and Corruption risk assessment.
NSW TREASURY QAIP
When
Next assessment
by Oct 2014
Each meeting
By who
ARC members
ARC Members
and Treasury
Secretary
As required
Each meeting
Annually. New Charters
posted in March 2014
Next review
January 2015,
(unless GSE Act
changes require
earlier review)
CAE
Yes – complete revision in
October 2013, posted in
March 2014
Annually – next
update February
2015
IAPM/CAE
Workshops
commence first
Internal Audit
A fraud and corruption risk
assessment was conducted
10
Periodic
assessments will
be conducted
through
Potential
Components Include
Assessment Criteria
Treasury Assessment
for Treasury/Crown and
separately for SICorp in June
2012.
The Secretary has requested
new fraud and corruption
workshops in 2014, leading
to a second risk assessment
and audit in 2015, to be
reviewed every 3 years
thereafter.
NSW TREASURY QAIP
When
half 2014,
preceding a
Cluster audit in
2014-15.
By who
Service Provider
11
EXTERNAL ASSESSMENTS - 1312
External assessments will appraise and express an opinion about internal audit’s conformance with the Standards, The IIA’s Definition of Internal Auditing and
Code of Ethics and include recommendations for improvement, as appropriate.
External assessments will be
conducted through
1
Quality assessment of Treasury Cluster
Internal Audit.
When
Every five years, as per TPP 09-05. Last review
conducted in May 2011.
By who
The Institute of Internal Auditors.
Next review May 2016.
2
Audit Office assessment of Internal
Audit’s compliance with TPP 09-05.
At the Auditor General’s discretion. Last survey
performed in 2012. Recommendations made in
AO management letters for year ending June
2012 and implemented.
NSW Audit Office.
REPORTING ON QUALITY PROGRAM - 1320
Internal Assessments – Results of internal assessments will be reported to the Audit and Risk Committee annually. Highlights from the assessments will
appear in the ARC’s annual report to the Secretary each June.
External Assessments – Results of external assessments will be provided to the Audit and Risk Committee and the Secretary. The external assessment
report will be accompanied by a written action plan in response to significant comments and recommendations contained in the report. The CAE will implement
appropriate follow-up actions to ensure that recommendations made in the report and action plans developed are implemented in a reasonable timeframe. This
activity is monitored by the ARC at each meeting.
NSW TREASURY QAIP
12
CONDUCTED IN ACCORDANCE WITH THE STANDARDS - 1330
Internal auditors are encouraged to report that their activities are "conducted in accordance with the International Standards for the Professional Practice of
Internal Auditing." However, internal auditors may use the statement only if assessments of the quality improvement program demonstrate that the internal
audit activity is in compliance with the Standards.
External assessments will be
conducted through
1
When
Use of "Conducted in Accordance with the Internal audits are conducted in accordance
Standards"
with ASAE 3000 on assurance engagements.
Internal audit is evaluated against the
Standards annually. Working papers for each
internal audit are evaluated for conformance to
ASAE 3000 (this is documented in the
Finalisation of Internal Audit – Checklist).
By who
IAPM
DISCLOSURE OF NON COMPLIANCE - 1340
Although the internal audit activity should achieve full compliance with the Standards and internal auditors with the Code of Ethics, there may be instances in
which full compliance is not achieved. When non-compliance impacts the overall scope or operation of the internal audit activity, disclosure should be made to
senior management and the board.
External assessments will be
conducted through
1
Disclosure of Noncompliance
NSW TREASURY QAIP
When
Annual internal assessments of conformance to
the International Standards for the Professional
Practice of Internal Auditing. Last review
conducted Feb 2014. Next review Feb 2015.
By who
CAE
13
QAIP Review History
Prepared/Reviewed by
Review Date
Approved by
Approval Date
Stephen Connolly, IAPM
7/11/2011
Nadia Fletcher, CAE
11/11/2011
Stephen Connolly, IAPM
12/2/2013
Nadia Fletcher, CAE
20/02/2013
Stephen Connolly, IAPM
23/12/2013
Nadia Fletcher, CAE
23/12/2013, for
posting on the
website in March
2014
Next complete review due: February 2015
NSW TREASURY QAIP
14
Appendix A – Internal Audit Standard 1300
1300 – Quality Assurance and Improvement Program
The chief audit executive must develop and maintain a quality assurance and improvement program
that covers all aspects of the internal audit activity.
Interpretation:
A quality assurance and improvement program is designed to enable an evaluation of the internal audit
activity’s conformance with the Definition of Internal Auditing and the Standards and an evaluation of
whether internal auditors apply the Code of Ethics. The program also assesses the efficiency and
effectiveness of the internal audit activity and identifies opportunities for improvement.
1310 – Requirements of the Quality Assurance and Improvement Program
The quality assurance and improvement program must include both internal and external assessments.
1311 – Internal Assessments
Internal assessments must include:
 Ongoing monitoring of the performance of the internal audit activity; and
 Periodic self-assessments or assessments by other persons within the organization with
sufficient knowledge of internal audit practices.
Interpretation:
Ongoing monitoring is an integral part of the day-to-day supervision, review, and measurement of the
internal audit activity. Ongoing monitoring is incorporated into the routine policies and practices used to
manage the internal audit activity and uses processes, tools, and information considered necessary to
evaluate conformance with the Definition of Internal Auditing, the Code of Ethics, and the Standards.
Periodic assessments are conducted to evaluate conformance with the Definition of Internal Auditing,
the Code of Ethics, and the Standards.
Sufficient knowledge of internal audit practices requires at least an understanding of all elements of the
International Professional Practices Framework.
1312 - External Assessments
External assessments must be conducted at least once every five years by a qualified, independent
assessor or assessment team from outside the organization. The chief audit executive must discuss
with the board:
 The form and frequency of external assessment; and
 The qualifications and independence of the external assessor or assessment team, including
any potential conflict of interest.
Interpretation:
External assessments can be in the form of a full external assessment, or a self-assessment with
independent external validation.
A qualified assessor or assessment team demonstrates competence in two areas: the professional
practice of internal auditing and the external assessment process. Competence can be demonstrated
through a mixture of experience and theoretical learning. Experience gained in organizations of similar
size, complexity, sector or industry, and technical issues is more valuable than less relevant
experience. In the case of an assessment team, not all members of the team need to have all the
competencies; it is the team as a whole that is qualified. The chief audit executive uses professional
judgment when assessing whether an assessor or assessment team demonstrates sufficient
competence to be qualified.
An independent assessor or assessment team means not having either a real or an apparent conflict of
interest and not being a part of, or under the control of, the organization to which the internal audit
activity belongs.
NSW TREASURY QAIP
15
1320 – Reporting on the Quality Assurance and Improvement Program
The chief audit executive must communicate the results of the quality assurance and improvement
program to senior management and the board.
Interpretation:
The form, content, and frequency of communicating the results of the quality assurance and
improvement program is established through discussions with senior management and the board and
considers the responsibilities of the internal audit activity and chief audit executive as contained in the
internal audit charter. To demonstrate conformance with the Definition of Internal Auditing, the Code of
Ethics, and the Standards, the results of external and periodic internal assessments are communicated
upon completion of such assessments and the results of ongoing monitoring are communicated at least
annually. The results include the assessor’s or assessment team’s evaluation with respect to the
degree of conformance.
1321 – Use of “Conforms with the International Standards for the Professional Practice of
Internal Auditing”
The chief audit executive may state that the internal audit activity conforms with the International
Standards for the Professional Practice of Internal Auditing only if the results of the quality assurance
and improvement program support this statement.
Interpretation:
The internal audit activity conforms with the Standards when it achieves the outcomes described in the
Definition of Internal Auditing, Code of Ethics, and Standards.
The results of the quality assurance and improvement program include the results of both internal and
external assessments. All internal audit activities will have the results of internal assessments. Internal
audit activities in existence for at least five years will also have the results of external assessments.
1322 – Disclosure of Non-conformance
When non-conformance with the Definition of Internal Auditing, the Code of Ethics, or the Standards
impacts the overall scope or operation of the internal audit activity, the chief audit executive must
disclose the non-conformance and the impact to senior management and the board.
NSW TREASURY QAIP
16