50 Shades of Quality
Hans Nieuwlands CIA CGAP CCSA
CEO IIA Netherlands
Insert Logo Here
Outline
•
•
•
•
•
•
Introduction
Guidance
Quality Assessment and Improvement Program
Planning of an External Quality Assessment
Common Improvement Areas
Questions
Insert Logo Here
What is Quality?
Quality is not an act, it is a habit.
Aristotle
Insert Logo Here
What is Quality?
Quality means doing it right
when nobody is watching.
Henry Ford
Insert Logo Here
What is Quality?
Quality in a product or service is not
what the supplier puts in.
It is what the customer gets out and is
willing to pay for.
Peter F. Drucker
Insert Logo Here
What is Quality?
Quality in internal audit is guided
by both an obligation to meet
customer expectations as well as
professional responsibilities
Practice Guide
inherent in conforming to the
Standards.
Insert Logo Here
Professional Guidance
Insert Logo Here
Standards
1300 – Quality Assurance and Improvement
Program
The chief audit executive must develop and
maintain a quality assurance and improvement
program that covers all aspects of the internal
audit activity.
Insert Logo Here
Standards
Interpretation 1300:
A quality assurance and improvement program
is designed to enable an evaluation of the
internal audit activity’s conformance with the
Definition of Internal Auditing and the Standards
and an evaluation of whether internal auditors
apply the Code of Ethics.
The program also assesses the efficiency and
effectiveness of the internal audit activity and
identifies opportunities for improvement.
Insert Logo Here
Standards
1310 – Requirements of the Quality
Assurance and Improvement Program
The quality assurance and improvement program
must include both internal and external
assessments.
Insert Logo Here
Standards
1311 – Internal Assessments
Internal assessments must include:
• Ongoing monitoring of the performance of the
internal audit activity; and
• Periodic self-assessments or assessments by
other persons within the organization with
sufficient knowledge of internal audit practices.
Insert Logo Here
Standards
Interpretation 1311:
Ongoing monitoring is an integral part of the
day-to-day supervision, review, and measurement
of the internal audit activity.
Ongoing monitoring is incorporated into the
routine policies and practices used to manage the
internal audit activity and uses processes, tools,
and information considered necessary to evaluate
conformance with the Definition of Internal
Auditing, the Code of Ethics, and the Standards…
Insert Logo Here
Standards
1320 – Reporting on the Quality Assurance
and Improvement Program
The chief audit executive must communicate
the results of the quality assurance and
improvement program to senior management and
the board.
Insert Logo Here
Practice Guides
Insert Logo Here
QAIP Framework
Insert Logo Here
QAIP Components
Insert Logo Here
QAIP Assessment
Insert Logo Here
The Value of a QAIP
Insert Logo Here
Planning of an External
Quality Assessment
• Standard 1300: Set up a QAIP Framework
• Standard 1311: Perform an internal assessment
• Standard 1312: Organize an External Quality
Assessment (EQA)
Insert Logo Here
Assessments
Standard 1311
– Internal Assessments
Standard 1312
– External Assessments
Insert Logo Here
Common improvement areas
Insert Logo Here
Common improvement areas
Insert Logo Here
Common improvement areas
 Definition
- Discuss with (Supervisory) Board
- Include in Charter
 Code of Ethics
- Include in manual
- Include in job descriptions
- All staff should acknowledge
compliance annually
Insert Logo Here
Attribute Standards
Insert Logo Here
Attribute Standards

Insert Logo Here
Attribute Standards
 1000: Purpose, Authority and Responsibility
 1100: Independence and Objectivity
- Define reporting line to CEO and Audit
Committee (AC)
- Define attendance at AC meetings
- Include hiring/firing of the CAE
Insert Logo Here
Attribute Standards
Insert Logo Here
Attribute Standards
1200: Proficiency and Due Professional
Care
- Stimulate Professional Certification
- Create Personal Development plan
- Take into account external
developments
- Develop new competencies and
skills(e.g. soft controls)
- Utilize opportunities created by the
employer
Insert Logo Here
Attribute Standards
Insert Logo Here
Attribute Standards
1300: Quality Assessment and Improvement
Program (QAIP)
- Do the self assessment frequently
- Include Quality aspects in
operational processes
- Check periodically is the manual
needs an update
- Communicate results of quality
assessments to the CEO and AC
Insert Logo Here
Performance Standards
Insert Logo Here
Performance Standards
2000: Managing the Internal Audit Function
- Ensure audit universe is complete,
up to date and accurate
- Describe the risk assessment
methodology used
- Document the trail from universe to
audit plan
- Document the reasons for dropped
audits
Insert Logo Here
Performance Standards
Insert Logo Here
Performance Standards
2100: Nature of Work
Include in every audit:
- Governance aspects
- Risk Management processes
Advice on these matters in the report
Insert Logo Here
Performance Standards
Insert Logo Here
Performance Standards
 2200: Engagement Planning
- Substantiate the Planning
Memorandum, including interviews
- Document red flags used to identify
potential fraud
- Align the audit program with the
specific risk assessment made
- Document manager’s approval of
the audit program, prior to fieldwork
Insert Logo Here
Performance Standards
Insert Logo Here
Performance Standards
2300: Performing the Engagement
-
Document field work done
Substantiate sampling method used
Ensure complete cross references
Document supervision of fieldwork
Create a trail from findings to report
and vice versa
- Finalize all supervision before
issuance of draft report
Insert Logo Here
Performance Standards
Insert Logo Here
Performance Standards
2400: Communicating Results
Ask stakeholders for feedback on the
reports, e.g.:
- Overall quality of report
- Extend to what risks are addressed
- Level of detail
- Clarity of audit opinion
- Readability
Insert Logo Here
Performance Standards
Insert Logo Here
Performance Standards
2500: Monitoring Progress
- Communicate frequently follow up
activities on audit recommendations
to appropriate levels of
management
- Report periodically on high risk and
overdue issues to CEO and AC
Insert Logo Here
Performance Standards
Insert Logo Here
Performance Standards
2600: Communicating the Acceptance
of Risks
- Include the escalation procedure to be used
when senior management and the CAE
disagree on the acceptance if business risks
in the Audit Charter
- Include any disagreement in the audit report
Insert Logo Here
Conclusion
43 IAFs complied with the Standards
4 IAFs did not comply with the Standards
(improvement plans were implemented and
assessed)
Prepare well and you will survive an External
Quality Assessment!
Insert Logo Here
Don’t be one out of these 4!
Insert Logo Here
Thank you for your attention!
• Hans.Nieuwlands@iia.nl
Insert Logo Here