CIA-3 - Quality of the Internal Audit Function (15% of the exam) - Section C.1
Describe the required elements of the quality assurance and improvement program, including internal and external assessments, assessor qualifications, and ongoing monitoring and self-assessment.
Recognise the key components of quality assurance and the applicability of Topical Requirements to the quality assurance and improvement program, and explain the program's overall purpose. Compare the elements of internal versus external quality assessments, recognise the acceptable qualifications of quality assessors, describe the components of ongoing monitoring and periodic self-assessment, and recognise the chief audit executive's responsibility for communicating program results to the board.
Quality assurance and improvement programExternal quality assessmentOngoing monitoring
Practice question for this objective
lock_openFree sampleQuality of the Internal Audit Functionhard
Dunmore Insurance has completed both its internal assessments for the year and an independent external assessment. The chief audit executive has reviewed the external assessor's conclusions and prepared a remediation plan for the two areas flagged. A newly appointed manager assumes the chief audit executive simply files these results internally. To whom should the chief audit executive communicate the results of the quality assurance and improvement program?
ASolely to the external assessor's firm, so that the firm can confirm the remediation plan before wider distribution occurs
BTo senior management and the board, because the chief audit executive reports the outcomes of the quality assurance and improvement program to those charged with oversightcheck_circle Correct
CTo the operational line managers of the audited business units, because they are the parties who must act on the flagged issues
DTo the internal audit staff alone, because the program is an internal matter for the function and its own personnel to resolve
The chief audit executive reports quality assurance and improvement program results to senior management and the board. Because the board and senior management hold oversight of the internal audit function, the chief audit executive owes them the outcomes of both internal and external assessments together with any action plans, not merely an internal filing.
Why A is wrong: The external firm may review its own findings, but restricting communication to it withholds the results from the senior management and board who need them, so this is wrong.
Why B is correct: Correct: the chief audit executive communicates the results of internal and external assessments, and any remediation plans, to senior management and the board that oversee the internal audit function.
Why C is wrong: Line managers act on individual engagement findings, but the quality assurance and improvement program concerns the audit function itself and its results are owed to senior management and the board.
Why D is wrong: Staff involvement in remediation is expected, but confining the results to the function removes the oversight role of the board and senior management, so this is incorrect.
Exam traps in Quality of the Internal Audit Function
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-3 bank for this domain.
The external assessor, who retains ownership of the findings and monitors the chief audit executive's remediation to closure.
errorWhy it is wrong: The assessor delivers findings but does not own remediation or monitor closure; responsibility for acting on and communicating the results rests with the chief audit executive, not the outside assessor.
Hold the results back until an external assessment is next commissioned, on the basis that outside assessors present quality findings straight to the board.
errorWhy it is wrong: It sounds orderly to wait for a single external report, but internal assessment results are due to the board and senior management on their own schedule and should not be delayed until the next external cycle.
Commission an external quality assessment at once so that an outside assessor can build the programme from scratch during the engagement.
errorWhy it is wrong: Bringing in an external assessor looks decisive, but an external assessment validates an existing programme; it is not the vehicle for designing one, so this skips the step of establishing the programme internally first.