An internal audit function proves its own quality the same way it asks other functions to prove theirs: with a methodology, evidence and follow-up. Standards 12.1 and 12.2 of the IIA Global Internal Audit Standards set the requirements. This post turns them into a program a small function can run in a few days a year.
Standard 12.1: internal assessments
The chief audit executive must develop and conduct internal assessments of the function's conformance with the Global Internal Audit Standards and its progress toward performance objectives. The methodology must include:
- Ongoing monitoring of conformance and progress.
- Periodic self-assessments, or assessments by other persons in the organization with enough knowledge of internal audit practices.
- Communication with the board and senior management about the results.
Based on periodic self-assessments, the CAE must develop action plans for nonconformance and improvement opportunities, with a proposed timeline, and communicate results and plans to the board and senior management. Internal assessments must be documented and included in the evaluation by the independent third party in the external quality assessment. If nonconformance affects the overall scope or operation of the function, the CAE must disclose the nonconformance and its effect to the board and senior management.
Standard 12.2: performance measurement
The CAE must develop objectives to evaluate performance, considering the board's and senior management's input and expectations. The CAE must develop a methodology to measure progress toward those objectives and to promote continuous improvement, must solicit feedback from the board and senior management as appropriate, and must develop an action plan to address issues and opportunities for improvement.
What ongoing monitoring means in practice
Ongoing monitoring is built into engagement supervision. Standard 14.6 requires that the supervisor and the auditor review documentation for accuracy, relevance and completeness and that the CAE review and approve it. Standard 15.1 requires CAE approval of every final communication before issue. Those reviews, recorded consistently, are the monitoring. Add a short closing checklist per engagement and the file shows monitoring without a separate process.
Closing checklist items drawn from the standards:
- Objectives and scope approved by the CAE (13.3).
- Work program approved before fieldwork and after changes (13.6).
- Workpapers sufficient for a prudent person to repeat the work (14.6).
- Supervisor review notes cleared or retained with resolution (12.3 implementation text).
- Final communication approved before issue (15.1).
- Follow-up dates entered in the tracker (15.2).
Periodic self-assessment
The standard requires periodic self-assessments but sets no frequency or sample size. One workable design: once a year, the CAE or a qualified person from elsewhere in the organization tests a sample of engagement files against the Standards. A workable sample for a small function is one engagement per auditor plus one from the co-source provider. For each file, answer whether each requirement was met and record the evidence. Roll results up by domain.
Sample scorecard
| Measure | Target | Result | Comment |
|---|---|---|---|
| Plan engagements completed | 90 percent | 86 percent | One ITGC review deferred for staff turnover; reported to committee |
| Final reports issued within 30 days of fieldwork close | 85 percent | 79 percent | Review bottleneck at CAE level |
| High findings validated closed by due date | 80 percent | 67 percent | Three IT items waiting on vendor release |
| Stakeholder survey (board and senior management), usefulness | 4.0 of 5 | 4.2 | Three comments request shorter reports |
| Files with complete CAE approvals | 100 percent | 92 percent | Two work programs approved after fieldwork began |
The scorecard is illustrative. Targets are the function's own, set under Standard 12.2 with board and senior management input. They are not industry benchmarks, and the function should not claim they are. Each target needs an owner and a reason.
Action plans
Every missed target on the scorecard needs an action plan, because the standard requires a plan for nonconformance and for improvement opportunities. Take the last row. Work program approval after fieldwork starts is a nonconformance with Standard 13.6, which requires approval before implementation. The plan: a system gate that blocks timesheet coding to an engagement until the approval is attached, with a date. The CAE reports the plan to the audit committee with the results.
Communicating results
Standard 8.1 lists results from the quality assurance and improvement program among the items the CAE reports to the board and senior management, and Standard 8.3 requires the CAE to communicate the results of the internal quality assessment at least annually. Standard 12.1 separately requires disclosure to the board and senior management when nonconformance affects the overall scope or operation of the function. The board's essential conditions under Standard 8.3 include approving the function's performance objectives at least annually.
Linking to the external assessment
Internal assessments feed the five-year external assessment under Standard 8.4. A function with documented internal assessments and closed action plans gives the assessor the file that Standard 12.1 says the evaluation must include. A function without them has a gap before the assessor arrives. See /us/blog/external-quality-assessment-every-five-years-standard-8-4.
Mistakes to avoid
- Measuring activity (hours, reports) with no measure of value or conformance.
- Setting targets that the function never misses. A scorecard with no red items shows targets chosen to be met.
- Collecting feedback and not acting on it.
- Keeping the assessment results inside the function.
For the broader program, including the charter, see /us/blog/internal-audit-guide-plan-charter-report-program.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- The IIA, Global Internal Audit Standards (2024), Standards 8.1, 8.3, 8.4, 12.1, 12.2, 12.3, 13.3, 13.6, 14.6, 15.1, 15.2: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error