Home Up



External Quality Assurance Review

The IIA Standards for the Professional Practice of Internal Auditing require that an external review of the Internal Audit function be carried out every five years at a minimum.

Richard Cascarino and Associates uses one of the country's leading Certified Internal Auditors to head our review team and carry  out the review to the highest standards using the procedures recommended by the IIA-Inc. We involve your own staff within the process which means that this approach offers you a team of professionals who understand your organisation, led by an expert who is a leading authority on both  the practice of internal auditing and IS auditing.

Our evaluation of your department's independence, scope of operations, professional proficiency, performance of audit work and audit management can tell you whether your department:

  • Meets the needs of senior management and your board
  • Meets the Standards for the Professional Practice of Internal Auditing
  • Addresses the most important risk areas in your organisation
  • Operates efficiently, effectively and economically

At the conclusion of the review, a comprehensive report identifies your department's strengths, together with recommendations for improvements.

The Process

We follow the standard IIA quality assurance review methodology which allows the review team to assess:

  •     deviations in performance from acknowledged best practices for internal auditing, from IIA Standards, and from the    internally prescribed internal audit function procedures; and

  •     the operation of the internal auditing function as perceived by the internal audit function's members and customers.

 The review team also evaluates other issues that affect the internal audit function, including:

  •         the integration of the concepts of business controls into the internal audit practice;

  •         the adding of value to the organization by providing insights into efficiency and effectiveness;

  •         the optimization of internal audit staff performance;

  •         the effectiveness of communication with staff and company personnel;

  •         the development of internal audit staff, both personally and professionally;

  •         the use of technology to increase efficiency and effectiveness; and

  •         the effectiveness of ongoing internal quality assurance programs.

 Performing a Quality Assurance Review

To comply with the requirements of Standard 1310, we follow the standardized IIA approach which takes the form of a five-stage process, including:

  •          planning and preparation

  •          determining the customers’ needs

  •          analyzing the internal audit process

  •          communicating the results of the review

  •          ongoing improvement

 Planning and Preparation

As part of the planning and preparation process, the quality assurance review team reviews the latest quality standards and internal audit best practices as established by the IIA. At this stage, the team will normally plan its initial meetings with stakeholders and prepare its information requests for the internal audit department.

 Determining the Customer’s Needs

The main aim of this phase is an assessment of management's commitment to and support of internal auditing. This is done by getting comments and observations about the internal audit function from its customers, including management, the audit committee and auditees.

An understanding of the environment within which the internal audit function operates is essential to gaining a clearer understanding of corporate objectives. In addition, where performance shortfalls are subsequently noted, practical recommendations for improvement can be drawn up.

Analyzing the Internal Audit Process

Critical internal audit processes are generally taken to include:

  •          developing the overall audit plan

  •          planning individual audits

  •          carrying out the audit program

  •          communicating results

  •          follow-up

 In order to evaluate the process against the IIA Standards, the quality assurance review team must obtain a comprehensive understanding of the internal audit process implemented within the organization and be up-to-date with the latest of the IIA’s Practice Advisories in order to make acceptable recommendations for improving the existing process.

 Communicating the Results of the Review

As with any audit, the aim of this phase is to communicate the results of the review to management and the audit committee in a form that meets their requirements.

The report will make clear to management the overall conclusions, significant points and items requiring action. As such, it interprets the results of the findings and focus the reporting on high-level aspects of the review, particularly for the audit committee.

 The audit committee may have questions about the review, and the quality assurance review team will be prepared to respond to requests for additional information or further insights on their findings.

The report will include an assessment of the extent to which specific standards were achieved. Where deficiencies are noted, the findings, improvement opportunities and recommendations should be stated. As in any conventional audit, an action plan with dates and allocated responsibilities will have been agreed with the head of internal audit and will be included in the report.


As with any audit, the recommendations resulting from the quality assurance review are of little value if they are not effectively implemented. The quality assurance review team, together with the audit committee, will establish a clear follow-up process to make sure that the action plan is implemented and effective.

Quality Assurance Methodology

In order to achieve professionally acceptable standards of review, the conducting of a quality assurance review has been carefully structured to follow the IIA’s specific methodology. This involves, at a minimum, interviews with internal auditing   stakeholders, and a review of the internal auditing department charter and of a representative sample of working papers and reports.

 The stakeholder interviews are scheduled as early as possible in the process in order to structure the review to meet stakeholders’ requirements and expectations.


In a typical medium-sized Internal Audit function, the process will take two to three weeks

  Further Information Request Form