Exposure Draft of QSIA 1, Internal Audit Quality Aspects

The new Standard on Internal Audit (SIA) prescribes comprehensive Quality Assurance measures to ensure internal audit engagements are efficient, effective, and fully conform to professional standards and regulatory requirements. Applicable to all internal audit engagements, the standard mandates the establishment of a Quality Assurance and Improvement Program (QAIP). The objectives of the QAIP are to structure quality assurance, maintain objectivity and consistency in reporting, and drive continuous improvement. The QAIP requires internal reviews (self-assessments and peer reviews), external assessments by independent professionals, and stakeholder feedback from auditees and the Audit Committee. The standard necessitates a formal quality assessment at least once every three years. Furthermore, it details requirements for audit documentation, mandating that records must be complete, standardized, and assembled within 60 days of the report’s signing, and retained securely for a minimum of seven years or until the conclusion of any related legal proceedings. Finally, the standard requires strict adherence to ethical principles, including objectivity, professional competence, and confidentiality, to safeguard the independence and credibility of the internal audit function.

The Institute of Chartered Accountants of India

Quality Standard on
Internal Audit (QSIA) 1
Internal Audit Quality Aspects

1. Introduction

1.1 Internal Audit quality assurance is essential for ensuring that internal audit assignments comply with professional standards, stakeholder expectations, and regulatory requirements. A robust quality assurance framework enhances the Internal Audit Maturity Level by rigorous focus on efficiency, effectiveness, credibility, consistency, and reliability in audit execution. Quality is a combined measure of conformance with applicable Standards on Internal Audit (SIA) and the achievement of the internal audit function’s performance objectives.

1.2 This Standard prescribes quality assurance measures for internal audit engagements to ensure their efficiency, effectiveness, and conformity with applicable internal audit frameworks.

1.3 Scope: This Standard applies to all internal audit engagements and requires that internal auditors establish and maintain a system of quality assurance covering audit processes, reporting, engagement performance measurement and follow-up actions.

2. Effective Date

2.1 This Standard is applicable for internal audits beginning on or after a date notified by the Council of the Institute.

3. Objectives

3.1 The objectives of this QSIA are to ensure that internal auditor:

• Implement a structured quality assurance process to improve audit effectiveness.
• Maintain objectivity, consistency, and accuracy in audit planning, execution, and reporting.
• Establish and adhere to review mechanisms for audit work at different levels and identify the area for improvements.
• Conduct periodic evaluations of internal audit team performance.
• Receive feedback about internal audit team’s performance and identify opportunities for improvement.
• Ensure that the internal audit activity is continuously improving and conforming to the highest professional standards.

4. Requirements

4.1 Establishing a Quality Assurance Framework (Refer Para. A1)

Internal auditors shall develop and implement a Quality Assurance and Improvement Program (QAIP) that includes:

• Internal reviews – Monitoring of internal audit team performance and periodic self-assessment or evaluation of work done by another team of internal auditor.
• External assessments – Independent reviews by external professionals in a defined time frame. Quality Standard on Internal Audit (QSIA) 2, Peer Review and Third- Party Assessment covers this aspect.
• Stakeholder feedback – Inputs or discussion on the observations from auditees, senior management and the Audit Committee.

The QAIP shall align with internal audit charters, regulatory requirements, and best practices.

4.2 Quality Assurance and Continuous Improvement (Refer Para. A2)

• Quality Assurance Improvement Programs (QAIP) must evaluate compliance with Standards on Internal Audit, identify performance gaps and drive ongoing enhancements to audit methodologies and outcomes.
• A formal quality assessment should be done once in every three years.
• Professional education and training and development programmes shall be conducted to maintain the competency of the team.
• QAIP evaluates that internal audit team applies robust methodology, approach and templates coping with the continuous change in both external and internal environment.
• QAIP evaluates that internal audit team is using the right audit software, Artificial Intelligence (AI) tools and data analytics in applicable areas.
• QAIP evaluates that sufficient work is performed in accordance with the audit plan to reach a well justified conclusion.
• QAIP evaluated that the internal audit team has sufficient knowledge and Technical / subject matter expertise to understand. the industry trends and technicalities involved.

In case external experts like Valuers, Engineers, Legal Experts, IT and Cyber-Security Experts, Data Scientists) are consulted, evaluate the process of selection and expertise evaluation.

4.3 Post-Audit Quality Assessments & Continuous Improvement (Refer Para. A3)

Internal audit team must conduct periodic quality assessments, including:

• Self-assessments – Internal reviews of audit effectiveness.
• External assessments – Independent quality evaluations where required, at appropriate intervals.

Continuous improvement initiatives should focus on:

• Identifying trends and recurring audit challenges.
• Enhancing audit methodologies through training, capacity building and best practices.

4.4 Quality Assurance in Audit Documentation (Refer Para. A4)

• Quality Assessment must be there to ensure that internal audit team has sufficient expertise in maintaining complete and standarised documentation of all planning, execution and reporting activity required for transparent regulatory review.
• Internal Audit Team shall be capable to assemble the file within 60 days after the signing of internal audit report.

4.5 Retention of Audit Documentation (Refer Para. A5)

Internal audit documentation shall be retained for:

• A minimum of seven 7 years from the date of the audit report, or
• Until the conclusion of any related regulatory or legal proceedings (whichever is later).

Retention policies must ensure:

• Protection against unauthorized alterations or loss.
• Secure access control and confidentiality.
• Compliance with ICAI’s professional and legal requirements.

Secure Destruction of Documents:

Upon expiry of the retention period, documents must be securely destroyed using appropriate methods (e.g., shredding for physical records, permanent deletion for electronic records) to prevent unauthorized access, tampering etc.

4.6 Compliance with Ethical Standards (Refer Para. A6)

Internal auditors shall adhere to ethical principles, including:

• Objectivity and Independence – Avoiding conflicts of interest.
• Professional Competence and Due Care – Staying updated with regulatory changes, entity’s business environment and audit techniques.
• Confidentiality – Protecting sensitive audit information from unauthorized disclosure.

*****

Application and Other Explanatory Material

A1. Establishing a Quality Assurance Framework (Refer Para. 4.1): QAIP helps ensure consistency, credibility, and reliability of audit outcomes. It supports continuous enhancement of audit quality and reinforces stakeholder confidence. Alignment with the audit charter ensures QAIP is integrated into governance structures.

A2. Quality Assurance and Continuous Improvement (Refer Para. 4.2): Continuous improvement requires monitoring compliance with SIAs and updating audit practices in response to changes in technology, regulations, and organizational risks. Periodic external assessments provide independent validation of the internal audit function’s quality.

A3. Post-Audit Quality Assessments & Continuous Improvement (Refer Para. 4.3): Self-assessments allow the audit team to reflect on effectiveness and efficiency, while external assessments provide unbiased benchmarking against industry and regulatory expectations. Continuous improvement helps in adopting innovative tools and global best practices.

A4. Quality Assurance in Audit Documentation (Refer Para. 4.4): Proper documentation provides evidence of compliance with SIAs and supports transparency during peer reviews or regulatory scrutiny. Timely file assembly ensures information is consolidated and accessible when needed.

A5. Retention of Audit Documentation (Refer Para. 4.5): Retention periods are designed to align with legal, regulatory, and professional requirements. Secure retention protects the integrity of records, while secure destruction ensures confidentiality once retention is no longer required.

A6. Compliance with Ethical Standards (Refer Para. 4.6): Ethical conduct underpins trust in the internal audit profession. Adherence to the ICAI Code of Ethics and global standards safeguards independence, protects sensitive information, and ensures quality audit delivery.