From RiskWiki
Jump to: navigation, search



Quality Assurance, is the review and control necessary throughout all stages of an internal audit. The final review should ensure that

  • the direction of the audit has proved appropriate
  • the audit approach has been satisfactory
  • that the audit has been correctly documented so as to support the audit findings and recommendation

Quality Assurance is a review process which if correctly applied will provide assurance to both audit and client management that defined auditing practices and standards have been complied with. Quality Assurance also enables the early identification of non compliance with prescribed procedures. It also allows audit management to determine the appropriateness of such procedures. Another feature in the Quality Assurance process is the identification of training needs for field auditors including project team managers.

Quality Assurance is not the sole prerogative of the audit manager, rather it is a process which involves all participants from the field auditor and project team leader, audit manager to Corporate Audit Committee and to a lesser extent the clients.

In this article we focus on quality assurance as a review mechanism, but it should be remembered that under total qualioty management principles, we conduct quality assurance throughout the project. Its components in this form include:

  • Specification of the methods;
  • Training and refreshing skills of staff;
  • Recruitment of appropriate staff;
  • Feedback and suggestions from staff and clients as to process improvements;
  • Establishment of a permanent quality assurance/improvement review committee focussed on process improvement;
  • Monitoring of audit process performance measures;
  • Adoption of processes that control and manage throughput and production point queues (like in-trays!!);
  • Automatic escalation of alerts on system or process failure; and
  • On going and active direction by the management team.

The portion of quality assurance described here is specifically focussed on review stage quality assurance which is specifically addressed and required by the auditing standards.

Responsibility for Review and Quality Assurance

Under the Annual Audit Plans, there are three levels of audit activity. These are :

  • Program Reviews which are of a national or state wide focus
  • Locality Audits which are oriented to activities in a single location
  • Outlet Audits are audits of individual outlet offices

Review and Quality Assurance should be applied to all and by the appropriate officers irrespective to the type of audit being undertaken. Naturally, the field auditor at all times should be aware of the importance in ensuring that work papers and audit documentation are of a high and presentable standard. Included is the need to ensure the next level of audit management takes an active role and interest in reviewing workpapers and progress accordingly.

At the Program Review level, the quality assurance should be undertaken by the Director, Internal Audit and would have been reviewed by the field auditors project manager.

For Locality Audits the quality assurance would be performed by the State Audit Manager/Director Internal Audit.

Outlet Audits would be reviewed by the field auditor with input provided by other field auditors and the State Audit Manager.

The focus of all review and quality assurance action is to ensure specified audit objectives have been met, the scope and objectives are measured against the final product, working papers are adequate and can support findings and that there is evidence of a review process with outcomes being addressed satisfactorily by the field auditor.

Quality Assurance through the Audit Flow

Any audit is a planned and controlled constructive analysis of the strengths and weaknesses of an organisation's systems to gauge the extent to which they assist the organisation to achieve its objectives with adequate cost effective and efficient use of resources.

Quality Assurance is the process whereby the objectives are visited during and at the completion of an audit.

Quality Assurance in the Audit Phases

All audits can be considered to be undertaken in five major phases during which Quality Assurance should be applied. This will ensure early identification of any weaknesses and that the final product/report is not unnecessarily delayed.

Major phases of an Audit:

  • Planning
  • Documentation
  • Analysis
  • Verification/Testing
  • Reporting

The Quality Assurance function should apply at the beginning, during and completion of each phase. A simple, efficient and effective check during each audit phase by the field auditor and audit leader/manager will greatly assist in ensuring the audit has been completed properly and that the product is a quality product readily accepted by client management.

Incorporation of the Quality Assurance process during each audit phase not only assists in identifying whether the field auditor is on track but in itself is a control mechanism.

Additionally, Quality Assurance highlights the areas of strengths or weaknesses respective to field auditors work and thus corrective action can be initiated.

Quality Assurance during Planning Phase

The planning phase is critical to a successful audit outcome in that wasted time and application of resources may be avoided if in the initial stage all requirements are adequately planned and catered for.

The field auditor should identify the system objectives, specify the audit objectives and scope, have a clear picture of the system boundaries, formulate a brief system overview, allocate resources, itemise broadly the time required for each major phase of the audit and determine topical issues relevant to the system being audited. Also any major organisational policy relating to the system should be identified.

Each phase of the audit should have a time and resources allocated. This will allow both the field auditor and the audit manager or project team leader to monitor the pace of the audit.

The audit manager should receive a verbal report of progress to date. This will allow the audit manager or project team leader to be aware of any issues, potential problems and guide the field auditor in the correct path.

Evidence of such activities should be included in the working papers under the planning phase.

During the planning phase, a review of previous audit reports and the status of recommendations from such reports would be performed by the field auditor.

Additionally, the basis of the entry interview will be prepared and checked with the audit manager. This should include aspects in relation to audit methodology.

Quality Assurance during Documentation Phase

The Quality Assurance applied during the Documentation phase essentially should centre on the outcome of the Entry Interview. Also included are User procedural guides and system narratives, legislation that is applicable, program notes and budget reports/extracts, previous DRT or ANAO audit reports and follow up action by users. The DRT Risk Assessment of DRT Programs 1990/91 and reports from a program evaluation which may include the actual system being audited should be included in the work papers. All these documents will assist the auditor in gaining an accurate overview of the system and its environment.

A walk-through of the system and notation of manual and compliance requirements should be performed during this phase. The walk-through gives the field auditor an opportunity to gain an understanding of the system and subsequently document it. It also lays the foundation for the preparation of a control model.

Evidence of walk-throughs and verification of the walk-through flowchart or narrative description by the users must be sighted by the audit manager or project leader as part of the Quality Assurance process.

The emphasis of the documentation phase is to ensure there is a sufficient basis for the field auditor to lay the foundation of the audit in order that the essential knowledge about the system and its environment are in the working papers. This allows the reviewer performing the Quality Assurance, to ascertain certain aspects of the system and to form an overview of the system itself. The documentation sets the background.

A brief index of documentation should be included in the working papers with areas of interest or relevant to the system being highlighted. This will provide the audit manager with an efficient reference to subject matter regarding the system.

Quality Assurance during Evaluation Phase

The Evaluation phase essentially is where the field auditor develops a control model. The control model can also take the form of a risk assessment matrix approach.

Data for the control model should be drawn from the walk-through of the system, outcome of the entry interview, reference to the documentation already collected and from standard control models.

The control model is simply the identification of controls and respective control objectives that an auditor would ideally like to see in place regarding a system. These are subsequently matched against the actual controls in place in the system. The subsequent verification process will identify the adequacy of control and identify weaknesses, strengths and potential exposures.

Quality Assurance at and during this audits phase is critical as it is the basis for the field auditor to evaluate the system. The field auditor should have the draft control model reviewed by the project leader and subsequently the audit manager before embarking on the evaluation phase.

This will ensure the audit objectives and scope are on the right track and identify the field auditors level of understanding in respect to defining control models.

The audit manager should examine the control model for its appropriateness in a rigorous fashion. Only when the control model is regarded as being satisfactory should the field auditor proceed to the actual evaluation phase.

A brief written statement on the final control model by the audit manager or project leader to the effect of a review has been performed should also be mandatory.

Quality Assurance during Verification/Testing Phase

The evaluation of the control model is carried out by analysing the results of applying the control model in the actual environment the system resides.

The comparison of ideal controls against actual controls in the system and its environment will provide the field auditor with sufficient data to form an opinion on the adequacy of controls.

It should be noted that even if the system does not completely relate to the control model it may in fact be well controlled and contain compensating control features. This often happens when a standard control model is used as such models are aimed at systems which have common features. The system being audited may not fit this scenario in terms of commonality.

The analysis and evaluation of the control model should be done with the assistance of specialist members of the audit staff. This Quality Assurance process will ensure all features respective to analysis of the adequacy, efficiency and effective of controls in the system are appropriately covered.

Quality Assurance after completion of the evaluation of the control model is extremely important. It allows for an independent and objective view of the results to be formed by the project leader or audit manager. It is not a time consuming process and will identify areas where the field auditor has placed too much emphasis on a particular control feature or not enough. Quality Assurance at this stage also provides the opportunity to identify areas of the system which may need to be revised or where clarification of a control feature is required.

Essentially the Quality Assurance during this phase ensures the appropriateness of testing which follows and that the evaluation of the control model has been performed properly and with due regard to audit standards. Again, it also provides an indication of the level of experience and understanding of the field auditor. Conversely it is an education for the project or audit manager. These higher beings are not always correct.

The testing phase is also critical in that it ensures the field auditor can substantiate and validate the direction of the testing. This would be set out in the rationale statement which is the auditor's opinion on the system of internal control and includes the details of and justification for the testing which will be carried out to confirm this opinion

Quality Assurance must include an examination of the logic of the rationale and subsequent testing and also be directed to ensuring test papers are appropriately indexed to each test/in and provide a comprehensive and meaningful basis for review.

Evaluation of test results from a Quality Assurance perspective provide a sound basis for ensuring the exit interview and draft report are based on accurate and tested findings.

Quality Assurance during Reporting Phase

Quality Assurance should be applied to the draft report prepared by the field auditor. This will allow for all findings to be revisited by the audit manager and any issues which may emerge as being potentially critical to acceptance of the report being identified and addressed properly in the report.

The audit manager should review the draft report with the objective of ensuring all findings can be supported and substantiated, that they are accurate and complete. The report must address real concerns and issues and not petty mundane matters. Recommendations are to be sound, cost efficient and of practical benefit to the users.

The above Quality Assurance process can be performed quickly in light of the previous Quality Assurance process during the other stages of the audit.

The review of the draft report is an opportunity for the audit manager to discuss with the field auditor any aspects in relation to perceived training needs as a result of the audit.

All amended copies of the draft should be retained as a management trail and to provide the audit manager with a basis for determining when and why amendments were made.

Final Quality Assurance of an Audit

The final Quality Assurance is ideally a complete revision of the workpapers by the audit manager at the draft reporting stage. A review sheet at the from of the workpapers should be made available for this purpose.

The review sheet allows for the audit managers comments to be written and subsequently the field auditors response.

The Quality Assurance process at this stage also determines whether the field auditor has used prescribed forms and gives an indication of whether audit standards, procedures and methodologies are being correctly applied by audit staff.

Process of Quality Assurance


The purpose of this document is to outline the proposed procedures to ensure a high quality professional standard is achieved and maintained throughout planning, fieldwork and reporting of the audit.

The proposed option for review and quality assurance of the audit work performed is as follows:

First Review

All State Audit Managers (SAMs) will be responsible for the review of all work papers produced within their respective State, except work they produce themselves. State Audit Managers (SAMS) will complete Parts 1a, 1b and 1c of the QA Standard Working Papers when reviewing the work of their staff.

State audit managers will form a peer review group that will conduct random peer reviews of the audit papers of other SAMs according to a schedule to be issued annually. In these tasks, the SAMs will complete Part 1d.

The primary objective of this first review is to ensure adequate audit coverage was provided in the State of review to allow any other professional auditor to express a similar audit opinion based on audit evidence as presented.

Second Review

Where the National Audit consists of multiple national components (such as a Financial Statements Audit), a National Manager will be appointed for each component. Where the National Audit consists of only one component, proceede directly to the third review.

After the first review, all work papers for each audit component, when completed in a State or Central Office, should be copied and sent (in an overnight bag if required, otherwise through an online audit reporting system) to the relevant Audit Manager for that audit component item. The Audit Manager will perform the second review, Part 2 (of QA Standard Working Papers).

The objective of the second review is for the Audit Manger to determine whether sufficient audit coverage has been performed from a national perspective to facilitate the expression of a national audit opinion. This review should be performed prior to an audit opinion being expressed on the State returns.

Third Review

On the completion of component audit review by the Audit Managers and finalisation of draft audit reports, each Audit Manager should forward work papers and draft reports to the National Co-ordinator. The National Co-ordinator will review all work on completion. The National Co-ordinator will also complete quality assurance checklists. The National Co-ordinator will complete Part 3 - Third Review (of the QA Standard Working Papers).

The objective of the third review is to ensure sufficient audit evidence exists to support the content of the component audit report prepared by each Audit Manager. The National Co-ordinator is also to prepare and complete a quality assurance checklist which will verify that all review processes are complete, and all audit milestones attained and verified. The primary responsibility of the National Co-ordinator is ensuring the quality of audit work is of a sufficient standard to withstand any reasonable scrutiny.

Quality Assurance

National Level

The Director Internal Audit will have overall responsibility for all audit opinions expressed. To ensure reasonableness of the audit opinion expressed, a quality assurance review will be performed by the Director Internal Audit. The objective of this review is to ensure no major deficiencies exist in audit coverage, and the national audit opinion is sufficiently supported. The Director IA will complete Part 4 - QA (of the QA Standard Working Papers).

Global Level

For Global Audits, National Directors of Internal Audit will meet with the International Director on a quarterly or bi-monthly basis (as appropriate) and coordinate global opinions basied on the national audit opinions. Issues will be graded accoring to the level of global (as opposed to national) risk and matters specific to individual countries, but not of global implication will be separated from the global issues into national sections of the global report, with a summary and index prepared to allow for rapid review by the global governance committee.


Quality assurance should be the responsibility of the Audit Manger. All working papers should be reviewed by him/her at the during and at the completion of fieldwork prior to the preparation of the national report. All State reports should also be reviewed by him/her prior to their submission/discussion to ensure consistency, particularly of issues that may become part of the national report.

The Audit Manager's papers should be subject to quality assurance review by his/her State Audit Manger where that is appropriate. The papers of Audit Managers who are themselves a State Audit Manager should be reviewed by another State Audit Manager according to the annual QA peer review schedule.

In all States/Territories where the audit is conducted the relevant State Audit Manager has responsibility for the day-to-day supervision and review of the audit, and should participate in entry and exit discussions and the preparation of the State report.