QAR Program for 2017 Standards

SIAAB Quality Assurance Review Program



This page provides tools covering The Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing (Standards) effective January 1, 2017.


The State Internal Audit Advisory Board (SIAAB) is responsible for coordinating external quality assurance reviews (peer reviews) among the State's internal audit organizations in accordance with the Fiscal Control and Internal Auditing Act (FCIAA).  State internal audit organizations designated to have an internal audit function are required to conduct an external quality assurance assessment (EQA) or a self-assessment with independent external validation (SAIV), at least once every five years by an independent reviewer or review team from outside the organization (IIA Attribute Standard 1312).  Each Internal Audit Organization and Quality Assurance Review Team is required to follow SIAAB's external quality assurance guidelines as established in SIAAB Bylaws Article III - Quality Assurance Review Program and as presented below.


Requesting SIAAB's Approval of Quality Assurance Review Team 

Chief Internal Auditors are required to obtain SIAAB's approval of the quality assurance methodology and review team members prior to beginning any external quality assurance reviews.   To initiate the approval process, Chief Internal Auditors are required to submit the following documents to the SIAAB Chair:

In addition, each reviewer/external validator team member must successfully complete the SIAAB's On-line Quality Assurance Review Training Program:


SIAAB's External Quality Assurance Reviews


Late External Quality Assurance Reviews 

According to AS 1312, external assessments must be conduct at least once every five years.  This is an unconditional requirement. Therefore, if an internal audit activity is delinquent on their external assessment, this must be communicated to senior management and the board, if applicable (A3 1322).  Further, nonconformance must be disclosed in each audit report, including the reason(s) for and impact of nonconformance (PS 2431).  The phrase “conducted in conformance with the International Standards for the Professional Practice of Internal Auditing” cannot be used when an internal audit function is delinquent on their external assessment (AS 1321 and PS 2430).

When an internal audit function becomes more than one year delinquent on their external assessment, SIAAB may send a letter to their chief executive officer under Bylaw 3.5.2. If your audit function is or will be delinquent on your QAR, we encourage you to notify SIAAB.  Below is a sample notification letter: