SIAAB Quality Assurance Review Program

This page provides tools covering The Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing (Standards) effective January 1, 2017.

The State Internal Audit Advisory Board (SIAAB) is responsible for coordinating external quality assurance reviews (peer reviews) among the State's internal audit organizations in accordance with the Fiscal Control and Internal Auditing Act (FCIAA).  State internal audit organizations designated to have an internal audit function are required to conduct an external quality assurance assessment (EQA) or a self-assessment with independent external validation (SAIV), at least once every five years by an independent reviewer or review team from outside the organization (IIA Attribute Standard 1312). Each Internal Audit Organization and Quality Assurance Review Team is required to follow SIAAB's external quality assurance guidelines as established in SIAAB Bylaws Article III - Quality Assurance Review Program and as presented below.

Requesting SIAAB's Approval of Quality Assurance Review Team

Chief Internal Auditors are required to obtain SIAAB's approval of the quality assurance methodology and review team members prior to beginning any external quality assurance reviews. To initiate the approval process, Chief Internal Auditors are required to submit the following documents to the SIAAB Chair:

In addition, each reviewer/external validator team member must successfully complete the SIAAB's On-line Quality Assurance Review Training Program:

SIAAB's External Quality Assurance Reviews

Late External Quality Assurance Reviews

According to AS 1312, external assessments must be conducted at least once every five years. This is an unconditional requirement. Therefore, if an internal audit activity is delinquent on their external assessment, it must disclose the nonconformance and corrective action to be taken to senior management and the board. The Chief Internal Auditor shall determine the manner of disclosure appropriate for the agency which may include explanatory paragraphs in audit reports, inclusion in the internal audit annual report, or other as deemed appropriate. The disclosure is required annually until a subsequent review has been conducted by the external validator verifying that appropriate corrective action has been taken and approved by the Board. The phrase "conducted in conformance with the International Standards for the Professional Practice of Internal Auditing" cannot be used when an internal audit function is delinquent on their external assessment (AS 1321 and PS 2430).

When an internal audit function becomes more than one year delinquent on their external assessment, SIAAB may send a letter to their chief executive officer under Bylaw 3.5.2. If your audit function is or will be delinquent on your QAR, we encourage you to notify SIAAB. Below is a sample notification letter: