The State Internal Audit Advisory Board (SIAAB) is responsible for coordinating quality assurance reviews among the State’s internal audit organizations in accordance with the Fiscal Control and Internal Auditing Act (FCIAA). State of Illinois internal audit organizations designated to have an internal audit function are required to conduct an external quality assurance assessment (EQA) or a self-assessment with independent external validation (SAIV), at least once every five years by an independent reviewer or review team from outside the organization (IIA Attribute Standard 1312). Each internal audit organization and quality assurance review team is required to follow SIAAB’s external quality assurance program as discussed below and in SIAAB Bylaws - Article III Quality Assurance Review Program.

The chief internal auditor of each designated State of Illinois Internal Audit Organization is responsible for ensuring that the required external assessments are completed within five years from the date of the prior QAR report was submitted to the SIAAB Quality Assurance Coordinator or Assistant Quality Assurance Coordinator for approval. Each quality assurance review conducted on behalf of a State of Illinois internal audit organization is required to determine whether the internal audit organization is in conformance with the following Institute of Internal Auditors (IIA) mandatory guidance:

1. International Standards for the Professional Practice of Internal Auditing (Standards); and

2. Code of Ethics

SIAAB has developed a specific internal and external quality assurance review program for conducting EQAs or SAIVs to which each State of Illinois chief internal auditor is required to adhere. Such reviews are required to be conducted using the SIAAB’s Audit Programs and Quality Assurance Matrix applicable for the period in which the external quality assessment covers, unless use of an alternate QAR process, such as the IIA QAR Manual or IIA resources, has been approved by the Board.

Chief internal auditors are required to obtain approval of the proposed review methodology (EQA or SAIV) and review team members from SIAAB prior to finalizing any quality assurance review arrangements. To initiate SIAAB’s review, the chief internal auditor is required to submit the following documents to the Quality Assurance Review Coordinator:

1. Request to the SIAAB for External Quality Assurance Review Team Approval – submitted to the Quality Assurance Review Coordinator within 60 days of the anticipated external quality assurance start date.

2. SIAAB External Quality Assurance Review Confidentiality Policy / Commitment Form – signed by each external quality assurance review team member/validator.

3. SIAAB External Quality Assurance Review Statement of Independence – signed by each external quality assurance review team member/validator.

4. Resumes for each external quality assurance review team member/validator.

SIAAB will review the chief internal auditor's Request to the SIAAB for External Quality Assurance Review Team Approval to determine whether each review team member/validator adequately possesses the following qualifications, experience, independence and training requirements:

1. A bachelor's degree with course work in auditing, business management, public administration, economics, computer science, accounting (preferably with twelve semester hours) or other related subjects.
2. Experience in the auditing field, or other relevant technical or industry experience which enhances the collective proficiency of the review team.
3. Successful completion of the most recently updated SIAAB’s online training course covering the Internal Auditing Standards in the State of Illinois for the period applicable to the EQA or SAIV being performed, unless waived by the Board.
4. Compliant with SIAAB Bylaws - Article II, Section V, Continuing Professional Education Requirements.

At least one member of the review team must also:

• Have four years of progressively responsible auditing experience and certification as a Certified Internal Auditor or Certified Public Accountant OR five years of progressively responsible professional auditing experience.
• Have some governmental experience or other industry specific experience.

Review Team Independence:

It is critical that review team members be free from any real or apparent conflict of interest, obligation to, or interest in, the Agency/Office whose internal audit activity is the subject of the external assessment. Examples of personal impairments include, but are not limited to the following:

1. Immediate family or a close family member who is a director or officer of the quality assurance/self-assessment entity or is in a position to exert direct and significant influence over the entity. Immediate family member is a spouse, spouse equivalent, or dependent (whether or not related). A close family member is a parent, sibling or nondependent child;

2. Financial interest that is direct, or is significant/material though indirect, in the quality assurance/self-assessment entity;

3. Responsibility for providing consulting and/or internal/external assurance services of the entity, or decision-making that could affect operations of the entity within the previous year. For example, past or concurrent consulting services and/or internal/external preparing source documents or originating data, in electronic or other form; posting transactions, authorizing, executing, or consummating transactions; maintaining an entity’s bank account or otherwise having custody of the entity’s bank account or otherwise having custody of the entity’s funds; or otherwise exercising authority on behalf of the entity or having authority to do so. Quality assurance team members, external validators, special assistants and/or SIAAB members should refrain from conducting quality assurance reviews/external validations/subsequent reviews over an entity or program for which they were previously responsible. Objectivity is presumed to be impaired if a quality assurance team member, external validator, special assistant, and/or SIAAB member provides quality assurance services for an activity for which they had responsibility within the previous year;

4. Preconceived ideas toward individuals, groups, organizations, or objectives of a particular program that could bias the quality assurance activity;

5. Biases, including those induced by political, ideological, or social convictions that result from employment in, or loyalty to, a particular type of policy, group, organization, or level of government; and

6. Seeking employment with the entity while conducting the EQA/SAIV.

SIAAB requires that each review team member/validator be organizationally independent. Accordingly, SIAAB will not approve proposed review team members when one or more of the following characteristics are present:

1. A review team member who participated in the last EQA or SAIV performed of the Agency/Office;.

2. Special assistant auditors for the Office of the Auditor General who performed the last Agency/Office financial and/or compliance audit;

3. Individuals or firms that have provided significant consulting services for Agency/Office and/or the internal audit function during the scope of the quality assurance review;

4. Individuals employed or formerly employed by the Agency/Office during the scope of the quality assurance review; and

5. Reciprocal arrangements between two State Internal Audit Organizations.

External Quality Assurance Review Methodologies:

The SIAAB has developed a Quality Assurance Matrix that is required to be used by all State internal audit organizations when conducting either a full EQA or SAIV, unless use of an alternate QAR process has been approved by the Board. The following schedule, pursuant to the IIA’s IPPF, reflects key characteristics between the scope and process of each methodology approved by SIAAB:

EQA	SAIV
•  SIAAB Quality Assurance Matrix completed by EQA review team	•  SIAAB Quality Assurance Matrix completed by chief internal auditor and validated by external reviewer
•  EQA report prepared by EQA review team leader using the SIAAB External Quality Assurance Report template	•  SAIV report prepared by chief internal auditor and validated by external reviewer using the SIAAB External Quality Assurance Report template
•  EQA Scope:  − Covers the entire spectrum of audit and consulting work performed;  − Includes benchmarking, identification, and reporting of leading practices to ensure efficient and/or effective internal audit activity;  − Internal Audit Staff Survey / Questionnaire;  − Chief Executive Officer and Audit Committee (if applicable) Surveys / Questionnaire;  − Includes a determination of whether the internal audit activity is in conformance with IIA’s Definition of Internal Auditing, Code of Ethics, Core Principles, and Standards;  − Reviews expectations of the internal audit activity expressed by the board, senior management and operational managers;  − Integration of the internal audit activity into the organization’s governance process including the relationship between and among the key groups involved in the process;  − Tools and techniques employed by the internal audit activity;  − Mix of knowledge, experience, and disciplines within the staff, including staff focus on process improvements; and  − Determination as to whether or not the internal audit activity adds value and improves the organization’s operations.	•  SAIV Scope:  − More limited scope than that of an EQA;  − Primary focus is on conformance with IIA’s Definition of Internal Auditing, Code of Ethics, Core Principles, and Standards;  − Limited attention to other areas such as benchmarking, review and consultation as to employment of leading practices, and interviews with senior and operating management;  − Internal Audit Staff Survey / Questionnaire; and  − Chief Executive Officers and Audit Committee (if applicable) Survey / Questionnaire.

As noted above, SIAAB requires under both the EQA and SAIV that external reviewers/validators conduct interviews of the internal audit staff, chief executive officer or director, and the audit committee/board, if applicable. SIAAB has developed the following example templates to be used for interviews:

• Internal Audit Staff Survey / Questionnaire
• Chief Executive Officer and Audit Committee (if applicable) Survey / Questionnaire

SIAAB’s primary focus is whether the internal audit organization is in conformance with IIA’s Definition of Internal Auditing, Code of Ethics, Core Principles, and Standards. SIAAB has reviewed the IIA Practice Advisories and has adopted specific best practices, to which all State internal audit organizations are required to adhere and has incorporated these within the SIAAB Quality Assurance Matrix. SIAAB requires internal audit organizations to use the SIAAB Audit Programs and Quality Assurance Review Matrix when conducting either an EQA or a SAIV, unless use of an alternate QAR process has been approved by the Board..

QUALITY ASSURANCE REVIEW REPORTS

At the conclusion of the EQA/SAIV, the external quality assurance reviewer/validator shall meet with the chief internal auditor of the internal audit organization to discuss the preliminary results of the review. Observations or suggestions for improvement in techniques used by the internal audit organization, which do not give rise to a conformance issue with the IIA’s Definition of Internal Auditing, Code of Ethics, Core Principles, or Standards should not be included in the internal audit organization’s EQA/SAIV report, rather they should be discussed with the chief internal auditor during the EQA/SAIV review.

Resolution of Disputes:

When a State of Illinois internal audit organization is not in concurrence with the results of their external quality assurance review, if irresolvable at the review team level and the SIAAB Assistant Quality Assurance Coordinator level, the dispute should proceed to the SIAAB Quality Assurance Coordinator for resolution, and, if necessary, brought to the SIAAB for discussion, where resolution shall be final and binding.

Disputes internal to the external quality assurance review team should proceed to the Assistant Quality Assurance Coordinator for resolution, and, may be appealed to the Quality Assurance Coordinator for resolution, and if necessary, brought to the SIAAB for discussion, where resolution shall be final and binding.

EQA/SAIV Report Review/Distribution:

SIAAB has developed a Quality Assurance Report Template which is required to be used by State internal audit organizations when conducting an EQA or SAIV. The template was developed to ensure uniformity and consistency in conducting and reporting EQA/SAIV reviews between the various State of Illinois internal audit organizations for which SIAAB has authority.

The External Quality Assurance Report includes the following key elements:

• Specific content and format to ensure uniformity and consistency between State Internal Audit Organizations;
• EQA or SAIV Review End Date;
• Cover page with opinion on conformance with IIA’s Definition of Internal Auditing, Code of Ethics, Core Principles, and International Standards for the Professional Practice of Internal Auditing (Standards);
• Signatures of the chief internal auditor, EQA Reviewer /SAIV Validator;
• Responses by the chief internal auditors to EQA Reviewer/SAIV Validator recommendations; and
• EQA Reviewer/SAIV Validator’s concurrence.

SIAAB requires each Internal Audit Organization to submit the External Quality Assurance Report and Quality Assurance Matrix to the Assistant Quality Assurance Coordinator for the preliminary SIAAB review. SIAAB has developed a Quality Assurance Coordinator Review Checklist template that will be used to conduct a review of the Internal Audit Organization’s EQA/SAIV documents. Upon completion of the review, the Assistant Quality Assurance Coordinator will make a recommendation to the Quality Assurance Coordinator on whether the Board should accept or disagree with the results of the Internal Audit Organization’s External Quality Assurance Report. After Quality Assurance Coordinator also reviews the Quality Assurance Coordinator Checklist and resolves any concerns/disagreements, the Quality Assurance Coordinator shall make a recommendation to the Board on whether to accept or disagree with the internal audit organization’s EQA/SAIV External Quality Assurance Report. After the Board decides to accept or disagree with the Quality Assurance Report, the Quality Assurance Coordinator shall prepare, sign and issue SIAAB’s Letter of Acceptance/Disagreement for each internal audit department’s Quality Assurance Report as follows:

• One copy to the chief executive officer of the State of Illinois internal audit organization
• One copy to the Audit Committee Chair (if applicable)
• One copy to the chief internal auditor of the internal audit organization
• One copy to the Quality Assurance Review Team Leader
• One copy to be kept by the Quality Assurance Coordinator until completion of the next external quality assurance review; and
• One copy to the Board’s Freedom of Information Officers (primary and secondary)

Final Disposition of Quality Assurance Documents:

Each State Internal audit organization’s External Quality Assurance Report, Quality Assurance Matrix and supporting documentation are exempt from the Freedom of Information Act [5 ILCS 140/7] as “materials prepared for or compiled with respect to internal audits of public bodies.” As such, these documents shall not be released to anyone outside the SIAAB’s external quality assurance review program which includes the external quality assurance review team members/validator, any Special Assistants, and SIAAB members.

After the SIAAB’s Letter of Acceptance/Disagreement of State Internal Audit Organization’s External Quality Assurance Report has been officially issued pursuant to SIAAB Bylaws Section 3.4.6, the internal audit documents shall be returned by SIAAB to the internal audit organization. Internal audit organizations are responsible for retaining the official SIAAB Letter of Acceptance/Disagreement, the internal audit organization’s External Quality Assurance Report, Quality Assurance Matrix, and supporting workpapers until completion of the next external quality assurance review.

Please close this window to return to Ability LMS to take the quiz for this lesson.