SIAAB Quality Assurance Review Program

---

This page provides tools covering The Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing (Standards) effective January 1, 2017.

---

The State Internal Audit Advisory Board (SIAAB) is responsible for coordinating external quality assurance reviews (peer reviews) among the State's internal audit organizations in accordance with the Fiscal Control and Internal Auditing Act (FCIAA).  State internal audit organizations designated to have an internal audit function are required to conduct an external quality assurance assessment (EQA) or a self-assessment with independent external validation (SAIV), at least once every five years by an independent reviewer or review team from outside the organization (IIA Attribute Standard 1312). Each Internal Audit Organization and Quality Assurance Review Team is required to follow SIAAB's external quality assurance guidelines as established in SIAAB Bylaws Article III - Quality Assurance Review Program and as presented below.

Requesting SIAAB's Approval of Quality Assurance Review Team

Chief Internal Auditors are required to obtain SIAAB's approval of the quality assurance methodology and review team members prior to beginning any external quality assurance reviews. To initiate the approval process, Chief Internal Auditors are required to submit the following documents to the SIAAB Chair:

• Request to SIAAB for External Quality Assurance Review Team Approval
• SIAAB External Quality Assurance Review Confidentiality Policy/Commitment
• SIAAB External Quality Assurance Review Statement of Independence
• Review Team Member Resume

In addition, each reviewer/external validator team member must successfully complete the SIAAB's On-line Quality Assurance Review Training Program:

• Course Outline
• On-line Course Registration
• Access On-line Course
• Course Evaluation
• On-line Course Participant Listing - Standards Effective January 1, 2017

SIAAB's External Quality Assurance Reviews

• Summary of More Substantive Changes to 2017 IIA Standards
• SIAAB Quality Assurance Review Process
• Quality Assurance Reviews FAQs
• Self-Assessment with Independent Validation (SAIV) Program - To be Completed by the Chief Internal Auditor
• Self-Assessment with Independent Validation (SAIV) Program - To be Completed by the External Assessor
• Full External Quality Assessment (EQA) Program - To be Completed by the Chief Internal Auditor
• Full External Quality Assessment (EQA) Program - To be Completed by the External Assessor
• Example Internal Audit Staff Survey / Questionnaire
• Example Chief Executive Officer and Audit Committee (if applicable) Survey / Questionnaire
• SIAAB Quality Assurance Matrix
• SIAAB External Quality Assurance Report Template
• SIAAB External Quality Assurance Coordinator Review Checklist

Late External Quality Assurance Reviews

According to AS 1312, external assessments must be conducted at least once every five years. This is an unconditional requirement. Therefore, if an internal audit activity is delinquent on their external assessment, it must disclose the nonconformance and corrective action to be taken to senior management and the board. The Chief Internal Auditor shall determine the manner of disclosure appropriate for the agency which may include explanatory paragraphs in audit reports, inclusion in the internal audit annual report, or other as deemed appropriate. The disclosure is required annually until a subsequent review has been conducted by the external validator verifying that appropriate corrective action has been taken and approved by the Board. The phrase "conducted in conformance with the International Standards for the Professional Practice of Internal Auditing" cannot be used when an internal audit function is delinquent on their external assessment (AS 1321 and PS 2430).

When an internal audit function becomes more than one year delinquent on their external assessment, SIAAB may send a letter to their chief executive officer under Bylaw 3.5.2. If your audit function is or will be delinquent on your QAR, we encourage you to notify SIAAB. Below is a sample notification letter:

• Sample late QAR Letter Template