QUALITY ASSURANCE IN THE 21st CENTURY 
- challenges for internal auditing

Achievement of high levels of professionalism in internal auditing practices will always depend on quality assurance being embedded in its practices. (External auditing recognizes this with mandatory quality assurance standards established by its regulators1 and compliance required in all of its practices.) The Institute of Internal Auditors (IIA) in its guidance statements for professional internal auditing has also always recognized this since the mid 70s. Yet, studies across the world too often show a lack of quality assurance programmes and their regulation in internal auditing activities. Regulation both by internal auditors and by those to whom they report. This century will change all of that.

With its new Professional Practices Framework The IIA2 now has a mandatory requirement for Chief Audit Executives to …develop and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity and continuously monitors its effectiveness… The quality programme framework is written into its Standards. The process of monitoring this programme …should include both internal and external assessments. The results of which should be reported to the board.

The IIA also recognises in its Standards the links between quality achievement in internal auditing and quality achievement in the organization it serves - …The (quality assurance) programme should be designed to help the internal auditing activity add value and improve the organisation’s operations…This important guidance builds an essential quality bridge between internal auditing and management. It opens the door to new engagements for internal auditing in the services it provides. But it requires all internal auditors to have a good understanding of quality principles.

Quality principles are not new. They are both national and international. They are used by many organizations to achieve quality for their products and services, as well as quality cultures and awards. They form the framework of many quality charters. The European Union Quality Charter3 was launched by quality representative organisations in Europe as an advantage for Europe in international competition. Its opening statement summarises the aims of quality as an organisational excellence objective, a methodology and a way of promoting people’s active participation based on involvement and responsibility of each individual. Ten significant challenges4 in this new charter for all organisations and internal auditors are:

1. Quality is the key to competitiveness.
2. Quality is an excellence objective.
3. Quality is a way of participation.
4. Quality implies motivation.
5. Quality is based on initiative.
6. Quality is a concern for the customer.
7. Quality is a measure of efficiency.
8. Quality must be a priority.
9. Quality is inseparable from solidarity.
10. Quality chains link all economic and social players.

The IIA with its Commitment to Quality Improvement Award (CQIA) now recognises the strong link between professionalism and quality. This annual award, started in 1999 can be applied for by any internal auditing activity. It requires demonstration of three criteria – Professional Outreach, Quality of Service and Professional Excellence. Points are awarded within these three categories for a variety of activities and achievements, which are based on its Professional Practices Framework and quality principles. Details are available on The IIA website www.theiia.org

In 1996, The IIA5 researched the worldwide implications of ISO 9000 on quality assurance in internal audit departments. Those internal auditing activities registered to ISO 9000 gave as their reasons:

• PROCEDURAL
  - need to update procedures
  - need to improve procedures
  - need to motivate internal auditing staff to comply with procedures
  - need for more uniform procedures
• STRATEGIC
  - requirement by organisation to pursue ISO 9000 
  - requirement by organisation to demonstrate quality in services provided
• ORGANISATIONAL 
  - need to change structure of global/national service
  - need to improve supervision
  - improve team building
• MARKETING 
  - part of programme to market test the internal auditing service in competition with other bids
  - part of a programme to market internal auditing services within the organisation

More recently the International Standards Organisation has revised its standards for quality management. ISO 90006 is a developing series of standards for quality management and assurance. Published first in 1987, the ISO 9000 series of quality standards replaced the British BS 5750. Today, approximately 100 countries have adopted ISO 9000, including the United Kingdom. The new ISO 9000:2000 is a major revision7. There are now just four primary standards:

ISO 9000: 2000 Quality management systems
Fundamentals and vocabulary
ISO 9001:2000 Quality management systems requirements
ISO 9004:2000 Quality management systems
Guidance for performance improvement
ISO 19011 Guidelines on quality and environmental auditing

The revised ISO 9001 and ISO 9004 standards are based on eight quality management principles that "…facilitate a continual improvement of the business, stimulating its overall efficiency in order to increase competitive advantage and to respond better to customers’ needs and expectations." The eight principles are:

• Customer focused organisation
• Leadership
• Involvement of people
• Process approach
• System approach to management
• Continual improvement
• Factual approach to decision-making
• Mutually beneficial supplier relationship

‘Continual improvement’ is now given a much higher profile in the ISO 9000 standard, although it did exist in the previous supporting guidance. The IIA8 in its proposed new professional standards for 2002, will require all internal audit departments ‘…to develop and maintain a quality assurance and improvement programme that covers all aspects of the internal audit activity and continuously monitors its effectiveness. Continual improvement and its associated innovation will be key to the effectiveness of all internal auditing in the future.

The following two case studies show that ISO 9000 is still being used by both large and small internal auditing activities to achieve quality in their practices.

Case Study 1

Alcatel in France designs, develops and builds innovative and competitive communication systems. In 2001 it had annual sales of EURO 25 billion, 99,000 employees and operated in more than 130 countries. It is totally committed to quality in its products and services and communicates this through its vision/mission statements, policies and planning. It has registered its processes to ISO 9000 and complies with the new TL 9000 quality requirements of the Quality Excellence for Suppliers of Telecommunication Leadership Forum. Its website www.alcatel.fr (or www.alcatel.co.uk for the English version) promotes quality in all its products and services.

Responsibility for quality auditing lies with line management and a Group Quality Assurance function. Both the group audit committee and internal auditing receive results from customer satisfaction surveys.

The Group Audit Service at Alcatel currently consists of 63 staff.Its staff have always been committed to quality in the services it provides. All its services are designed to be in compliance with The Institute of Internal Auditors’ (IIA) Professional Practices Framework. This requirement is built into both its quality awards. It has a well-established quality assurance and improvement programme.

In 1999 it was awarded The IIA Commitment to Quality Improvement Award and in 2001 registered its internal auditing processes to ISO 9001:2000. Some internal auditing staff have been trained as quality auditors. Compliance with The IIA Standards is a requirement of this registration. Its quality achievements have had a high impact on the group; its image as well as its consistency of service throughout the world. Promotion of quality in its work is also seen to have strengthened its promotion of effective control in the services it provides.

Responsibilities for quality assurance are built into all job descriptions, training plans and engagement objectives and procedures. Quality records, supervisory reviews, internal assessments and external assessments track control quality in all engagements. Engagement customers are surveyed to measure quality satisfaction.

Case Study 2

Network Housing Association in the United Kingdom delivers affordable housing solutions in London and the Home Counties. It operates through a number of subsidiary companies. In 2001 it had total annual turnover of £56 million, 460 employees and housing assets of £478 million. It is totally committed to delivering the best possible customer services and has achieved quality awards for the training of its staff. From 1995 it has progressively registered some department processes to ISO 9000:1994. Its website www.networkhg.org.uk promotes quality in all its services.

The internal auditing activity at NHA currently consists of 3 staff. It is part of an internal auditing and consultancy function that provides both internal auditing as well as a quality consultancy and auditing service. Its staff have always been committed to quality in the services it provides. All its internal auditing and consultancy services are designed to be in compliance with The Institute of Internal Auditors’ (IIA) Professional Practices Framework. This is required by its regulatory authority and built into a charter, approved by the group audit committee. It has a well-established quality assurance and improvement programme.

In 1999, the internal auditing activity was registered to ISO 9001:1994. This has strengthened all its processes and contributed to the marketing of all its services within the group. Currently the internal auditing activity processes are being improved to comply with the new requirements of ISO:9000:2000. The group has now decided to register all its headquarter processes to ISO 9000:2000.<

Responsibilities for quality assurance are built into all internal auditing job descriptions, training plans and engagement objectives and procedures. Quality records, supervisory reviews, internal assessments and external assessments track quality in all engagements. Engagement customers are surveyed to measure quality satisfaction.

© Jeffrey Ridley: 2002

(Jeffrey Ridley, Visiting Professor of Auditing, South Bank University, London, writes and lectures on quality assurance in internal auditing. In August this year he has arranged a training programme on Quality Assurance in Internal Auditing in London. Details are at www.managementauditschools.com or contact him at e-mail@management-audit.com)

1. Statement of Auditing Standards 240 – Quality Control for Audit Work, effective date 23/12/2000, Auditing Standards Board, UK. See also International Standard on Auditing – 220 with same title.
2. Professional Practices Framework, January 2002, The Institute of Internal Auditors (IIA), USA.
3. European Organisation for Quality (EOQ) Switzerland, website www.eoq.org
4. Ten quality challenges for internal auditors, Jeffrey Ridley, Internal Auditing & Business Risk – September 1999, IIA-UK.
5. International Quality Standards: Implications for Internal Auditing, Ridley/Stephens, 1996, The IIA Inc. USA.
6. BS EN ISO 9000/2000 Quality Systems Standards and Guidelines, 2000, International Standards Organization, Switzerland.
7. The new international standard ISO 9000:2000, David Taylor, December 2000, Business Standards, BSI, UK.
8. New Standards Bring Professional Practices Framework to Life, Internal Auditor, February 2001, The IIA Inc. USA.