Internal and Forensic Audit · Practices related to Internal Auditing

Quality Assurance and Internal Audit Function Management

Updated 11 October 2026 · Fact-checked

Managing the internal audit function means setting it up and running it so that it is independent, competent and reliable. You do this through a charter, proper reporting lines, qualified staff, controlled outsourcing and a quality assurance and improvement programme (QAIP) that checks the function through internal and external reviews.

Understand Quality Assurance and Internal Audit Function Management

An internal audit function is only useful if the board and management can trust its work. That trust comes from how the function is managed, not only from the audits it performs. This topic covers the management side: authority, independence, people, outsourcing and quality checks.

The starting point is the internal audit charter. It is a formal document approved by the board or audit committee. It sets out the purpose, authority, responsibility and scope of the function, and its reporting lines. Without a charter, the internal auditor has no clear mandate to ask for records, access premises or report findings.

Independence means the function is free from influence that could affect its judgement. Objectivity is the mental attitude of being unbiased. Independence is secured by reporting functionally to the audit committee or board, and administratively to a senior executive. The auditor should not audit areas they designed or operated, and should not hold operational duties. Where independence is impaired, it must be disclosed to the appropriate party.

Competence means the function has the right skills, knowledge and experience, and keeps them current through training. Outsourcing or co-sourcing lets a company use an outside firm, for example a chartered accountant firm, for all or part of the work. Outsourcing brings specialist skills and flexibility but reduces control and can create confidentiality risk. The board still remains responsible for the function, whoever performs the work.

A quality assurance and improvement programme (QAIP) covers the whole function. It has ongoing monitoring (supervision, checklists, feedback), periodic internal self-assessments, and external assessments done by a qualified independent reviewer. Results are reported to the board or audit committee, with an action plan for gaps. The aim is to confirm that the function follows its standards and to improve it continuously.

Key rules to remember

Charter contents: Purpose + Authority + Responsibility + Scope + Reporting lines + Access rights + Standards followed; Approved by the board or audit committee. Review it periodically and update when needed.
Dual reporting line: Functional reporting → Audit Committee / Board; Administrative reporting → senior management; Functional line protects independence. Administrative line covers day-to-day matters such as budget and leave.
QAIP components: Ongoing monitoring + Periodic internal assessment + External assessment; Results go to the board or audit committee. External assessment is done by a qualified, independent reviewer.
Outsourcing principle: Work may be outsourced; accountability stays with the entity; Board and audit committee remain responsible for the function and its quality.

How to solve Quality Assurance and Internal Audit Function Management questions

Questions on this topic ask you to explain, list, advise or evaluate. Use the same frame each time so that you cover the points examiners look for.

1Read the question and mark the keyword: charter, independence, outsourcing, competence or QAIP.
2Define the term in one or two lines in your own words.
3State the purpose: why the board and stakeholders need it.
4List the main points in short numbered headings, each with one line of explanation.
5If the question gives a scenario, apply it: name the threat or gap in the facts, such as the auditor reporting to the CFO.
6Give a balanced view where asked, with advantages and disadvantages, or strengths and weaknesses.
7Close with a conclusion or recommendation: who approves, who is accountable, what the audit committee should do.

Quickest way: Define, list, apply, conclude

When to use it: Use it when you have about 8 to 10 minutes for a 10-mark answer and need to be complete without padding.

Write a two-line definition.
Write four to six headed points with one line each.
Add one line linking the points to the facts in the question.
End with one line stating who is accountable, usually the board or audit committee.
For QAIP questions, always name the three parts: ongoing monitoring, internal assessment, external assessment.

Common mistakes in Quality Assurance and Internal Audit Function Management

Saying outsourcing transfers responsibility to the outside firm.
Students think paying a firm to do the work also passes the accountability to it.
Fix: State clearly that the board and audit committee remain accountable for the function and its output.
Confusing independence with objectivity.
Both words are used together and seem alike.
Fix: Independence is organisational status, such as reporting lines. Objectivity is the auditor's unbiased mental attitude.
Treating the QAIP as only an external review.
Students remember the external assessment and forget the rest.
Fix: Always list all three parts: ongoing monitoring, periodic internal assessment and external assessment.
Listing charter contents without stating who approves it.
Students focus on contents and skip governance.
Fix: Add that the board or audit committee approves the charter and reviews it periodically.
Giving only advantages of outsourcing.
Answers are written from memory of the benefits.
Fix: Present both sides: specialist skills, flexibility and cost against reduced control, confidentiality risk and weaker knowledge of the business.
Recommending that the internal auditor report to the CFO for all purposes.
Students mix administrative convenience with the independence requirement.
Fix: Recommend functional reporting to the audit committee or board. The CFO line can be at most administrative.

Worked examples

Example 1

The internal auditor of Sundaram Textiles Ltd reports only to the Chief Financial Officer and also approves vendor payments. Identify the independence issues and advise the audit committee.

Show the solution

Reporting line: reporting only to the CFO means the auditor depends on the person whose area may be audited. This weakens independence.
Operational role: approving vendor payments is an operational duty. The auditor would later audit decisions they made, which is a self-review threat to objectivity.
Advice on reporting: set a functional reporting line to the audit committee, covering the charter, plan, budget approval, appointment and removal of the head of internal audit, and the receipt of reports. Keep only administrative reporting to a senior executive.
Advice on duties: remove the payment approval role from the internal auditor and assign it to the finance team.
Charter: record these arrangements in the internal audit charter approved by the board or audit committee.

Answer: The auditor lacks independence because of the sole reporting line to the CFO and the operational duty of approving payments. The company should create functional reporting to the audit committee, remove operational duties, and record this in the charter.

Example 2

Explain the quality assurance and improvement programme of an internal audit function and state the advantages and disadvantages of outsourcing internal audit.

Show the solution

Define the QAIP: a programme that evaluates whether the whole internal audit function follows its standards and charter, and identifies opportunities to improve.
Ongoing monitoring: supervision of engagements, review of working papers, checklists, and feedback from the auditee.
Periodic internal assessment: self-assessments or reviews by other people in the organisation who know internal audit practice.
External assessment: a review by a qualified, independent assessor from outside the organisation, done periodically.
Reporting: results and action plans go to the board or audit committee.
Advantages of outsourcing: access to specialist skills, such as IT or forensic expertise; flexibility during peaks; independence from internal politics; no need to keep a full team.
Disadvantages of outsourcing: less control and knowledge of the business; confidentiality risk; possible dependence on the provider; cost for long engagements.
Conclude that accountability stays with the board even where work is outsourced.

Answer: The QAIP has three parts: ongoing monitoring, periodic internal assessment and external assessment, reported to the board or audit committee. Outsourcing gives skills and flexibility but reduces control and creates confidentiality risk, and accountability remains with the entity.

Exam tips

Write the full QAIP trio, ongoing monitoring, internal assessment and external assessment, every time. It is the most reliable scoring point.
In case-based questions, spot the independence threat in the facts first, for example a reporting line or an operational duty, then give the remedy.
For outsourcing questions, always give both advantages and disadvantages and end with the accountability point.
Use short numbered headings for charter contents. Examiners reward clear structure over long prose.
Link answers to the audit committee as the body that approves the charter, reviews the plan and receives QAIP results.

Practice questions from Practices related to Internal Auditing

Quality Assurance and Internal Audit Function Management in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Quality Assurance and Internal Audit Function Management: frequently asked questions

What is the purpose of an internal audit charter?

The charter formally defines the purpose, authority, responsibility and scope of the internal audit function. It is approved by the board or audit committee. It gives the auditor the mandate to access records and report findings.

How can the independence of an internal auditor be ensured?

Give the function a functional reporting line to the audit committee or board, and keep administrative reporting to senior management. Avoid operational duties and do not let the auditor audit areas they have run. Disclose any impairment to the appropriate authority.

What are the parts of a quality assurance and improvement programme?

A QAIP has ongoing monitoring, periodic internal assessments and external assessments. Together they check conformance with standards and drive improvement. Results are reported to the board or audit committee.

Does outsourcing internal audit remove the company's responsibility?

No. The company can outsource the work, but the board and audit committee stay accountable for the function. They should define the scope in a contract and review the quality of the provider's work.