The 5 P’s of QARs: Processes

For this week’s blog, I will be discussing the 4^th P of QAR Success: Processes. Your organization’s process and workflow can determine where your organization is heading. When organizations are heading downward, it’s mainly because of three main oversights: improvement programs, follow-ups, and past QARs.

1. Insufficient Quality Assurance and Improvement Program (QAIP)

While some level of Quality Assurance might be in place, the overall program has not been established. These sublevel quality assurance activities normally transpire in some form of staff supervision and workpaper reviews and signoffs. However, a fully developed Quality Assurance and Improvement Program includes much more than staff monitoring and reviews. After reviews and supervision are completed, it’s important that themes are identified in order to best gauge which education and awareness activities need to be addressed.

Education and training are where the gaps in a fully developed QAIP commonly arise. Often, the Internal Audit Department has developed an initial QAIP, which covers the fieldwork aspects of the internal audit activity, but this only covers the basic properties that a QAIP should have, such as staff supervision and reviews. In order to be a fully developed program, the QAIP needs to be expanded to cover other important areas, such as education and training, operational management, and risk assessment process.

A fully developed QAIP, however, does not stop once the program has been established. It must be implemented into staff’s activity on a regular basis. If you truly want your staff to develop and grow, ensuring that they will be involved in the QAIP throughout their workweek, month, and year is key to their success and also your organization’s success. Establishing a QAIP that isn’t regularly implemented into staff’s regular activity is similar to creating a plan for a long-term goal you personally want to achieve, but not taking the necessary steps every week to ensure this goal is met.

2. No Follow-Up

Internal audit teams do a great job of identifying the risks to an organization, which without these identifications, how would an organization know what they need to address? Addressing these gaps, however, is frequently missing. If no one remedies these issues, then the investment in the QAR process is rendered useless. Often, there hasn’t been any follow-up process to ensure the gaps are fully addressed in a timely manner.

Once risks to your organization have been identified, come up with a plan to fully address these gaps. Plans should include concrete, measurable goals and be broken down into steps to achieve these goals. Ask yourself, “What short-term goals need to be achieved to address the overall long-term goals (addressing the risks)?” Include follow-up meetings throughout the calendar year to ensure your organization is staying on track with short-term goals to address the gaps. Doing so will ensure your organization doesn’t run into the same risks each QAR process and is on the path to growth and improvement.

3. Missing QAR Every 5 Years

The Institute of Internal Auditing (IIA) requires a QAR at least once every 5 years. In most cases, the reviews I’ve conducted are the first one that the Internal Audit Activity team has performed. This means that for the years prior, the organization didn’t conform with the IIA’s standards in performing a QAR every 5 years. There are many reasons for this, but that is a topic for another blog.

Despite the reasons that organizations may fail to complete a QAR every 5 years, it is imperative that QARs are completed every 5 years. If you and your organization are unsure or wary of completing one within your current team’s scope and abilities, this is where seeking out third parties can come in handy. Remember what has been stated in previous blogs: asking for help is a strength and can give you an outside perspective into your organization’s missing links.

Overall, the leadership who take on the QAR requirements and standards deserves a great deal of recognition. These reviews demonstrate compliance, or at least partial compliance, with the IIA’s standards, which is key to ensuring your organization stays afloat. Conducting these reviews also gives stakeholders confidence and comfort that internal audit activity is well managed, effective, and efficient. Ultimately, this ensures the organization’s mission is being met and results are being communicated out in a timely and objective manner.

The 5 P’s of QARs: Processes Infographic Plain Text

Your organization’s process is key to heading in the right direction. There are three common oversights that organizations fail to address in their process:

Insufficient QAIP: Fully developed QAIPs include education and training, operational management, and risk assessment process.

No Follow-Up: Once risks have been identified, create follow-up plans to remedy the major gaps within your organization.

Missing QAR: QARs need to be done every 5 years– many organizations fail to meet this conformance standard with the IIA.

Ensuring your organization’s process is effective will lead to overall success and growth and increase stakeholder confidence.