On the Frontlines: Exploring the New Quality Manual
Blogs Hervé Gloaguen, SEP Apr 01, 2025
As an organization grows and its internal processes change and evolve, its quality monitoring process must keep pace. An ongoing commitment to growth and improvement ensures consistent quality in a dynamic and changing business environment. The IIA’s Quality Manual, published last August, is an important reference that can guide CAEs and their teams in their quality assurance efforts.
The Maturity Assessment of an Internal Audit Function
One of the optional components of the manual is its focus on the maturity assessment of an internal audit function. Chapter 10 is designed to help organizations gauge the progression of their audit capabilities from initial to optimizing levels, enabling them to identify areas of improvement and achieve higher stages of excellence.
The manual outlines five maturity levels for internal audit development: the reactive and ad-hoc nature of initial, the partial commitment to the Standards for infrastructure, the independence and focus on quality and performance of integrated, the implementation of data analytics and technology of managed, and the strategic value at a business level for optimizing.
The five levels provided in the manual are comparable to the Ambition Maturity Model levels developed by the IIA Netherlands. This model was crafted in mid-2016, before the 2024 manual, but remains highly relevant. It provides a nuanced and complementary perspective on the stages of maturity an internal audit function can achieve.
The S4 Maturity Model: A Path to Excellence
Many internal audit functions, especially large ones, developed their maturity model in the past. As global CAE of the Allianz Group, with 900 auditors in 40 teams worldwide in insurance, asset management, and banking activities, I developed an internal quality assurance program called S4: Scope, Standards, Skills, and Status. The ambition was to monitor and increase audit performance and quality, achieve consistency across teams, and define a path to excellence.
Standards: Does the audit unit comply with the group auditing standards, as defined by the audit policy (charter), the Standard Audit Manual, and other standards (The IIA’s)?
Scope: Is the unit auditing the right things? Within the methodology defined for the audit plan and audit universe definition, scoping ensures that blind spots regarding risks, controls, and processes are not missed.
Status: What is the unit’s impact? Is the organization listening and acting on observed deficiencies? An internal audit must deliver a proper control culture and responsiveness at the top level of the organization. The impact of the audit activity is assessed, for example, with a management responsiveness scorecard.
Skills: Are the right people and proper set of competencies present in a team to effectively cover the whole scope? Specific gaps are analyzed in finance and IT skills, particularly in smaller audit units.
I expect such internal models to combine nicely with The IIA’s framework.
The required elements of a Quality Assurance and Improvement Program (QAIP) include periodic assessments. The manual provides:
- A detailed model for conducting different types of assessments, ensuring that audit functions conform to professional standards and principles.
- An overview of various quality assessment types: internal, external, self-assessment with validation, gap, and maturity.
- A planning process for quality assessments, covering team selection, data requests, and stakeholder communication.
- Guidance for evaluating conformance with the standards and principles in the Global Internal Audit Standards, Domains I through V.
- Domain-specific fieldwork templates for implementing the recommended approach in respective chapters.
- Guidance for interpreting and applying models to measure the internal audit function's maturity.
- Templates and tools for planning, conducting, and reporting on the Quality Assurance and Improvement Program.
You Secure Your Future
The Quality Assessment Manual is a significant resource for internal audit functions aiming to refine their practices and align with the Standards. The "how" is somewhat formalistic but essential: Audit is a strict discipline with clear rules. Conformance with these rules is a necessary condition for the quality of our work.
The manual's high-level approach to the maturity assessment allows organizations to work on continuous improvement. These levels outline a pathway for internal audit functions to evolve and to better support their organizations in achieving strategic objectives and sustaining long-term success. By doing so, they ensure their relevance and secure their future in their organization.