Quality and internal audit
How can internal audit deliver a quality service? How is quality defined, expressed and measured?
Like other professions, internal audit should strive to deliver the best service it can. How do we do this?
The head of internal audit should identify the objectives of internal audit, then establish processes and systems to achieve them and to report the results. The definition of internal auditing is a good place to start as it sets out the fundamental purpose, nature and scope to aim at while the Code of Ethics explains how we should behave.
But it is also important to match this up with customers and stakeholders' expectations. The International Standards are principle-based so organisations can tailor internal audit to their circumstances, particularly in relation to legal and regulatory requirements. This means internal auditors need to understand what's best for their organisation.
In effect, by following the guidance in the International Professional Practice Framework (IPPF) and listening to their stakeholders, internal auditors can lay the foundations for delivering a high- quality service. Our guidance document Quality Assurance and Improvement Programme provides more detail on how to approach quality and quality assurance.
The International Standards also set out what internal audit can do to perform quality assurance and how to establish a programme to support day-to-day delivery of a reliable assurance and consulting service. Read our guide Quality and the International Standards.
There is also a self-assessment checklist to help internal audit perform internal assessments, which can be validated externally.
For more information about what the institute can do to help improve your service visit our Quality assessment services page.
The meaning of 'quality' depends on the context, particularly when applied to organisations. In manufacturing and production, quality is often defined in relation to defects or non-compliance against standards. For service organisations, quality is more likely to mean service excellence and customer care, which is measured in terms of meeting customer expectations and customer satisfaction.
Harvey and Green (1993) explored the nature and usage of 'quality' in relation to higher education and identified five categories summarised in our diagram:
All five of these categories may apply to providing an internal audit service, although some may be assigned more importance than others.
Because 'quality' can be interpreted differently, the ways in which it is managed vary too. Emphasis can be on 'product', 'process' and 'people' quality management or a combination of all three.
The Chartered Quality Institute (CQI) believes that all forms of quality management can "not only create value for an organisation and its stakeholders but also manage its exposure to risk and can make the difference between success and failure".
According to the CQI, the 'fundamental principles of quality' are:
- Leadership - provide vision and direction to achieve results
- Fact based decision making - make decisions using accurate data and facts
- People - deliver value through the development of individuals
- Suppliers and partners - maintain mutually beneficial relationships
- Systems thinking - manage processes through an integrated approach
- Business process management - increase efficiency
- Customer focus - anticipate future needs
- Continual improvement - make performance improvement a perpetual objective
Quality doesn't just 'happen'. The management of quality is a discipline that seeks to ensure organisations are as successful as possible. This requires a framework, or quality management system (QMS) that contains policies, objectives, structures, resources and procedures. It translates good intentions into working practice and results.
A selection of quality standards
International Standards Organisation (ISO) 9000 series
This provides a framework to manage key processes, ensuring consistency and minimising defects. Organisations or parts of organisations can be certified against this standard when they meet its requirements, which may help to win or retain business. Some internal audit functions have attained ISO 9000 accreditation to demonstrate 'quality' to their stakeholders and in some cases ISO 9000 is regarded as a prerequisite for tender submissions. The BSI website has more detail on ISO 9000.
European Foundation for Quality Management
The EFQM's excellence model is used to identify current strengths and areas for improvement against strategic goals. It contains nine criteria to help organisations conduct a self-assessment exercise, identify gaps and prioritise improvements. The EFQM organisation is the custodian of the model and its website provides more detail of how the process works.
UK Commission for Employment and Skills
This organisation is responsible for Investors in People (IiP) a tool designed to help all kinds of organisations develop performance through their people. It provides assessments to support organisations in planning, implementing and evaluating effective strategies.
The UK government has developed a Customer Service Excellence standard for service organisations who want to drive customer-focused change. It helps test priorities such as delivery, timeliness, information, professionalism and staff attitude.
For more details on quality standards and to read related case studies, visit the businessballs website.
The terms 'quality assurance' and 'quality control' are often used interchangeably to refer to ways of ensuring the quality of a service or product. However, the terms have different meanings.
Quality assurance is about the prevention of defects. It involves planned and systematic activities within the QMS designed to build an awareness of quality.
Quality control is about the detection of defects. It is most commonly associated with testing that takes place within the QMS. In practice, quality control forms part of quality assurance.