Quality Assurance Review: An essential engagement for your credit union

I began my career as an Internal Auditor directly out of college and was excited to make a difference at my credit union. I strived to find ways to help internal audit add value to the credit union. Over the course of countless audits, I truly felt like I was making a difference by providing expert level suggestions to the issues I uncovered. But there was always this little thought in the back of my head saying, “Could I do even better?”

This question swirled in my head for quite some time and I didn’t know how to respond. Then I discovered that the Institute of Internal Auditors (IIA) offered a Certified Internal Auditor (CIA) designation that I could obtain if I studied for and passed an exam. I was all in! I was ready to learn more about internal auditing in an effort to help my credit union. While I was studying for the exam, I came across an IPPF Standard 1312. It says “External Assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization.”

I asked my boss if we had ever had an external assessment. He said, “no” and that an external assessment, (a Quality Assurance Review) had been on our audit plan for several years, but it always got pushed aside for budgetary or time constraints. He also didn’t think it would be extremely useful because, “we were doing a great job.” Unfortunately, many auditors and their bosses and coworkers don’t understand the importance of this critical engagement besides it being required by auditing Standards. 

How times have changed. Now, I serve as the Quality Assurance Review (QAR) specialist at The Audit Library and have the joy of helping internal auditors and their credit unions every day! Let’s examine some of the benefits of this essential engagement.

Walk a Mile in Someone Else’s Shoes

I rarely suggest action from clients just, “because it is required.” I think it is crucial to understand the reasons behind why requirements are a good idea to follow. To help internal auditors understand why a Quality Assurance Review is essential, I try to get them to think about it from the perspective of their auditees. 

When I was a full time auditor, my auditees would often ask, “Who audits internal audit?” The question was humorous banter, but also very valid. I never had a good answer. The NCUA looks at internal audit somewhat, but it is not anything near the level of scrutiny internal audit would put other departments through. However, a Quality Assurance Review is an engagement I like to call “Audit the Auditor.” An external firm will review the internal audit function thoroughly, from department setup and governance through the latest report filed. The exact type of scrutiny internal auditors put their auditees through! 

Not only does this help internal auditors realize what it is like to be audited, it also helps strengthen the respect and the relationship between auditor and auditee. When management and other employees know that the internal auditor is held to the same high standards as the rest of the credit union staff, they gain a lot of respect for the internal audit team. This helps audits run smoother, and gives the auditor some compassion when their auditees haven’t dotted every “i” or crossed each “t”. 

Becoming More Efficient & Effective

When you hire an exceptional firm to perform your QAR, much like internal auditors when they audit various departments, the firm is looking for ways to improve the audit department. We typically look to ask and answer several key questions: Is audit wasting time on any projects? Could audits be structured differently to maximize efficiencies? Are resources being used well? Are the auditors asking deep enough questions? Does the department have the support they need to complete their duties? 

Once we answer these questions by following a detailed work program, we are able to provide suggestions for improvement. In a recent QAR I performed, upon review of the audit plan, it appeared that the department was completing too many audits for the number of staff members in the audit department. This indicated that the audits weren’t detailed enough to be meaningful. Upon examination of the audit workpapers for several audits, I found that my hypothesis was correct. So, I was able to suggest a solution that allowed internal audit to cover the risks they needed to analyze in each audit. 

When I checked back in with this client several months later, and I was happy when they reported back that they were able to complete audits at the appropriate level of depth because of our suggestions! The Supervisory Committee was also glad that the audit team was digging deeper into some of the high-risk areas at the credit union. They were able to understand the tradeoff of quantity for quality, and it was a win-win.

Looking Beyond Internal Audit

Beyond the internal audit department, it is important to examine how the entire credit union will benefit from a QAR. In each QAR we perform, we talk to members of senior management, the Supervisory Committee, and some other staff members. These interviews not only give us a “pulse check” on how the internal audit department is doing, they also provides us with the opportunity to teach these “outsiders” about the importance of internal audit and provide an expert’s independent perspective. 

Additionally, we speak to these staff members under the cloak of anonymity, so we do not reveal who has said what about the internal audit team or individual staff. If we discover an issue, we find a tactful way to recommend improvement. Sometimes that could be investing in some training or trying a different approach for the internal audit team.  Regardless, better communication and understanding are the outcome!

A QAR also helps the reputation of the credit union in the eyes of regulators. Recently we have heard that regulators, such as NCUA, have been asking if internal audit departments have had a QAR. If they have, the regulators can review the final report and have confidence that the internal department is doing a thorough job and that the credit union and the Supervisory Committee cares enough about the integrity of internal audit to allow them to budget for an external review. 

We have also seen board members, executives, and external auditors express their gratitude at the conclusion of a QAR. It can help leaders at all levels sleep a little better at night.

Conclusion

Regardless of the reasoning, a QAR is an essential engagement for every credit union to have and can reap benefits for many years to come.