According to IIA guidance, which of the following statements is true regarding reporting the results of the quality assurance and improvement program?

According to IIA Standard 1320, "Reporting on the Quality Assurance and Improvement Program," the chief audit executive (CAE) must communicate the results of the QAIP to senior management and the board. The associated Implementation Guidance for this standard specifies that this communication should occur at least annually. The QAIP is composed of both internal and external assessments. Internal assessments, as defined in Standard 1311, must include the ongoing monitoring of the internal audit activity's performance. Therefore, the results of this ongoing monitoring must be reported to senior management and the board at least annually as part of the overall QAIP results.

A. The five-year requirement applies to conducting an external assessment (Standard 1312), not the frequency of reporting the results of internal assessments.
B. The responsibility to communicate the results of all assessments, including external ones, rests with the chief audit executive (CAE), not directly with the external assessor (Standard 1320).
C. Reporting is required for nonconformance that impacts the overall scope or operation of the internal audit activity (Standard 1321), not for every deficiency as soon as it is noted.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards).

Standard 1311 – Internal Assessments: "Internal assessments must include: Ongoing monitoring of the performance of the internal audit activity..."

Standard 1312 – External Assessments: "External assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization."

Standard 1320 – Reporting on the Quality Assurance and Improvement Program: "The chief audit executive must communicate the results of the quality assurance and improvement program to senior management and the board."

Standard 1321 – Use of “Conforms with the International Standards for the Professional Practice of Internal Auditing”: "When nonconformance with the Code of Ethics or the Standards impacts the overall scope or operation of the internal audit activity, the chief audit executive must disclose the nonconformance and the impact to senior management and the board."

2. The Institute of Internal Auditors (IIA). (2017). Implementation Guidance for Standard 1320: Reporting on the Quality Assurance and Improvement Program.

Paragraph 1: "The CAE communicates the results of the QAIP to senior management and the board at least annually. The results include the internal audit activity’s overall level of conformance with the Standards and the Code of Ethics and may include action plans to address any significant areas of nonconformance."