Does Not Conform
The lowest conformity rating, indicating that identified deficiencies are so significant as to seriously impair or preclude the internal audit activity from performing adequately in all or significant areas of its responsibilities. Requires immediate and substantial corrective action.
Source: IIA Quality Assessment Manual 2024
Does Not Conform is the lowest of the three conformity ratings used in a quality assessment of an internal audit function, alongside generally conforms and partially conforms. The rating means that the identified deficiencies are so significant that they seriously impair or preclude the function from performing its responsibilities adequately, across all or significant areas. It requires immediate and substantial corrective action.
For the board, the supervisory board, and the audit committee, this rating is a serious signal. The audit committee relies on the internal audit function for independent assurance over governance, risk management, and internal control. When the rating is does not conform, that assurance cannot be considered reliable on essential points. The rating therefore bears directly on the value of the assurance on which oversight is based.
A does not conform rating typically results from an External Quality Assessment (EQA) or an internal review within the Quality Assurance and Improvement Program (QAIP). The assessor evaluates the function against the Global Internal Audit Standards (GIAS) 2024 of the Institute of Internal Auditors (IIA) and weighs whether deficiencies are incidental or structural. A does not conform rating reflects structural gaps: for example, in independence, mandate, audit methodology, or team competencies. The causes are named and translated into an improvement plan with actions, owners, and timelines.
When a does not conform rating arises, ONE Risk Advisory names the underlying causes rather than only the symptoms, whether they lie in governance, methodology, or competencies. We then guide the recovery toward demonstrable conformance, so the function can again fulfil its role as a reliable source of assurance.
Last updated:
Related service External Quality Assessment (EQA)
Frequently asked questions
What does a does not conform rating mean for the reliability of our assurance?
It means the internal audit function does not operate in line with the Global Internal Audit Standards (GIAS) 2024 on essential points. The assurance it provides is therefore not straightforwardly reliable on those points. The audit committee is well advised to discuss the scope of the rating and to have remediation planned.
What is the difference between partially conforms and does not conform?
With partially conforms there are deficiencies, but the audit function still operates largely as intended. With does not conform the gaps are so significant that they seriously impair or preclude the function from fulfilling its responsibilities. The latter requires immediate and substantial corrective action.
How do we move back from does not conform to conformance?
Through an improvement plan (Quality Improvement Plan) that addresses the underlying causes, with actions, owners, and timelines. Progress should be tracked within the Quality Assurance and Improvement Program (QAIP). A follow-up assessment makes the recovery demonstrable.