Quality Deficiency
An identified deviation from the IIA Standards or professional best practices in audit engagement execution, governance, or management of the internal audit function. Deficiencies can range from minor findings to significant risks to audit independence or effectiveness.
Source: IIA Quality Assessment Manual 2024
A Quality Deficiency is an identified deviation from the Global Internal Audit Standards (GIAS) 2024 or from professional best practices in audit engagement execution, governance, or management of the internal audit function. Deficiencies range from minor findings to significant risks to the independence or effectiveness of the audit function. At its core, a quality deficiency is the gap between what the function does and what the Standards require of it.
For the board, the supervisory board, and the audit committee, quality deficiencies matter because they carry through to the reliability of the assurance. Oversight bodies base decisions on the work of the internal audit function; if deficiencies go unnamed, risks may be over or underestimated. Timely insight into deficiencies allows the audit committee to intervene before the quality of the function comes under structural pressure.
Quality deficiencies are identified within the Quality Assurance and Improvement Program (QAIP), through ongoing monitoring, periodic internal assessments, or an External Quality Assessment (EQA). The assessor weighs the nature and impact of each deficiency: a minor procedural point calls for a different response than a deficiency that affects independence. Findings are classified and, in aggregate, translated into a conformity rating (generally conforms, partially conforms, or does not conform) and an improvement plan with actions, owners, and timelines.
ONE Risk Advisory maps quality deficiencies in a structured way, distinguishing the incidental finding from the structural gap. We then prioritise remediation, so the function resolves its deficiencies before they undermine the reliability of the assurance.
Last updated:
Related service Quality Improvement
Frequently asked questions
Is every quality deficiency equally serious?
No. Deficiencies range from minor findings to significant risks to the independence or effectiveness of the audit function. The assessor weighs nature and impact, since a procedural point calls for a different response than a deficiency affecting independence.
How are quality deficiencies identified?
Within the Quality Assurance and Improvement Program (QAIP): through ongoing monitoring, periodic internal assessments, or an External Quality Assessment (EQA). Findings are classified and, in aggregate, translated into a conformity rating.
What happens with an identified deficiency?
The deficiency is named and recorded in an improvement plan (Quality Improvement Plan) with actions, owners, and timelines. Timely remediation prevents the deficiency from carrying through to the reliability of the assurance.