AUDIT COMMITTEE POLICY STATEMENT ON

INTERNAL QUALITY CONTROL SYSTEMS AND

EXTERNAL PEER REVIEW PROGRAMS

I.  PURPOSE

> The purpose of this statement is to provide policy guidance to the
> members of the President's Council on Integrity and Efficiency (PCIE)
> and the Executive Council on Integrity and Efficiency (ECIE) on the
> implementation of the General Standard on Quality Control and
> Assurance of the generally accepted government auditing standards
> (GAGAS).

II. BACKGROUND

> Previously, GAGAS required government audit organizations to have an
> appropriate internal quality control system and to undergo periodic
> external peer reviews. The 2003 edition of GAGAS clarified policies on
> the type of information that should be reviewed, the qualifications of
> review staffs, the distribution of external peer review reports, and
> the granting of extensions of timeframes for the performance of
> external peer reviews.
>
> The PCIE published Quality Standards for Federal Offices of Inspector
> General (OIG). These standards, last updated in October 2003, cover
> the entire OIG organization and are considered advisory in nature.
>
> The PCIE's Policy Statement on Quality Control Reviews was issued on
> August 8, 1989, and then subsequently revised through March 2004. The
> policy statement provides guidance on internal quality control
> systems, internal review programs, and general guidance on the PCIE
> external peer review process.
>
> This policy statement supercedes the PCIE's March 2004 Policy
> Statement on Quality Control Systems and External Peer Reviews.

III. INTERNAL QUALITY CONTROL SYSTEM

> Each Office of Inspector General (OIG) organization is required to
> implement and maintain an internal quality control system for its
> audit work and attestation engagements. The internal quality control
> system typically consists of four characteristics, as follows:

-   policies and procedures that establish internal guidance and audit
    requirements,

-   supervisory review processes,

-   a quality control process for each audit (such as independent
    referencing), and

-   a quality assurance program (see Addendum 1).

> Each audit organization should prepare appropriate documentation for
> its system of quality control. The organization\'s internal quality
> control policies and procedures should provide for monitoring, on an
> ongoing basis, whether the policies and procedures related to the
> Standards are suitably designed and effectively applied.

IV. EXTERNAL PEER REVIEW PROGRAM

> The objective of the external peer review is to determine whether the
> reviewed audit organization's internal quality control system was
> adequate and complied with to provide reasonable assurance that
> applicable auditing standards, policies, and procedures were met.
>
> An audit organization, therefore, should retain relevant and
> sufficient documentation to enable an external peer review team to
> evaluate the reviewed OIG's compliance with its internal quality
> control system.
>
> Formal entrance and exit conferences should be held to ensure all
> parties understand the ground rules of the engagement, facilitate the
> conduct of the review, and communicate the review results.
>
> The 1988 amendments to the Inspector General Act of 1978 require that
> external peer reviews be performed exclusively by an audit entity of
> the Federal Government, including the Government Accountability Office
> or an OIG. Assignments for conducting peer reviews are made by the
> PCIE and ECIE.
>
> GAGAS requires external peer reviews at least once every 3 years. The
> external peer review team should issue its report within the 3-year
> period unless an extension, if it exceeds 3 months after the end of
> the 3-year period, is granted by the Government Accountability Office.
> The scope of the external review typically consists of the period of
> time covered by the two most recent semiannual reports to Congress,
> but may be expanded as deemed necessary by the review team. The scope
> may include other areas with mutual agreement between the OIG being
> reviewed and the external review team.
>
> In the conduct of an external peer review, reviewers should be
> independent of the OIG reviewed, its staff, and the auditees whose
> audits are selected for review. Employees separated from the reviewed
> agency within the past 3 years should not participate in the external
> peer review of their former agency. An audit organization is not
> permitted to review the organization that conducted its most recent
> external peer review. Further, the reviewing OIG generally should not
> conduct consecutive peer reviews of the same entity. In addition, an
> audit organization should not review another audit organization if its
> investigation unit was reviewed by the other's investigation unit
> within the past three years.
>
> The "External Peer Review Guide" (Addendum 2) provides guidance and
> procedures to ensure that external peer reviews are conducted in an
> appropriate and consistent manner. The external peer review will
> culminate in a written report, to include any expanded scope areas.
> Significant areas of disagreement requiring technical
> clarification/interpretation of GAGAS may be forwarded to the Audit
> Committee for comment prior to the issuance of the external peer
> review report.
>
> Regarding review report distribution, the reviewed OIG should provide
> copies of the final review report to the head of the agency, Chair and
> Vice Chair of the PCIE, and Chair of the PCIE Audit Committee. In
> addition, the ECIE organizations should provide a copy of the report
> to the Vice Chair of the ECIE. Upon request, the final review report
> should be available to the public. OIGs have the option to post the
> final report on their website. The review team should provide a copy
> of the final review report and supporting documentation to subsequent
> external review groups and, upon request, to the Government
> Accountability Office.
>
> Only an OIG that receives an unmodified opinion on its most recent
> peer review will be allowed to perform external peer reviews of other
> OIGs. OIGs receiving other than an unmodified opinion on external peer
> reviews may request an off-cycle peer review to demonstrate that
> corrective action has been taken. Further, if an audit organization
> under review receives notification at the official draft stage of the
> external peer review process that it will receive less than an
> unmodified opinion, and the reviewed agency is simultaneously
> performing a peer review of another audit organization, it should
> notify the PCIE Audit Committee. Reassignment will be made as
> appropriate.
>
> John Higgins, Chair
>
> Audit Committee