EY QA — Internal Audit Quality Assurance

EY QA

Quality that Assures Confidence

Client

Engagement

Documents

Checklist

QA Analysis

Final Report

Existing Client

Select from client list

Choose a client you've worked with before

New Client

Add a brand new client to the system

Select Client *

0 files uploaded | Supports PDF, DOCX, XLSX, CSV | Multiple files allowed per document type

S.No	Document Name	Uploaded Files — click Upload next to each document type

0 analysed | 0 exceptions | 0 pass | 0 skipped

CP #	Phase	Activity	Checkpoint	Run QA

GatiQA · AI Quality Engine

Running QA Review…

Initialising…

Press Esc or click × to cancel

GatiQA · Internal Audit QA Platform

QA Status Classification Guide

How GatiQA decides Exception vs Manual Review vs Conforms — and what each status means for your QA review.

The Core Principle

GatiQA can only raise an Exception when it has (1) the document uploaded AND (2) the document fails an objective, measurable test. If either condition is not met, the result is Manual Review. This mirrors IIA Standard 2330 — a finding cannot be raised without documented evidence.

⚠

Exception

Automated deficiency detected — action required

Definition: GatiQA uploaded the document, analysed its content, and the evidence objectively fails a measurable IIA/QA standard.

What triggers it

Duplicate rows detected in RCM
APM scope exclusion has no rationale
Prior year finding not in current APM
Control description under 100 chars / <4/6 5W1H
Report missing completion dates for findings
TOD steps copy-pasted across controls
Walkthrough MoM missing attendees / date

What to do

Read the Finding and Recommendation columns
Open the annotated source document (click the row)
Remediate the identified deficiency
Upload the corrected document
Re-run QA cycle to verify it passes

⚠ All Exceptions must be remediated or formally accepted (with documented rationale) before the QA review can be closed.

⤴

Manual Review

QA reviewer action needed — two distinct reasons

Definition: GatiQA cannot auto-conclude this checkpoint. This happens for exactly two reasons — shown below. It is not the same as an Exception.

Reason A — Document Not Uploaded

The required evidence document was not uploaded to this engagement. GatiQA cannot analyse what it cannot see. This is not a finding — it is a data gap.

What to do: Upload the missing document (see the Source Doc column), then click ⟳ Re-run QA.

Identified by: "not uploaded" in the Finding text

Reason B — Professional Judgement Required

The check requires a QA reviewer to read the content and apply professional judgement. GatiQA has analysed what it can but cannot make a binary Pass/Fail without human assessment.

What to do: Review the evidence, make your own assessment, and document your conclusion in the remarks field.

Examples: CP09 (risk taxonomy), CP18 (PII in screenshots), CP28 (MAP–root cause coherence)

⤴ Manual Review items must all be cleared (either passed or escalated to Exception) before the engagement QA score is finalised.

✓

Pass

Standard met — no action required

Definition: GatiQA analysed the uploaded document and the evidence objectively meets the required IIA/QA standard for this checkpoint. The reviewer may still open the evidence to read it, but no corrective action is needed.

Examples: APM has all 6 required sections · RCM has no duplicate rows and all descriptions pass 5W1H · Audit report has root cause per finding · Sample sizes match Sampling Matrix

IIA Standards Basis

IIA Standard 2200

Engagement Planning

Basis for CP01–CP04 checks. Requires documented objectives, scope, timing, and risk assessment before fieldwork.

IIA Standard 2330

Documenting Information

Auditors must document sufficient, reliable, relevant evidence. Undocumented = Manual Review. Documented but deficient = Exception.

IIA Standard 2410

Criteria for Communicating

Basis for CP23–CP29. Reports must include objectives, scope, conclusions, recommendations, and management responses.

📌 Summary for Management

Exception = GatiQA found the document and the document fails an objective, measurable IIA standard. These are confirmed deficiencies.
Manual Review = Either the required document is missing (upload it and re-run), or the check requires a human reviewer's professional judgement to conclude.
Pass = GatiQA confirmed the evidence meets the standard. Reviewer may validate but no action is required.

The QA Score excludes Manual Review items from the denominator — it reflects only what has been conclusively assessed. Once all Manual Reviews are cleared, the score updates to reflect the full engagement.

Evidence Viewer

Document

—

Ask Me

Online · QA Specialist

Send

Sign In

QA Status Classification Guide