An External Quality Assessment (EQA) is a review of an internal audit function’s conformance with the Institute of Internal Auditors (IIA) Global Internal Audit Standards (Standards). The revised Standards went into effect on January 9, 2025, and are organized into five domains and cover 15 principals. The Standards provide not only the requirements but also considerations for implementation and examples of conformance. The Standards should be used by the Chief Audit Executive (CAE) and the internal audit function as they:
- Define their purpose (Domain 1).
- Demonstrate ethics and professionalism (Domain 2).
- Govern the internal audit function (Domain 3).
- Manage the internal audit function (Domain 4).
- Execute internal audit services (Domain 5).
Planning for an EQA
Performance of an EQA should be discussed and approved by the board and conducted every five years by a qualified, independent assessor or assessment team. The structure of the assessment can be performed either as a full, external assessment or a self-assessment with independent validation.
- Full External Assessment: An independent assessor performs a comprehensive assessment of the internal audit function conformance with the Standards.
- Self-assessment with independent validation (SAIV). CAE performs a comprehensive internal assessment and documents the function’s conformance with the standards, and an independent assessor validates on a sample basis the validity of the internal assessment to ensure conclusions are complete and accurate.
Discussions should be had to determine what are the goals of the EQA to embed value in the assessment. The CAE and the Board should consider using the EQA as a maturity assessment or understand benchmarking against peers or best practices.
How to Prepare for an EQA
- Review and update existing policies and procedures to align with the new Standards and understand gaps if any related to conformance.
- Perform an internal assessment; often referred to as a quality assurance improvement program (QAIP). For areas of nonconformance determine a reasonable timeline to take action.
- Discuss with the board or Audit Committee the plan and timeline for an EQA and obtain their approval. Also determine if the assessment is a full EQA or a SAIV.
- Engage a qualified independent assessor or assessment team. Ensure at least one member of the team holds the Certified Internal Auditor (CIA) designation. Also ensure there are no conflicts of interest in factor or appearance with the independent assessor or assessment team.
- Collect the documentation to evidence conformance with the Standards.
The Value of an EQA
An EQA can provide credibility within an organization and build confidence in the function’s ability to execute audits and consulting services in a risk-based, independent, and objective manner. During the engagement process, additional value can be derived from discussions with an independent assessor about the EQU’s goals or outcomes, including the potential to benchmark against peers, understand best practices, and how other organizations internal audit functions operate and execute their internal audit function.
To learn more about external quality assessment, and to maximize the value to your organization and the internal audit function, contact your Rehmann advisor or Kristy Clark, CPA, CIA, at [email protected] or 248.952.5000.