How to Have a Successful Internal Audit External Quality Assessment

Both the current International Standards for the Professional Practice of Internal Auditing and the new Global Internal Audit Standards require every internal audit function to have an External Quality Assessment (EQA) performed at least once every five years. EQA is a process used to evaluate the effectiveness and quality of an internal audit function within an organization. Its primary purpose is to assess whether the internal audit activity adheres to professional standards and practices established by the Institute of Internal Auditors (The IIA) and assure stakeholders that the internal audit activity performs its duties effectively and efficiently.

A successful EQA allows an organization to state that the internal audit activities conform to the IIA Professional Standards in the Internal Audit Charter and audit reports. In addition, it builds stakeholder confidence by documenting the internal audit function’s commitment to quality and best practices. It provides evidence to the board, audit committee, senior management, and staff that the internal audit function is concerned about the organization’s internal controls, governance, and risk management processes.

EQA does not have to be a daunting endeavor if it is done right. Here are some steps and considerations an internal audit activity can take to have a successful and smooth EQA.

Choose the Right Approach

There are two recommended approaches for EQAs.

1. An Independent External Assessment: This involves an outside independent team that is led by a qualified assessor. In this approach, most of the work is completed by the independent assessor and the resources required from the internal audit activity are minimal.
2. Self-assessment with Independent Validation: An independent and objective external assessor validates the internal self-assessment completed by the internal audit activity. In this approach, most of the work is completed by the internal audit activity, so the available resources are required.

Clarify the EQA Scope and Process

1. Understand the scope of the EQA and the assessment process.
2. Ensure that credit and acknowledgment are received for known issues and ongoing improvement plans.
3. Clarify expectations and avoid distractions from the main purpose.

Engage with Stakeholders

1. Involve senior management, the audit committee, and other relevant stakeholders.
2. Demonstrate commitment to quality and best practices.
3. Use the EQA process to engage, motivate, and develop the audit team.

Alignment with Strategies and Objectives of the Organization

1. Align the internal audit work with the organization’s strategies, objectives, and risks.
2. Be insightful, forward-looking, and proactive in the approach.
3. Coordinate with other assurance providers and consider relying on their work.

Develop Training Plans

1. Identify training needs based on the EQA findings.
2. Create training plans to address any gaps or skill requirements.
3. Continuous learning and development contribute to a high-performing IA team.

Develop & Maintain a Quality Assurance & Improvement Program (QAIP)

1. Develop and maintain a Quality Assurance & Improvement Program (QAIP) that covers all aspects of the internal audit activity, including conformance with the Standards and adherence to the IIA’s Code of Ethics.
2. The QAIP should include ongoing and periodic internal assessments, as well as external assessments by a qualified independent assessor or assessment team from outside the organization.

Provide a Report to the Stakeholders

1. Share the EQA results and improvement plan with the audit committee and other stakeholders.
2. Transparency and accountability are essential for building stakeholder confidence.

A well-prepared Internal Audit Function results in an EQA that meets compliance requirements and contributes to the organization’s overall effectiveness and risk management.

For more information about our internal audit experience, be sure to visit our Internal Audit Services page, and don’t hesitate to contact Victor Kong if you would like more information or have further questions.

About the Author