EQA Companies in the UK: External Quality Assessment Providers
AC
Acumon Chartered Accountants·14 min read
Every internal audit function must be assessed by a qualified, independent assessor at least once every five years. The requirement is Standard 8.4 of the Global Internal Audit Standards, which took effect in January 2025, and it carries one condition that rules out shortlists before anything else is discussed: at least one person on the assessment team must hold an active Certified Internal Auditor designation.
Choosing an external quality assessment provider is not simply about meeting a professional requirement. A well-run EQA can give an organisation a clearer, independent view of how its internal audit function performs, where its approach is working and where there is room to improve.
Across the UK, EQA services are delivered by large professional services firms, specialist internal audit consultancies and independent assessment providers. Their experience, assessment methods and sector knowledge can vary considerably, so the right choice will depend on the organisation and the scope of the review.
This guide brings together a selection of companies providing EQA services in the UK. It is not a ranking. The aim is to explain who the providers are, the types of organisations they support and the main areas covered by their external quality assessment work.
Providers fall into three broad groups, and the trade-offs differ.
Type of provider
Typically suits
Worth checking
Large professional services firms
Complex groups, regulated entities and organisations wanting broad benchmarking
Independence if they audit you or want the outsourcing; whether the named partner does the work
Specialist internal audit consultancies
Functions wanting assessment as core work rather than a sideline, usually senior-led throughout
Size of the comparison base; sector fit
Independent assessors and small practices
Smaller functions, and organisations prioritising cost and senior involvement
Single point of failure; no peer review behind the opinion
Whichever group you approach, the two filters that matter most are the same. Is the provider independent of your function, and does the team include an active Certified Internal Auditor? Our guide to choosing an EQA provider sets out the selection process, and who can perform an EQA covers the conflicts that disqualify a firm.
Acumon
Acumon is a UK firm of chartered accountants and registered auditors providing External Quality Assessment services to internal audit functions, companies, charities, regulated organisations, and international corporate groups.
The firm works with organisations ranging from growing owner-managed businesses and charities through to larger corporate groups and regulated entities. EQA engagements provide an independent review of internal audit quality, effectiveness, methodology, governance, reporting, and alignment with recognised professional standards.
Acumon holds a Public Interest Entity (PIE) audit licence, allowing the firm to work with listed companies and other entities subject to enhanced regulatory oversight in the United Kingdom. This regulatory background supports EQA work for organisations operating within demanding governance, assurance, and compliance environments.
In addition to its UK audit registration, Acumon holds audit licences in several international financial centres, including the Cayman Islands, British Virgin Islands (BVI), Jersey, and Isle of Man. These licences support the firm’s work with international corporate groups whose internal audit and assurance arrangements extend across several jurisdictions.
International group structures frequently combine UK operating companies with offshore holding entities, particularly in sectors such as investment management, technology, energy, and international trade. Reviewing internal audit quality across these structures requires an understanding of cross-border governance, group reporting lines, risk ownership, regulatory expectations, and assurance coordination.
Acumon works with internal audit teams, finance leaders, audit committees, and boards to assess whether internal audit arrangements are properly designed, consistently applied, and delivering clear value to the organisation. The assessment also identifies weaknesses in methodology, documentation, reporting, quality assurance, and governance oversight.
EQA Capabilities:
Acumon provides External Quality Assessment services across a wide range of organisational structures and sectors.
These include:
UK limited companies and corporate groups
Public Interest Entities (PIEs) and regulated organisations
offshore holding companies and investment vehicles
EQA engagements are led by senior assurance professionals who remain directly involved throughout the review. The work examines both documented internal audit frameworks and how those frameworks operate across planning, fieldwork, reporting, follow-up, and communication with senior stakeholders.
Regulatory Licences and Registrations:
Acumon holds several audit registrations that support its work with organisations operating across multiple jurisdictions and under different regulatory frameworks.
These include:
UK statutory audit registration
Public Interest Entity (PIE) audit licence
Jersey audit licence
Isle of Man audit licence
Cayman Islands audit licence
British Virgin Islands audit licence
These registrations give the firm experience of working within regulated assurance environments and supporting groups that include entities in both the UK and key international financial centres.
Core Services:
Alongside External Quality Assessments, Acumon provides services focused on internal audit effectiveness, governance, risk management, and control improvement.
These include:
statutory external audit
group and subsidiary audits
Public Interest Entity (PIE) audits
charity and not-for-profit audit
audit of international group structures
internal audit and governance reviews
risk management and compliance support
EQA work is delivered alongside discussions with internal audit leaders, management, audit committees, and boards regarding the role, independence, resources, performance, and strategic direction of the internal audit function.
Organisations seek an External Quality Assessment when they need independent evidence that their internal audit activity conforms to recognised standards and performs effectively. An assessment also gives boards and audit committees a clearer view of whether internal audit work addresses the organisation’s principal risks and provides reliable assurance.
Acumon works with organisations that are:
approaching their first statutory audit
preparing for external investment
expanding into international markets
operating within corporate group structures
Early preparation for an EQA helps internal audit teams organise supporting evidence, review their methodology, address documentation gaps, and confirm that reporting and quality assurance processes reflect professional expectations.
Address: 1-2 Craven Road, Ealing, London, W5 2UA, UK
BDO
BDO is a UK accountancy and business advisory firm providing audit, tax, deals, consulting, risk and outsourcing services. Within their internal audit work, they carry out external quality assessments, strategic reviews and gap analysis against the Global Internal Audit Standards, examining how audit functions are structured, governed and delivered.
Their reviews look at areas such as audit planning, methodology, reporting, stakeholder expectations, skills and quality improvement arrangements. They work with organisations that want an independent view of current performance, along with practical recommendations for strengthening the internal audit function.
Key Highlights:
UK accountancy and business advisory firm
Strong focus on entrepreneurial and mid-market organisations
Operations across the UK and Ireland
Member of the BDO International network
Work structured around quality, accountability and regulatory standards
KPMG is a professional services firm working across internal audit, enterprise risk management and regulatory assurance. Their external quality assessment work reviews internal audit functions against professional standards, established practice and the expectations of boards, audit committees and senior management.
They also use benchmarking and wider quality assurance work to examine how the function compares with peers and where its processes need to develop. The review may cover strategy, governance, methodology, technology, skills, reporting and quality improvement, with findings translated into practical actions for the internal audit team.
Key Highlights:
End-to-end internal audit capability
Combination of sector, risk and technology expertise
Independent assurance across financial and non-financial risks
Outsourced and co-sourced delivery models
Work spanning governance, controls and regulatory compliance
Services:
Internal audit strategy and design
Internal audit outsourcing and co-sourcing
Enterprise risk management
Contract compliance and assurance
Major project risk and assurance
Regulatory compliance reviews
Climate and sustainability assurance
Continuous assurance
Contact Information:
Website: kpmg.com
Phone: +44 (0)161 246 4000
Address: The Plaza, 100 Old Hall St, Liverpool L3 9QJ
Twitter: x.com/kpmguk
Facebook: www.facebook.com/KPMG
LinkedIn: www.linkedin.com/company/kpmg-uk
Deloitte
Deloitte is a UK professional services firm providing audit, assurance, consulting, risk and technology services. Their external quality assessments examine whether an internal audit function conforms with professional requirements and whether its structure, methodology and delivery remain effective for the organisation.
The work goes beyond reviewing audit files alone. Their teams assess governance, planning, reporting, stakeholder relationships, resourcing, technology and quality improvement arrangements, drawing on wider expertise in risk, cyber, data and regulation where those areas form part of the audit function’s remit.
Key Highlights:
Broad UK audit and professional services practice
Formal focus on ethics, integrity and professional quality
Multidisciplinary teams across business and technology
Part of an international network of independent member firms
Experience with complex and regulated work
Services:
Audit
Assurance
Risk, regulatory and forensic services
Cyber
Engineering, AI and data
Business process solutions
Strategy and transactions
Tax
Legal services
Human capital consulting
Contact Information:
Website: www.deloitte.com
Address: 1 New Street Square, London EC4A 3HQ, United Kingdom
Phone: +44 20 7936 3000
Facebook: www.facebook.com/deloitteuk
Twitter: x.com/deloitteuk
LinkedIn: www.linkedin.com/company/deloitte
Grant Thornton
Grant Thornton is an audit, tax and advisory firm with a dedicated internal audit and business risk practice. Their external quality assessment work reviews internal audit functions against professional standards, looking at how well the function is governed, how consistently it delivers its work and whether its approach reflects the organisation’s current risks.
Their teams examine audit strategy, planning, methodology, reporting, stakeholder engagement, resources and quality assurance arrangements. The final review sets out areas of conformance, weaknesses that need attention and practical steps for improving the function’s effectiveness.
Key Highlights:
UK audit, tax and advisory firm
Senior-led approach to client work
Use of technology alongside professional judgement
Protiviti is a consulting firm specialising in internal audit, risk, compliance, technology and business processes. Their independent external quality assessments review internal audit functions against professional standards, examining whether governance, methodology, delivery and reporting arrangements are working as intended.
The assessment considers both formal conformance and the practical performance of the function. Their teams review audit planning, stakeholder relationships, skills, technology, quality assurance and operating practices, then provide recommendations aimed at improving internal audit effectiveness and longer-term development.
Key Highlights:
Specialist internal audit and risk consulting practice
Work across governance, technology and operations
Tailored multidisciplinary project teams
Combination of consulting and managed solutions
International network of offices and member firms
Services:
Internal audit
Governance and risk consulting
Regulatory compliance
Technology consulting
Business process improvement
Data and analytics
Finance consulting
Managed solutions
Transaction support
Contact Information:
Website: www.protiviti.com
Phone: +44.20.7930.8808
Address: The Shard, 32 London Bridge St, London SE1 9SG, United Kingdom
Facebook: www.facebook.com/Protiviti
Twitter: x.com/ProtivitiUK
LinkedIn: www.linkedin.com/company/protiviti-uk-
Instagram: www.instagram.com/protiviti.uk
Forvis Mazars
Forvis Mazars provide external quality assessments of IT internal audit functions, reviewing how technology risks, controls and assurance work are handled across the audit process. Their work examines whether the function is properly structured, follows recognised internal audit standards and provides clear coverage of areas such as cyber risk, systems governance, data and technology change.
Their teams assess audit methodology, planning, reporting, skills and stakeholder engagement, alongside the quality of individual IT audit assignments. The review combines technical analysis with discussion across the organisation, producing an independent view of current performance and the practical improvements needed within the IT internal audit function.
Key Highlights:
Integrated audit and assurance practice
Work with regional, national and international organisations
Consistent tools and engagement methodologies
Independent review and assurance capability
Sector experience across private, public and regulated organisations
Services:
Financial audit
Corporate reporting
Independent assurance and reviews
Training services
Consulting
Sustainability
Financial advisory
Accounting and outsourcing
Contact Information:
Website: www.forvismazars.com
Phone: +44(0) 161 238 9200
Address: One St Peters Square, Manchester, M2 3DE, United Kingdom
Validera provides internal audit, assurance and governance services to private sector and not-for-profit organisations. They take a practical approach to reviewing control environments, looking at how governance, risk and compliance arrangements operate in day-to-day practice rather than treating them as separate exercises.
Their work includes external quality assessments alongside internal audit, external audit, grant audit and technology assurance. They also advise on risk management, governance, compliance, supply chains and process improvement, with services shaped around the organisation's existing controls and future plans.
Key Highlights:
Independent audit and governance practice
Work across private and not-for-profit sectors
External quality assessment capability
Coverage of operational and technology-related controls
BHBi are internal audit specialists providing external quality assessment reviews under the standards governing the internal audit profession. They work with Littlechild & Haley on EQA engagements and use experienced Chartered Internal Auditors to carry out reviews of internal audit functions and working practices.
Their methodology combines document review, stakeholder feedback and direct involvement from internal audit staff and senior audit leaders. Assessments are conducted against the International Professional Practices Framework and relevant public sector standards, with findings presented through a formal report and practical recommendations.
Key Highlights:
Specialist internal audit consultancy
Reviews carried out by senior internal audit professionals
Assessments against professional internal audit standards
Stakeholder-based review methodology
Confidentiality managed through non-disclosure agreements
Services:
Full external quality assessment reviews
Reviews against the IPPF
Reviews against public sector internal audit standards
Littlechild & Haley are an internal audit and risk consultancy working across assurance, governance, internal controls and technology risk. Their external quality assessments examine how an internal audit function operates, how its work is received by stakeholders and how closely it follows the Global Internal Audit Standards and any relevant sector requirements.
They build stakeholder discussion into the review rather than relying only on policies and audit files. The assessment looks at both conformance and performance, including the efficiency of the function, the quality of its work and the practical changes needed to strengthen future delivery.
Key Highlights:
Independent review of internal audit functions
Assessments aligned with Global Internal Audit Standards
Stakeholder consultation built into the process
Focus on both compliance and operational performance
Broader expertise in governance, risk and controls
Intisaa Associates provide internal audit, quality assessment, risk and advisory services through a multi-skilled team of auditors and advisers. They design each engagement around the organisation's structure, objectives and risk profile, with audit programmes written specifically for the work rather than taken from a standard template.
Their quality assessment work covers full external quality assessments and independent reviews of internal self-assessments. They assess conformance with global internal audit standards, share examples of stronger practice and report findings through workshops, presentations and written feedback for audit teams and other stakeholders.
HillAudit provides internal audit, risk management and training services across the UK, with a particular focus on public sector organisations. Their team brings together auditors and consultants with experience in governance, assurance, professional standards and different ways of organising internal audit work.
Their external quality assessment service includes gap analysis, full EQA reviews and self-assessment with independent validation. They also prepare teams for assessment through training, review audit strategies and assurance maps, and examine whether working practices reflect the current Global Internal Audit Standards.
Most EQA providers work nationally, so proximity is rarely the deciding factor. Where it helps to see who has an office nearby, we list providers with their local addresses for London, Birmingham, Manchester, Leeds and Bristol.
Acumon provides external quality assessment through CMIIA-qualified assessors, covering both routes permitted by Standard 8.4 as well as readiness support where another firm will carry out the assessment. Scope, deliverables and our independence rules are set out on the external quality assessment service page, alongside internal audit and internal audit outsourcing.
Conclusion
Choosing an EQA provider usually comes down to more than finding a firm that understands the standards. Organisations also need to look at how the assessment will be carried out, who will lead it, how much stakeholder input is included and whether the final report will offer practical direction rather than a simple compliance result.
Some providers take a broad audit and assurance approach, while others work almost entirely with internal audit teams. That difference matters. A large organisation with a complex risk structure may need access to wider technical expertise, whereas a smaller or public sector team may place more value on a focused review, direct senior involvement and a straightforward assessment process.
This guide brings those differences into one place. It gives organisations a clearer view of how UK providers work, the types of EQA services they offer and the wider experience sitting behind each team. That makes it easier to compare options on substance, ask better questions before appointing a provider and choose an assessment approach that suits the internal audit function as it actually operates.
AC
Written by the Acumon team
Acumon is an ICAEW-registered firm of chartered accountants and registered auditors
based in London, with offices in Pitstone, Aylesbury and Bournemouth. Need advice on
anything covered here? Talk to us.
An internal audit function must be assessed by a qualified, independent assessor at least once every five years. That requirement is Standard 8.4 of the Global Internal Audit Standards, which…
An internal audit function must be assessed by a qualified, independent assessor at least once every five years. That requirement is Standard 8.4 of the Global Internal Audit Standards, which…
An internal audit function must be assessed by a qualified, independent assessor at least once every five years. That requirement is Standard 8.4 of the Global Internal Audit Standards, which…
Read article
Get in Touch
Ready for Accountants Who Move Your Business Forward?
Tell us what you need. Within one business day, a qualified accountant will be in touch to talk it through and give you a clear, fixed-fee quote — no obligation.
We use essential cookies to run this site, plus Google Analytics and Google Ads to
understand how visitors use it and measure our advertising — only with your consent. See our
Privacy Policy.
