Buying an external quality assessment without the programme that surrounds it is the most expensive way to meet the five-year requirement. The Standards do not treat an EQA as a standalone product: Standard 8.3 requires a quality assurance and improvement programme, and the external assessment is only one of the two assessment types inside it.
What Standard 8.3 actually requires
The wording is a duty on one person. The chief audit executive "must develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the internal audit function".
The programme "includes two types of assessments":
- External assessments — Standard 8.4, at least once every five years by a qualified, independent assessor or assessment team;
- Internal assessments — Standard 12.1, continuous and carried out by the function itself.
Note where these sit. The external assessment and the programme duty are both in Domain III: Governing the Internal Audit Function — the board-oversight domain. Internal assessment sits in Domain IV under Principle 12, Enhance Quality. People hunting for the EQA requirement in the quality principle do not find it there, which is one reason the two halves get treated as unrelated.
The internal half, in detail
Standard 12.1 is specific about what internal assessment has to include. The chief audit executive must establish a methodology covering:
- Ongoing monitoring of the function's conformance with the Standards and progress toward performance objectives;
- Periodic self-assessments, or assessments by other people inside the organisation with sufficient knowledge of internal audit practices to evaluate conformance;
- Communication with the board and senior management about the results.
Two further duties attach. Where periodic self-assessments find problems, the chief audit executive "must develop action plans to address instances of nonconformance with the Standards and opportunities for improvement, including a proposed timeline". And if nonconformance "affects the overall scope or operation of the internal audit function", the chief audit executive must disclose it, and its impact, to the board and senior management.
The sentence that changes how you buy an EQA
This is the provision most functions have not absorbed. Under Standard 12.1, internal assessments "must be documented and included in the evaluation conducted by an independent third party as part of the organization's external quality assessment".
Read that as a buyer. Your internal assessment records are not optional supporting material you may choose to share — they are part of what the external assessor is required to evaluate. A function that has done no documented internal assessment is not simply arriving unprepared; it is unable to supply evidence the Standards oblige the assessor to consider.
The practical consequence is that the quality of your programme sets a ceiling on the value of the EQA you buy. Commission an assessment with nothing behind it and you pay an assessor to discover that you have no programme — an expensive way to learn something you already knew.
The reporting duties people miss
Standard 8.3 sets two different rhythms, and the first one catches functions out because it is annual rather than five-yearly.
At least annually, the chief audit executive must communicate the results of the internal quality assessment to the board and senior management. External assessment results must be reported when completed.
In both cases the communication has to cover the function's conformance with the Standards and achievement of performance objectives; where applicable, compliance with laws or regulations relevant to internal auditing; and where applicable, plans to address deficiencies and opportunities for improvement.
So there is an annual quality conversation with the audit committee whether or not an EQA is due. A committee that only hears about quality every fifth year is not receiving what the Standards require.
Building a programme that survives inspection
Four things separate a programme that exists from one that is only described.
Make ongoing monitoring a by-product, not a project. Conformance evidence should fall out of how engagements are already run — supervisory review recorded at working paper level, methodology checkpoints in the engagement file. If monitoring requires a separate exercise, it will not happen in a busy year.
Run periodic self-assessment properly and write it down. Assess against the Standards domain by domain, record the evidence reference beside each conclusion rather than the conclusion alone, and be candid. An external assessor who finds a self-assessment claiming conformance in an area they then find deficient will discount the whole document.
Use the "other persons within the organization" route where it helps. Standard 12.1 expressly permits assessment by others inside the organisation with sufficient knowledge of internal audit practices. For a small function where self-assessment is genuinely self-marking, a knowledgeable colleague from outside the team adds credibility at no cost.
Close the loop on action plans. The Standard requires plans with timelines, and the assessor will look for whether previous actions were actually completed. Action plans that recur unchanged across years are a finding in themselves.
What to buy, and when
If your next external assessment is more than two years away, the useful spend is on the programme rather than the assessment: a documented methodology, a first honest self-assessment, and the annual reporting rhythm to the committee. That work reduces the cost of the eventual EQA and improves its findings at the same time.
If the assessment is imminent, buy readiness alongside it — but from someone who is not also the assessor, because a firm cannot independently assess work it has just helped you prepare.
Our guide to external quality assessment covers the assessment itself, how to prepare for an EQA the twelve months before one, who can perform one the independence and qualification rules, and EQA providers in the UK the market.
Acumon helps internal audit functions build and run the programme as well as meet the five-year requirement, through external quality assessment, internal audit and internal audit outsourcing work, with corporate governance support for the board-level reporting. If you cannot show a documented internal assessment from the last twelve months, that is the gap to close before you commission anything.