Every internal audit function has to be assessed by someone independent at least once every five years. That is not best practice or a maturity goal — it is a requirement of the Global Internal Audit Standards, which took effect in January 2025. There are two ways to meet it, and most functions do not realise they have a choice.
What an external quality assessment is
An external quality assessment — EQA — is an independent review of an internal audit function: how far it conforms with professional standards, and how effective it actually is. It is not an audit of the organisation. It is an audit of the auditors.
Two things distinguish it from internal review. The assessor comes from outside the organisation, so the opinion carries weight with an audit committee that has heard the function's own view already. And it covers the whole function — mandate, independence, resourcing, methodology, reporting, stakeholder relationships — rather than the quality of individual audit files.
A note on the term, because it causes genuine confusion. "External quality assessment" also means something completely different in clinical pathology, where it describes proficiency testing schemes that check laboratory accuracy against peers. That is a separate field with separate standards and separate providers. This guide is about internal audit.
Where the requirement comes from
The requirement is Standard 8.4, External Quality Assessment, and it sits in Domain III: Governing the Internal Audit Function — not in the quality principle, which is where most people look for it. Its wording is short: "The external assessment must be performed at least once every five years by a qualified, independent assessor or assessment team."
It sits under a wider duty in Standard 8.3, Quality: the chief audit executive "must develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the internal audit function", and that programme "includes two types of assessments" — external assessments under 8.4, and internal assessments under Standard 12.1, Internal Quality Assessment, in Domain IV.
So the external assessment is one half of a pair. Internal assessment is continuous, and 12.1 sets out what it must include: ongoing monitoring of conformance and progress toward performance objectives, and periodic self-assessments. Those internal assessments "must be documented and included in the evaluation conducted by an independent third party as part of the organization's external quality assessment".
That last sentence is the one to absorb. An assessor arriving to find no documented internal quality activity is not merely unimpressed — they are missing evidence the Standards require them to evaluate. Our guide to the quality assurance and improvement programme covers the internal half.
The two routes, and how to choose
The Standards allow the five-year requirement to be met in either of two ways.
The Standards call the second route a self-assessment with independent validation. The Chartered IIA markets its version as a Validated Self-Assessment, or VSA, and you will see both names for the same thing.
| Full external quality assessment | Self-assessment with independent validation | |
|---|---|---|
| Who does the work | An independent external assessment team | The internal audit function assesses itself, with independent validation by experienced assessors |
| Effort on your team | Lower — you supply evidence and access | Higher — your team carries out the assessment |
| Relative cost | Higher | Lower; the Chartered IIA presents it as a cost-effective alternative |
| Meets the five-year requirement | Yes | Yes — the same requirement |
| Suits | First assessment, a function under scrutiny, or where the committee wants maximum independence | A mature function with capacity, repeating an assessment after a clean prior cycle |
Both satisfy the Standards. The honest question is not which is more rigorous on paper but which produces a result your audit committee will believe. Where the function has had a difficult year, where the chief audit executive is new, or where the committee has asked pointed questions about independence, a full external assessment answers a question a self-assessment cannot.
What the assessment looks at
A competent EQA goes well beyond a conformance checklist. The areas that carry the most weight in practice:
- Mandate and charter. Is the function's authority documented, approved by the board, and matched by what it actually does?
- Independence and positioning. Reporting lines, access to the board, and whether the chief audit executive can raise an unwelcome finding without consequence;
- Board and committee oversight. Whether the audit committee genuinely directs and supports the function, or receives its papers passively;
- Resourcing and competency. Headcount, skills, and access to specialists for IT, cyber, fraud and data;
- Risk-based planning. Whether the plan derives from the organisation's real risks or from last year's plan;
- Methodology and engagement delivery. Planning, fieldwork, evidence, supervision and review;
- Communication and follow-up. Reporting quality, and whether agreed actions are tracked to closure rather than logged and forgotten;
- The quality programme itself. Whether internal assessment is real and documented.
What organisations get out of it
The compliance benefit is the obvious one and the least interesting. The value that actually justifies the spend falls into four areas.
An independent answer for the audit committee. Non-executives are asked to rely on internal audit's opinion. An EQA tells them how much that opinion is worth, from someone with no stake in the answer.
Leverage for the chief audit executive. A CAE who has been arguing for more resource, better access or a clearer reporting line gets that argument made independently. In our experience this is the most common practical outcome of an EQA, and it is rarely the one stated in the terms of reference.
Benchmarking. An assessor who has reviewed comparable functions can say where yours sits, which no internal exercise can.
A prioritised improvement plan. The deliverable that matters is not the conformance opinion but the list of what to fix, in order, with a realistic sense of effort.
Where functions lose marks
Recurring themes, and what sits behind them:
| Finding | What it usually means |
|---|---|
| No documented quality programme | Internal assessment happens informally and leaves no evidence, so it cannot be relied on |
| Charter out of date | Approved years ago and never revisited against the current Standards or the function's actual remit |
| Plan not demonstrably risk-based | The link from risk register to audit plan exists in someone's head, not on paper |
| Actions tracked but not closed | Follow-up stops at reporting overdue items rather than pursuing them |
| Thin engagement documentation | The work was done properly; the file does not show it. Supervision and review evidence is the usual gap |
| Independence compromised by other duties | The CAE also owns risk, compliance or a control function, without a documented safeguard |
Note the pattern: most are evidence failures rather than capability failures. Functions doing good work routinely score badly because nothing records it.
Choosing an assessor
Independence is the first filter. An assessor cannot review work their own firm performed, and any relationship with the organisation needs to be disclosed and considered before appointment, not after.
Beyond that, ask what the assessor has actually done: internal audit functions of comparable size and sector, and credible internal audit experience rather than external audit experience relabelled. Ask to see an anonymised specimen report — the depth of the improvement recommendations tells you more than any credential. And agree at the outset who sees the draft and how disagreements are handled, because that conversation is much harder once a finding is on the page.
Our guide to EQA providers in the UK sets out who offers this work, and how to prepare for an EQA covers the twelve months before one.
Getting the timing right
Count back from the deadline, not forward from convenience. If the last assessment concluded in, say, March 2022, the next must be complete by March 2027 — which means appointing an assessor in 2026, not starting the conversation in 2027.
Two things to settle in the terms of reference. Standard 8.4 requires the chief audit executive to ensure that at least one person on the assessment team holds an active Certified Internal Auditor designation — check it rather than assume it. And assessors differ in how they phrase conformance conclusions, so agree the rating scale up front, because the Standards do not prescribe one and the audit committee needs to know what "conforms" will mean when it arrives.
Acumon supports internal audit functions on both sides of this requirement through external quality assessment, internal audit and internal audit outsourcing work, with corporate governance and risk management support for the board-level questions an assessment raises. If you cannot name the date your last external assessment concluded, that is the first thing to establish.