You will choose an external quality assessment provider roughly once every five years, and the choice is harder than it looks because the usual shortcut — appoint the firm you already trust — is often the one option the Standards rule out. Independence disqualifies more candidates than organisations expect, and one qualification is mandatory rather than desirable.
Why this decision is different
Most professional appointments reward familiarity. This one penalises it. An external quality assessment is an opinion on your internal audit function delivered to your audit committee, and its entire value rests on the assessor having no stake in the answer.
The requirement itself is Standard 8.4 of the Global Internal Audit Standards, which took effect in January 2025. It sits in Domain III, Governing the Internal Audit Function — under the board's oversight duties rather than in the quality principle, which is where most people go looking for it. The wording is short: "The external assessment must be performed at least once every five years by a qualified, independent assessor or assessment team."
Two words in that sentence do the work. Qualified and independent. Everything below is about testing them.
The one mandatory qualification
Standard 8.4 is explicit, and it is the single easiest thing to check before you sign anything. When selecting the assessor or assessment team, the chief audit executive "must ensure at least one person holds an active Certified Internal Auditor® designation".
Note three things. It is a designation, not a firm credential — ask which named individual holds it. It must be active, so a lapsed qualification does not count. And it is the CIA specifically; the Chartered Member of the Institute of Internal Auditors designation is a respected UK credential and a good sign, but it is not what Standard 8.4 names.
An assessment team without an active CIA does not meet the Standard. Ask for evidence rather than assurance.
Independence: the three conflicts that rule a firm out
They already provide your internal audit. A firm that delivers or co-sources your internal audit function cannot assess it. This is the clearest disqualification and it is still got wrong, usually because the relationship is described internally as "advisory" rather than delivery.
They are your external auditor. Assessing the internal audit function that your audit team relies on creates an obvious self-interest. For a listed or public interest entity there are separate restrictions on non-audit services that need considering before anyone discusses scope.
They want the work the findings might create. An assessor positioned to bid for an outsourcing contract off the back of their own report has a reason to find the function wanting. Ask directly whether they intend to bid, and record the answer in the file.
Lesser relationships do not automatically disqualify. A firm that ran one unrelated project three years ago is usually fine — but it should be disclosed to the audit committee before appointment, not surfaced afterwards.
Testing competence
Independence is necessary and not sufficient. The distinction that matters most is between internal audit and external audit experience. They are different professions with different standards, and an assessor from a statutory audit background tends to review engagement files as though they were audit files — missing the things that actually determine whether a function is effective: its mandate, positioning, board engagement, and whether the plan addresses the organisation's real risks.
Questions that separate a competent assessor from a credentialled one
- How many internal audit functions have you assessed, of what size, in which sectors?
- Who will actually do the work? The person in the room now, or a team you will meet after signing?
- May we see an anonymised specimen report? The depth of the improvement recommendations tells you more than any credential;
- Who on the team holds an active CIA? Name and evidence;
- What is your experience of our regulatory context? A housing association, an academy trust, a bank and a manufacturer are not interchangeable;
- How do you handle a disagreement over a finding? Ask before you need the answer.
Full assessment or validated self-assessment?
Standard 8.4 allows the requirement to be met two ways: a full external quality assessment, or — in the Standards' own words — "a self-assessment with independent validation". The Chartered IIA markets its version of the second route as a Validated Self-Assessment, or VSA, and you will see both names for the same thing.
Both satisfy the Standard. The practical question is not which is more rigorous on paper but which produces a result your audit committee will believe.
When the full route is worth the difference
A first assessment, a newly appointed chief audit executive, a function that has had a difficult year, or a committee that has asked pointed questions about independence. In those situations a full external assessment answers a question a self-assessment cannot, and paying less to answer it weakly is a false economy.
When the validated route fits
A mature function with the capacity to do the assessment work, repeating an exercise after a clean prior cycle, where the committee already has confidence and the value sought is improvement rather than reassurance.
A good provider will tell you which they think fits before you commission either, including when the answer is the cheaper one. A provider that only ever recommends the more expensive route is telling you something.
A workable selection process
Step 1 — Establish your deadline first
Count back from the date the last assessment concluded, not forward from convenience. If it completed in March 2022, the next must be complete by March 2027, which means appointing during 2026. Assessor availability, not your calendar, usually sets the date.
Step 2 — Decide the route before you approach anyone
Going to market without knowing whether you want a full assessment or a validated self-assessment produces proposals you cannot compare.
Step 3 — Brief two or three candidates on identical scope
Same period, same locations, same entities, same sample expectations. Different scopes produce different prices and no useful comparison.
Step 4 — Require conflict disclosure in writing
Ask every candidate to disclose any relationship with the organisation over the last several years, and whether they expect to bid for related work.
Step 5 — Let the audit committee chair meet the shortlist
They are a principal user of the output and will have to rely on it. Their read on whether an assessor will tell them something uncomfortable is worth more than a scoring matrix.
Step 6 — Settle the terms of reference before work starts
Scope and period; the route; the conformance rating scale and what each rating means; who sees the draft, in what order, and how factual disagreements are resolved; who receives the final report and who presents it; and the sampling approach, including how many engagement files and chosen by whom.
The draft-report question causes the most friction and is the easiest to settle in advance. A chief audit executive who first sees a finding in the committee pack has been badly served.
What drives the price
Published rate cards do not exist for this work, and any figure quoted without seeing your function is guesswork. The drivers are largely things you control:
- The route — a self-assessment with independent validation costs less, because your team does the assessment work;
- Size and spread of the function, and the number of locations or entities in scope;
- Sample size — how many engagement files are examined;
- Interview count — stakeholder interviews drive a surprising share of the effort;
- Your readiness — a function with a documented self-assessment and an assembled evidence pack takes materially less assessor time than one reconstructing five years of records.
That last driver is worth planning around, because preparation reduces the cost and improves the finding at the same time. Our guide to preparing for an EQA covers the twelve months before one.
Red flags
- No named CIA on the team. A hard fail against Standard 8.4;
- A price quoted before anyone has seen the function. It means the scope is assumed, and scope is where cost lives;
- Reluctance to show a specimen report. Usually because the recommendations are thin;
- An assessor who will not say the route you asked for is wrong. Agreeableness at proposal stage predicts agreeableness in the findings;
- A team of external auditors presented as internal audit assessors;
- No willingness to commit to the draft-review process in writing.
After the appointment
The report is not the deliverable — the improvement plan is. Convert every recommendation into an owned action with a date, take the plan to the audit committee alongside the report, and report progress during the year.
Then feed it into the internal half of the requirement. Standard 8.3 requires the chief audit executive to maintain a quality assurance and improvement programme covering both external and internal assessment, and Standard 12.1 requires internal assessments to be documented and included in the external assessor's evaluation next time. Our guide to the quality programme covers that side.
Working with Acumon
Acumon provides external quality assessment through CMIIA-qualified assessors, covering both routes — a full external quality assessment, or independent validation of your own self-assessment — as well as readiness support where another firm will perform the assessment.
We apply the independence rules to ourselves: we do not assess an internal audit function we deliver or co-source, we disclose any prior relationship with the organisation for the audit committee to consider before appointment, and we say up front if we intend to bid for related work. If you ask us to assess a function we already support, we will decline and explain why.
Details of scope, deliverables and the assessment approach are on our external quality assessment service page, alongside internal audit and internal audit outsourcing.
Frequently asked questions
How often must an external quality assessment be carried out?
At least once every five years, under Standard 8.4 of the Global Internal Audit Standards. Count back from the completion date of the previous assessment.
Can our external auditor perform our EQA?
It creates a self-interest that needs careful consideration, and for listed or public interest entities there are separate non-audit service restrictions. In most cases a different firm is the cleaner answer, and it is the audit committee's decision to take on disclosed facts.
Does the assessor have to be a firm?
No. Standard 8.4 refers to a qualified, independent assessor or assessment team, so an individual can perform one. Weigh the seniority and cost advantages against a single point of failure and a narrower benchmarking base.
What qualification is actually required?
At least one person on the assessment team must hold an active Certified Internal Auditor designation. Other credentials may be valuable but that is the one the Standard names.
Is a validated self-assessment a lesser option?
Not in compliance terms — it meets the same requirement. It asks more of your team and costs less. Whether it is right depends on your function's maturity and what your audit committee needs to be convinced of.
Our guide to who can perform an EQA covers the independence and qualification rules in more depth, external quality assessment explains the requirement itself, and EQA companies in the UK sets out providers active in this market.