Most internal audit functions prepare for an external quality assessment in the six weeks before it starts. That is the wrong six weeks. The findings an EQA produces are set by what you did over the preceding five years, and the single largest category of adverse finding is not poor work — it is good work with no evidence behind it.
Start twelve months out
The useful preparation window is a year, because two of the things an assessor looks for cannot be created retrospectively without it being obvious.
The first is a functioning quality assurance and improvement programme. Standard 8.3 requires the chief audit executive to develop, implement and maintain one, and Standard 12.1 requires that internal assessments "must be documented and included in the evaluation conducted by an independent third party as part of the organization's external quality assessment". A function that runs its first-ever internal quality review the month before the assessor arrives has told the assessor something it did not intend to.
The second is closed management actions. Follow-up is judged on outcomes. A year gives you time to chase overdue actions to closure or, where they will never close, to escalate them properly so the record shows the function did its job.
The self-assessment comes first
Whichever route you take — a full external assessment or a self-assessment with independent validation — start by assessing yourself honestly against the Standards, domain by domain.
Do it in writing, and record the evidence reference against each conclusion rather than the conclusion alone. Two benefits follow. You find the gaps while you still have time to close them. And you arrive with an evidence map, which shortens the assessment and signals a function that manages its own quality.
Be candid in it. An assessor who finds a self-assessment claiming full conformance in an area they then find deficient will discount everything else in the document.
The evidence pack
Assemble these before the assessor asks, covering the full period since the last assessment:
- Internal audit charter, with the date and minute of board or committee approval, and any revisions;
- Audit plans for each year, with the risk assessment that produced them and any in-year revisions with reasons;
- Audit committee papers and minutes — the minutes matter more than the papers, because they show how the committee actually engaged;
- A representative sample of engagement files spanning good and difficult audits, not a curated best-of;
- Action tracking records showing raised, agreed, due, closed, and overdue escalations;
- Annual internal audit opinions and how they were supported;
- Quality programme records — supervisory review evidence, post-engagement reviews, periodic self-assessments;
- Resourcing and competency records — team structure, qualifications, CPD, use of specialists;
- Conflict and independence declarations, including any safeguards where the CAE holds other responsibilities.
Fix the predictable gaps
Four gaps appear in most functions and all four are fixable inside a year.
Supervision and review evidence. Work is reviewed; the review leaves no trace. If your system does not timestamp reviewer sign-off at working paper level, start recording it now — this is the most common single finding and the cheapest to remedy going forward.
The risk-to-plan link. The plan is risk-based in the head of the person who built it. Write the derivation down: these are the organisation's principal risks, here is existing assurance over each, here is where we are auditing and why, here is what we consciously chose not to cover.
An out-of-date charter. Review it against the current Standards, take it back to the committee for approval, and keep the minute.
Independence safeguards on paper. Where the chief audit executive also owns risk, compliance or another control function, the safeguard needs to be documented and committee-approved. Assessors treat an undocumented safeguard as no safeguard.
Prepare the people, not just the files
An EQA involves interviews — the audit committee chair, the chief executive, the finance director, senior operational stakeholders, and the audit team.
Do not script them. Assessors have heard coached answers and it damages credibility. Do brief participants on what an EQA is, why it is happening, and roughly what will be discussed, because a stakeholder who thinks they are being investigated gives defensive answers that help nobody.
One conversation is worth having in advance. If you already know a stakeholder holds a critical view of the function, hear it yourself before the assessor does. You cannot change their evidence, but you can stop being surprised by it in a draft report.
Agree the terms of reference properly
Settle these before work starts:
- Scope and period — which years, which locations, which subsidiaries;
- Route — full external assessment or self-assessment with independent validation;
- The conformance scale the assessor will use, and what each rating means;
- Who sees the draft, in what order, and how factual disagreements are resolved;
- Who receives the final report and who presents it to the committee;
- Sampling approach — how many engagement files, chosen by whom.
The draft-report question causes the most friction and is the easiest to settle in advance. A chief audit executive who first sees a finding in the committee pack has been badly served.
Afterwards is the part that counts
The report is not the deliverable. The improvement plan is.
Convert every recommendation into an owned action with a date, take the plan to the audit committee with the report, and report progress against it during the year. Then feed it into your ongoing quality programme, so the next assessment starts from a function that has demonstrably acted on the last one.
The functions that get least from an EQA are the ones that treat it as an examination to pass. The ones that get most treat it as the one occasion in five years when somebody independent will tell the board what the function needs.
Our guide to external quality assessment covers the requirement itself, who can perform one the independence rules, and EQA providers in the UK the market.
Acumon prepares in-house functions for assessment and delivers independent reviews through external quality assessment, internal audit and internal audit outsourcing work, with risk management support where the plan's risk linkage is the gap. If your next assessment is due within two years, the quality programme is the thing to start now.