The Global Internal Audit Standards require an external assessment of internal audit at least once every five years, but they do not hand you a list of approved firms. The constraint is independence and competence, and the first of those disqualifies more candidates than organisations expect — including, frequently, the adviser they were about to appoint.
The independence test
An external assessment is worth nothing if the assessor is reviewing their own work, or hopes to win the work they are reviewing. Three situations need care.
The firm already provides your internal audit. If internal audit is outsourced or co-sourced to a firm, that firm cannot assess it. This is the clearest case and it is still got wrong, usually because the relationship is described as "advisory" rather than delivery.
The firm is your external auditor. Assessing the internal audit function your audit team relies on creates an obvious self-interest, and for a listed or public interest entity there are separate restrictions on non-audit services to consider before anyone discusses scope.
The assessor wants your next engagement. An assessor positioned to bid for outsourcing work off the back of the findings has a reason to find the function wanting. Ask directly whether they will bid, and record the answer.
Lesser conflicts do not automatically disqualify — a firm that ran one unrelated project three years ago is usually fine — but they must be disclosed and considered by the audit committee before appointment, not surfaced afterwards.
The competence test
Independence is necessary and not sufficient. The assessor also has to understand internal audit as a discipline.
The distinction worth insisting on is between internal and external audit experience. They are different professions with different standards, and an assessor whose background is statutory audit will tend to review engagement files as if they were audit files, and miss the things that actually determine whether a function is effective — positioning, mandate, board engagement, and whether the plan addresses the organisation's real risks.
Four questions separate a competent assessor from a credentialled one:
- How many internal audit functions have you assessed, of what size, in which sectors?
- Who will actually do the work — the person in the room now, or a team you will meet later?
- Can we see an anonymised specimen report? The depth of the improvement recommendations is the single best indicator of quality;
- What is your experience of our sector's regulatory context? A housing association, an academy trust, a bank and a manufacturer are not interchangeable.
One qualification is not optional. Standard 8.4 requires that when selecting the assessor or assessment team, the chief audit executive "must ensure at least one person holds an active Certified Internal Auditor® designation". That is a hard condition of the appointment, not a preference — check it before you sign, because an assessment team without it does not meet the Standard.
Beyond that floor, the Chartered Member of the Institute of Internal Auditors designation is the UK benchmark, but treat it as a baseline rather than a differentiator.
Who offers this work
Four kinds of provider, with different trade-offs.
| Provider | Strengths | Watch for |
|---|---|---|
| The professional body | Authority with the audit committee; runs both full assessments and validated self-assessments | Capacity and lead times; less sector-specific commercial insight |
| Large accountancy firms | Benchmarking depth, sector specialists, brand comfort for the board | Independence if they audit you or want the outsourcing; the named partner may not do the work |
| Specialist internal audit firms | Assessment is core work, not a sideline; usually senior-led throughout | Smaller comparison base; check sector fit |
| Independent individual assessors | Cost, and genuine seniority on every engagement | Single point of failure; no peer review behind the opinion; benchmarking is anecdotal |
Our guide to EQA providers in the UK sets out who is active in this market.
Peer assessment, and its limits
Reciprocal arrangements between organisations — you assess ours, we assess yours — are common in the public sector and in group structures, and they are cheap.
Two cautions. Reciprocity is itself a threat to independence: an assessor who expects to be assessed by the person they are assessing has an incentive to be gentle, and the audit committee will see that. And peer assessors are often assessing for the first time, which shows in the depth of the findings.
Where a peer arrangement is used, it is worth documenting explicitly how the reciprocity threat has been managed, and being realistic with the committee about what the exercise can and cannot tell them.
What it costs
Published rate cards do not exist for this work, and any figure quoted without seeing your function is guesswork. What you can do is understand the drivers, because they are the things you control:
- Route. A self-assessment with independent validation costs less than a full external assessment, because your team does the assessment work. The Chartered IIA, which markets it as a Validated Self-Assessment, presents it in exactly those terms;
- Size and spread of the function, and the number of locations or entities in scope;
- Sample size — how many engagement files are examined;
- Interview count — stakeholder interviews drive a surprising share of the effort;
- Your state of readiness. A function with an evidence pack and a current self-assessment takes materially less assessor time than one that has to reconstruct five years of records.
That last point is worth planning around, because preparation reduces cost and improves the finding at the same time — see how to prepare for an EQA.
Appointing well
Run it as a proper selection. Brief two or three candidates on the same scope, require disclosure of any relationship with the organisation, ask each how they would handle a disagreement over a finding, and let the audit committee chair meet the shortlist — they are a principal user of the output and will have to rely on it.
Agree the conformance scale and the draft-review process in the terms of reference. And appoint early: assessor availability, not your calendar, is usually what sets the date.
Acumon provides independent assessment and assessment readiness through external quality assessment, internal audit and internal audit outsourcing work, with corporate governance support where the findings reach the board. If the firm you have in mind already delivers any part of your internal audit, that is the conflict to resolve before anything else.