External Quality Assessment

The Global Internal Audit Standards, effective January 2025, require that an external assessment "must be performed at least once every five years by a qualified, independent assessor or assessment team". That is Standard 8.4, in Domain III: Governing the Internal Audit Function — it sits under the board's oversight duties rather than in the quality principle, which is where most people look for it.

An EQA is not an audit of your organisation. It is an assessment of the audit function itself — its mandate, independence, positioning, resourcing, methodology, reporting and follow-up — and the deliverable your audit committee actually needs is not the conformance opinion but a prioritised, realistic plan for what to improve.

Full EQA or Validated Self-Assessment?

The Standards allow the five-year requirement to be met two ways, and both are legitimate.

A full external quality assessment is carried out by our team. You supply evidence and access; we do the assessment work. It suits a first assessment, a function under scrutiny, a newly appointed chief audit executive, or any situation where the audit committee wants maximum independence behind the opinion.

A validated self-assessment is carried out by your own function, with independent validation by our assessors. It asks more of your team and costs less, and it suits a mature function with capacity that is repeating an assessment after a clean prior cycle.

We will tell you which we think fits before you commission either, including when the answer is the cheaper one.

What We Assess

Conformance with the Standards is the floor, not the point. Our assessment covers the mandate and charter and whether board approval matches what the function actually does; independence and positioning, including reporting lines and real access to the board; audit committee oversight and whether it directs the function or receives its papers passively; resourcing, competency and access to specialist skills; whether the audit plan genuinely derives from the organisation's risks; engagement methodology, evidence and supervision; reporting quality and whether agreed actions are tracked to closure; and the internal half of your quality programme.

In our experience most adverse findings are evidence failures rather than capability failures — functions doing good work that keeps no record of supervision, review or the reasoning behind the plan.

Assessment Readiness

Where another firm will perform your EQA, we help you arrive ready. That means an honest self-assessment against the Standards with evidence referenced against each conclusion, an evidence pack covering the full period since the last assessment, and remediation of the gaps that are predictable — supervision and review evidence, the documented link from risk register to audit plan, an out-of-date charter, and independence safeguards that exist in practice but not on paper.

Readiness work reduces the assessor's time and improves the finding at the same time. It is worth starting twelve months out, because a quality programme cannot be created retrospectively without it being obvious.

Independence — Including Ours

An external assessment is worthless if the assessor is reviewing their own work or hopes to win the work they are reviewing. We will not assess an internal audit function we deliver or co-source, and we disclose any prior relationship with the organisation for the audit committee to consider before appointment rather than after.

If we intend to bid for related work, we say so up front. If you ask us to assess a function we already support, we will decline and say why — an opinion the committee cannot rely on is not worth buying.

One condition is not a matter of judgement: Standard 8.4 requires the chief audit executive to ensure at least one person on the assessment team holds an active Certified Internal Auditor designation. Ask any prospective assessor to evidence it, including us.

What You Receive

A written report addressed to the audit committee setting out the conformance conclusion against an agreed rating scale, the evidence behind it, and improvement recommendations prioritised by impact and realistic effort.

We agree the rating scale, the sampling approach and the draft-review process in the terms of reference, so nobody first sees a finding in a committee pack. We present the findings to the committee where that helps, and we convert the recommendations into an owned action plan you can report progress against — because an assessment that stops at the report changes nothing.

What You Get With Acumon

• Full external quality assessment against the Global Internal Audit Standards
• Validated self-assessment with independent validation
• Assessment readiness support where another firm performs your EQA
• Conformance opinion plus a prioritised, costed improvement plan
• Rating scale, sampling and draft-review process agreed up front
• Findings presented to the audit committee where that helps
• Strict independence — we do not assess functions we deliver

Why Acumon for External Quality Assessment?

• CMIIA-qualified assessors
• Full EQA, validated self-assessment and readiness support
• Independence maintained — we do not assess functions we deliver

Get a Fixed-Fee Quote

Tell us what you need and we'll come back within one business day with a clear scope and a fixed price — no hourly-rate surprises. Call 020 8567 3451 or use the form and we'll be in touch.