Internal audit EQA: how to prepare for an external quality assessment

An internal audit EQA is the one occasion when an independent assessor tells your board, in writing, whether the internal audit function conforms with professional standards and how well it performs. The IIA’s Global Internal Audit Standards took effect on 9 January 2025 and are now the benchmark for that judgement,¹ with the UK public sector following from 1 April 2025. The new Standards place more of the evidence burden on the board and senior management as well as on the chief audit executive, so preparation matters more than it did. This guide explains what an external quality assessment of internal audit covers, how to choose between a full assessment and a self-assessment with independent validation, what to gather, how to prepare stakeholders, the gaps assessors commonly find and what to do once the report arrives.

If you have not yet worked through the new Standards themselves, start with our overview of what changed in the Global Internal Audit Standards and what to update.

When an internal audit EQA is due

Standard 8.4 requires an external quality assessment at least once every five years by a qualified, independent assessor or assessment team. The chief audit executive must develop a plan for it and discuss the plan with the board. The board and chief audit executive may decide that more frequent assessment is appropriate, for example after a change of chief audit executive or senior management, significant changes in methodology, the merger of internal audit functions or significant staff turnover.²

Two UK frameworks add to this. The Chartered IIA’s Internal Audit Code of Practice, effective from January 2025 for the financial services, private and third sectors, says the audit committee should obtain an independent external quality assessment at appropriate intervals irrespective of the organisation’s size, that the function as a whole should be reviewed at least every five years, and that conformity with both the Code and the Standards should be explicitly included. The audit committee chair should oversee the appointment of the assessor.³

In the public sector and local government, the Global Internal Audit Standards apply together with the Application Note issued by the Relevant Internal Audit Standard Setters to engagements commenced on or after 1 April 2025, and external assessors must consider conformance with the Application Note as part of their results.⁴ For local government bodies, CIPFA’s Code of Practice for the Governance of Internal Audit, in force from 1 April 2025, requires senior management to ensure an external quality assessment at least once every five years against the Standards as applied in the UK public sector, including the Code itself.⁵

What an External Quality Assessment covers

Conformance with the Standards is the core of any assessment, but the Standards expect an external quality assessment to be broader than a compliance check. The considerations for Standard 8.4 list the areas a comprehensive review should address.² The table below groups them and shows the evidence an assessor will usually want to see.

Area under review	What the assessor is testing	Evidence to have ready
Conformance with the Standards	Whether each requirement is met and each principle achieved	Your self-assessment mapped to every standard, with evidence references
Mandate, charter, strategy and plan	Whether the function’s foundations are agreed, current and approved	Approved charter, documented strategy, risk assessment, audit plan and board minutes approving them
Methodologies and processes	Whether methodologies are documented, aligned with the Standards and followed	Audit manual, templates, a sample of completed engagement files, supervision evidence
Laws and regulations	Compliance with any legal or regulatory requirements that apply to internal audit	Relevant regulations, regulator correspondence, sector codes
Performance	Performance criteria and measures, and how results are used	Board-approved performance objectives, KPI reports, stakeholder feedback
People	Competencies and due professional care, including the chief audit executive’s qualifications	Skills matrix, CPD records, job descriptions, training plans
Governance and independence	Integration into governance and the relationships that position the function independently	Reporting lines, independence confirmations, records of private sessions with the audit committee
Contribution and expectations	Contribution to governance, risk management, control and improvement, and whether stakeholder expectations are met	Annual opinion, thematic reports, follow-up results, interview and survey responses

Your own internal assessments are part of the evidence. Standard 12.1 requires internal assessments to be documented and included in the evaluation carried out by the independent third party.² If you have adopted the Chartered IIA Code, expect it to be covered too: the Code’s foreword states that external quality assessment providers will benchmark against it.³

Topical Requirements are a further consideration. The IIA issued the first, on cybersecurity, on 5 February 2025, and it is effective from 5 February 2026.⁶ Internal auditors must conform with a Topical Requirement when an engagement’s scope includes that topic,² so if your assessment falls after February 2026 your planning and engagement files should show how you considered it.

Full EQA or self-assessment with validation

The Standards allow the requirement to be met either by a full external assessment or by a self-assessment with independent validation. A self-assessment with validation typically involves a comprehensive, fully documented internal assessment that emulates the external process, validation by a qualified independent assessor that the self-assessment was complete and accurate, and benchmarking and interviews with key stakeholders. The board must approve the chief audit executive’s plan, including the rationale for choosing self-assessment with validation over a full assessment.²

Consideration	Full external assessment	Self-assessment with independent validation
Who does most of the work	The external assessor	The internal audit function, then the validator
Internal time required	Lower: mainly evidence provision and interviews	Higher: a full assessment against every standard
Independence of the judgement	Independent throughout	Independent validation of an internal judgement
Best suited to	New or changed functions, a new chief audit executive, known concerns, or first assessment under the new Standards	Mature, well-documented functions with capacity and a recent clean assessment
Development value for the team	Learning from the assessor’s findings	Deep familiarity with the Standards built during the self-assessment

As a rule of thumb, a function assessed for the first time against the 2024 Standards gains more from a full assessment, because the self-assessment would need to interpret requirements the team has not yet applied in practice. Whichever route you choose, the IIA’s Quality Assessment Manual, 2024 edition, is authoritative IIA Global Guidance and includes a model for concluding on the quality of the function, which makes it a useful structure for your own self-assessment.⁷ We offer both routes, as well as readiness reviews, through our internal audit quality review and EQA service.

Choosing a qualified, independent assessor

At least one member of the assessment team must hold an active Certified Internal Auditor designation. The considerations also point to experience of the Standards and leading practice, chief audit executive or comparable senior experience, sector experience, previous assessment experience, IIA-recognised assessment training, and a written attestation that there are no conflicts of interest.² In the UK public sector, the Application Note replaces the Certified Internal Auditor requirement: at least one person must have the qualifications expected of a public sector chief audit executive, namely CMIIA, a CCAB qualification or an equivalent that includes internal audit training, together with suitable internal audit experience.⁴

Independence rules are specific. Individuals from another department of the same organisation, or from a related organisation such as a parent or group affiliate, are not independent. Reciprocal peer reviews between two organisations are not independent, although assessments rotated among three or more peers may be. In the public sector, functions in the same tier of government reporting to the same chief audit executive are not independent of each other. Potential impairments include providing the external audit, assisting the internal audit function, personal relationships, taking part in the function’s internal quality assessments, or advisory work on governance, risk, control or financial reporting.²

Documents to gather

Each standard ends with examples of evidence of conformance, which the IIA says are provided to help functions prepare for quality assessments, “which rely on demonstrative evidence”.² Assemble an evidence pack before the assessor arrives, indexed to the Standards:

• Governance: the current charter and the minutes approving it; records of the Domain III discussion with the board and senior management; independence confirmations; minutes of private sessions with the audit committee; any documented alternatives to essential conditions.
• Strategy and planning: the internal audit strategy; the documented risk assessment behind the plan; the approved plan, budget and resource plan, and approvals of significant changes.
• Methodology: the audit manual and templates, with evidence of when they were last updated and how the team was trained on them.
• Engagements: a list of all engagements in the period, so the assessor can select a sample, plus access to working papers, reports and follow-up records.
• Quality: the quality assurance and improvement programme, ongoing monitoring records, periodic self-assessments and action plans, performance objectives approved by the board and performance reports.
• People: structure chart, job descriptions, qualifications, CPD records and a skills assessment against the plan.
• Reporting: audit committee reports for the period, including the annual opinion or conclusion where one is given, and any documented non-conformance.

If the function is outsourced or co-sourced, agree in advance which documents belong to the provider and which to the organisation, and make sure the assessor can see both.

Stakeholder surveys and interviews

Interviews are central to how an assessor judges contribution and stakeholder expectations. The Standards expect a self-assessment with validation to include interviews with key stakeholders such as board members, senior management and operational management, and periodic self-assessments may interview and survey stakeholders. Separately, Standard 12.2 requires the chief audit executive to seek feedback from the board and senior management when assessing the function’s performance.²

Practical points for preparing this part of the assessment:

• Agree the interview list with the assessor: typically the audit committee chair and members, the chief executive, the finance director, heads of risk and compliance, the external audit engagement lead, a cross-section of auditees and members of the internal audit team.
• Brief interviewees on the purpose and timing, but do not coach them. Assessors can tell when answers have been rehearsed, and candid views are what make the report useful.
• If the assessor runs a survey, keep it short, send it from the assessor rather than internal audit, and give a clear deadline to improve the response rate.
• Make sure audit committee members are ready to talk about their own role. Under Domain III the assessor will be interested in how the board approves the charter and plan, oversees resources and quality, and meets the chief audit executive privately. A short pre-assessment briefing through audit committee training can help.

Common findings and how to address them

The new Standards introduce requirements that many functions did not previously need to evidence. In practice, the gaps below are the ones most likely to surface in a first assessment against the 2024 Standards, and each can be addressed before the assessor arrives.

Likely gap	Standard	How to address it
Charter not updated for the new minimum content	6.2	Redraft to include the Purpose of Internal Auditing, commitment to the Standards, mandate, board expectations and reporting lines; obtain board approval
No record of the Domain III discussion with the board and senior management	Domain III	Hold and minute the discussion; document any agreed alternatives to essential conditions
No documented internal audit strategy	9.2	Prepare a short strategy with vision, objectives and initiatives; review it with the board
Performance objectives not approved by the board	8.3, 12.2	Agree objectives and measures with the audit committee each year
Quality programme limited to file reviews	12.1	Add a periodic self-assessment against every standard and report results annually
Plan does not show consideration of IT governance, fraud risk and compliance and ethics programmes	9.4	Document how each was considered in the risk assessment, including why any is not covered
Reports lack named owners, dates or acknowledgement of actions already taken	15.1	Update the report template and quality checklist
Methodology not updated or team not trained on it	9.3	Update the manual and keep training records
Chief audit executive holds non-audit roles without documented safeguards	7.1	Record the roles and safeguards in the charter and arrange independent assurance over those areas

A further point concerns the conformance statement in your reports. The Standards say a statement that an engagement conformed with the Standards is appropriate only if it is supported by the results of engagement supervision and the quality assurance and improvement programme.² If your quality evidence is thin, the statement is exposed.

After the assessment

The board’s essential conditions under Standard 8.4 continue after fieldwork. The board should receive the complete results directly from the assessor, review and approve the chief audit executive’s action plans, approve a timeline for completing them and monitor progress. Senior management should review the results and agree the action plans and timeline with the chief audit executive and the board.² Under Standard 8.3, the chief audit executive must report external assessment results when completed, covering conformance with the Standards, achievement of performance objectives, any relevant legal or regulatory compliance and plans to address deficiencies.²

Local government audit committees must receive the complete results and consider the action plan, and where the committee lacks delegated authority it should report the overall results to those charged with governance. Authorities are also expected to explain compliance with the CIPFA Code in their annual governance statement.⁵ Public sector functions must describe their conformance as conformance with the Global Internal Audit Standards in the UK Public Sector.⁴

Treat the action plan as part of the internal audit strategy rather than a separate list, track it through your quality programme, and decide with the audit committee whether the next assessment should come sooner than five years. Any significant changes in leadership or methodology are good reasons to bring it forward.

How we can help

We carry out internal audit external quality assessments (EQA), independent validations of self-assessments and pre-assessment readiness reviews against the Global Internal Audit Standards, the Chartered IIA Code and the UK public sector Application Note. Our audit committee and internal audit training prepares boards and teams for their part in the assessment, and we work with public sector and local government bodies on the April 2025 changes. To talk through timing and scope, book a free 20-minute call.

Frequently asked questions

How often is an internal audit EQA required?

The Global Internal Audit Standards require an external quality assessment at least once every five years, carried out by a qualified, independent assessor or team. The board and chief audit executive can decide to assess more often, for example after a change of leadership or methodology. Sector codes in the UK, such as the Chartered IIA Code and CIPFA's local government Code, also refer to the five-year minimum.

What is a self-assessment with independent validation?

It is an alternative to a full external assessment in which the internal audit function carries out a comprehensive, documented self-assessment against the Standards, which a qualified independent assessor then validates. The validator checks that the self-assessment was complete and accurate and usually interviews key stakeholders. The board must approve the reasons for choosing this route.

Who can carry out an external quality assessment of internal audit?

A qualified assessor or team that is independent of the organisation, its internal audit function and related organisations. Under the Global Internal Audit Standards at least one team member must hold an active Certified Internal Auditor designation. In the UK public sector this is replaced by a requirement for at least one person with CMIIA, a CCAB qualification or an equivalent, plus suitable internal audit experience.

References

1. The Institute of Internal Auditors, 16 January 2025. The IIA Celebrates the Effective Date of the Global Internal Audit Standards
2. The Institute of Internal Auditors, 9 January 2024. Global Internal Audit Standards
3. Chartered Institute of Internal Auditors, September 2024 (effective from January 2025). Internal Audit Code of Practice: Principles on effective internal audit in the financial services, private and third sectors
4. Relevant Internal Audit Standard Setters (published by CIPFA), December 2024. Application Note: Global Internal Audit Standards in the UK Public Sector
5. CIPFA, February 2025 (in force from 1 April 2025). Code of Practice for the Governance of Internal Audit in UK Local Government
6. The Institute of Internal Auditors, 5 February 2025. Cybersecurity Topical Requirement
7. The Institute of Internal Auditors, 2024 edition (product page undated). Quality Assessment Manual, 2024 Edition