Stay connected: follow us on LinkedIn and explore more at
www.CherryHillAdvisory.com.
.svg)
Subscribe now to join the Risk Register community:
Every internal audit function has to be assessed from the outside at least once every five years. The part that surprises people is that the Standards give you two ways to do it, and the cheaper one is not the lesser one.
A full external quality assessment and a self-assessment with independent validation both satisfy Standard 8.4. They cost different amounts, they put the work in different hands, and they land differently in the boardroom. Choosing between them is a governance decision the Standards now ask your board to sign off on, with reasons.
So the useful question isn't which one is more rigorous. It's which one fits your function right now, and what you give up either way.
Standard 8.4 of the 2024 Global Internal Audit Standards says the external assessment "must be performed at least once every five years by a qualified, independent assessor or assessment team," and then adds the sentence this whole decision turns on: "The requirement for an external quality assessment may also be met through a self-assessment with independent validation."
That sits inside Domain III, Governing the Internal Audit Function, under Principle 8, Overseen by the Board. The placement is the point. Quality is framed as something the board oversees, not something the function administers to itself. Standard 8.3 requires a quality assurance and improvement program with both external and internal assessments, and Standard 12.1 covers the internal side: ongoing monitoring plus periodic self-assessments, with results going to the board and senior management.
Plenty of functions run that internal program well and have still never been assessed by anyone outside the building. Others have a quality program on paper and little else. Either way, the five-year clock is the same, and the Standards became effective on January 9, 2025, so the first cycle under the new framework is already running. Which brings us to what the second route actually is.
A self-assessment with independent validation, or SAIV, is a recognized route to meeting Standard 8.4, and the Standards treat it as one of the two forms of external assessment rather than as a lesser category.
The IIA's own quality services FAQ describes the split this way. In a full-scope EQA, "an independent Assessment Team, led by a qualified experienced and professional Team Leader" does the work. In a SAIV, "the internal audit function performs the 'self-assessment' portion and an external, independent qualified validator reviews the self-assessment portion." Both routes include workpaper reviews, surveys, stakeholder interviews, and a report.
What changes is who carries the load. In a SAIV your team completes the assessment work programs, evaluates conformance, and writes it up. The validator then reviews the planning, re-performs a sample of the work, interviews the board and executives, and tests whether your conclusions hold. The IIA is direct about why one costs less than the other: in a SAIV the function does most of the work itself.
The assessor's qualification does not change either. Standard 8.4 requires that "at least one person holds an active Certified Internal Auditor designation" whichever route you take. A validator is an assessor who is validating your work instead of doing it.
Which raises the obvious question: if both routes satisfy the Standard, what does the full version actually buy you?
A full external quality assessment brings a reference point the function cannot give itself. A qualified assessment team has seen how comparable audit functions operate across industries and sizes, and it calibrates your function against that, not just against the Standards on paper.
The IIA's own guidance on the self-assessment route notes that it normally gives limited attention to benchmarking, review, and consultation on successful internal audit practice. That is the trade. A SAIV tells you and your board whether you conform. A full EQA also tells you where you sit relative to peers, which is the finding that carries weight in a resourcing conversation.
There is a credibility difference too. When the chief audit executive reports that the function conforms with the Standards, the audit committee weighs that statement differently when a third party did the fieldwork than when the function assessed itself and had it checked. They carry different amounts of independent weight, and your board will notice.
Under the 2024 Standards that same board has to approve which route you took. That is the next thing to get right.
Standard 8.4 puts the decision on the board's desk, and it does not leave it as a formality. The board's essential conditions include reviewing and approving the chief audit executive's plan for the external assessment, and that approval covers, at a minimum, "the scope and frequency of assessments," "the competencies and independence of the external assessor or assessment team," and "the rationale for choosing to conduct a self-assessment with independent validation instead of an external quality assessment."
If you choose the SAIV route, the Standards expect a written rationale that your board has seen and approved. "It was cheaper" is a reason, but it is not the reason you want minuted.
The board also has to "require receipt of the complete results of the external quality assessment or self-assessment with independent validation directly from the assessor." The report goes to the audit committee unfiltered, whichever route you take. If your instinct was that a SAIV keeps the findings closer to home, the Standards closed that door.
Would your audit committee chair be able to explain, in one sentence, why your function chose the route it did? If not, that conversation belongs before the assessment starts, not after the report lands.
A SAIV fits a function that already runs a mature quality program, has a recent full EQA behind it, and needs to satisfy the five-year requirement without diverting a large budget to an outside team. It also suits smaller functions, where a full-scope engagement is out of proportion to the audit plan, and functions with a stable team and methodology since the last assessment.
The full EQA is the better call in the opposite conditions. A first assessment under the 2024 Standards, where the framework itself moved and you want an outside read on how you map to it. A function with turnover in the chief audit executive seat or the methodology. A regulated industry where external oversight of internal audit is part of the supervisory conversation. And any situation where the board's real question is not "do we conform" but "how do we compare," because a SAIV is not built to answer that.
A useful test: if you already know what the findings will be, a SAIV validates them efficiently. If you don't, you want a team that will go looking.
Whichever route you take, the scope has grown since the last cycle. Two additions in particular catch functions off guard, so let's take them next.
The IIA states on its Topical Requirements page that "quality assessments conducted after the effective date will assess conformance with effective Topical Requirements." The Cybersecurity Topical Requirement has been in effect since February 5, 2026. The Third-Party Topical Requirement becomes effective September 15, 2026, Organizational Behavior on December 15, 2026, and Organizational Resilience on April 30, 2027. Each one becomes effective 12 months after it is issued, so the list your assessor tests against depends on when the assessment happens.
The second addition is quieter. Standard 9.2 requires the chief audit executive to "develop and implement a strategy for the internal audit function" that "must include a vision, strategic objectives, and supporting initiatives," reviewed with the board and senior management periodically. This is a new, explicit requirement in the 2024 Standards, and in our experience it is the one most functions have not written down. An assessor, or a validator, will ask to see it.
Both of these apply whether you run a full EQA or a SAIV. What differs is who has to notice the gap first: in a SAIV, that's you.
The Standards set the floor: a qualified, independent assessor or team, with at least one active CIA. The IIA's quality services FAQ goes further on what "qualified" means in practice, listing experience as a chief audit executive or comparable senior role, experience in your industry, prior external quality assessment work, completion of IIA-recognized assessment training, and an attestation of no conflicts of interest.
In addition to what is dictated, a few things separate an assessment worth paying for from an expensive exercise in confirmation. How the team applies the Standards to your function rather than reading them at you. Whether their experience is broad enough to place you against real peers. Whether they take the time to understand what your function is for, and treat the engagement like a management consulting exercise with an opinion at the end, not a checklist with a signature.
Full stop: an assessment that tells you everything is fine without benchmarking you against anything has told you very little.
Our own sequence reflects that view. We start with a self-assessment, run a structured gap assessment against the 2024 Standards before any formal opinion is on the line, and only then move to the external quality assessment. The gaps get closed on your timeline rather than discovered in the report. If you are weighing a full EQA against a SAIV, or you are unsure which one your board would approve, our external quality assessment services cover both routes, and we have written before about how to get ready for an EQA. Reach out and we'll work through the choice with you.
The next disruption to the profession, whatever form it takes, will find the functions with a current, board-approved assessment in a far better position than the ones still deciding which kind to have.
Subscribe now to join the Risk Register community:
.jpeg)
