Stay connected: follow us on LinkedIn and explore more at
www.CherryHillAdvisory.com.
.svg)
Subscribe now to join the Risk Register community:
Most internal audit functions know they're supposed to have an External Quality Assessment (EQA) every five years. Fewer know what one actually covers when it's done well. The gap between checking the box and running a real assessment is wider than most people expect, and the audit committee usually can't tell the difference until something goes wrong.
If your function is preparing for one, or deciding whether to commission one, this is what you should expect the work to include.
An EQA evaluates whether the internal audit function conforms with the International Standards for the Professional Practice of Internal Auditing, published by the Institute of Internal Auditors (IIA). In practice, it's a structured, independent review of how the function operates, how it plans its work, how it communicates results, and how the CAE and team are positioned to deliver value to the organization.
Conformance with IIA Standards signals to the board, the audit committee, and senior leadership that the function is operating with professional discipline. A well-executed EQA tells you whether internal audit is set up to do what the organization needs it to do, and where the gaps are before someone else finds them.
Boards expect more from internal audit in 2026 than they did five years ago. They want assurance on AI governance, cybersecurity risk, third-party exposure, and ESG controls, sometimes all at once. An EQA that only checks whether the function follows the Standards is too narrow to be useful.
The IIA Standards framework is the place to start if you want to understand what a rigorous external quality assessment demands.
Conformance ratings under the IIA Standards come in three categories: Generally Conforms, Partially Conforms, or Does Not Conform. Those ratings are the required output of any external assessment. A serious EQA also looks well beyond them.
A rigorous assessment looks at operational effectiveness, meaning whether the function delivers what the organization needs. That covers audit methodology, risk assessment processes, stakeholder relationships, team capabilities, use of technology, and the quality of communication to the audit committee.
The IIA's mandatory guidance, including the Global Internal Audit Standards (GIAS) that took effect in January 2025, outlines what conformance means. But the most useful EQAs go further, benchmarking the function against peer organizations and giving the CAE a specific improvement roadmap.
A useful assessment scope covers six areas of the internal audit function.
Six areas appear in every well-structured EQA, and each one gives the organization a different view of how the internal audit function is performing.
Governance and independence: Does the function have the right structural position in the organization? Is the CAE reporting to the right level? Are there independence impairments that could limit objectivity?
Risk-based audit planning: Is the audit plan genuinely tied to the organization's risk profile, or is it a recycled list of last year's audits? Does the planning process engage senior leadership and the audit committee?
Audit execution and methodology: Are audits scoped and performed with professional rigor? Is the work documented in a way that supports the conclusions drawn?
Communication and reporting: Do audit reports communicate findings clearly? Is the content calibrated to the right audience, from process owners to the audit committee?
People, skills, and technology: Does the team have the capabilities to audit what it's being asked to cover? Are emerging areas like AI, cybersecurity, and third-party risk staffed with relevant expertise or co-sourced effectively?
Quality assurance and improvement: Does the function have an internal quality program? Are results being measured and used to drive improvement?
Looking at the findings across all six areas together gives the clearest picture of the function. A function can have strong methodology and weak governance positioning, or excellent reporting paired with a risk-based planning process that hasn't been updated in three years.
Whether those findings are useful depends a lot on who runs the assessment.
The quality of an EQA depends heavily on who runs it. The IIA requires that assessors be independent of the function being assessed and competent in both internal audit practices and the relevant industry.
In practice, a credible assessor brings hands-on internal audit experience as well as knowledge of the Standards. The ACFE's 2024 Report to the Nations found that organizations with strong internal audit functions lose significantly less to fraud than those without, so the person assessing the function needs to know what a strong function looks like.
An assessor who has run internal audit departments, worked with audit committees, and co-sourced specialized expertise on live engagements sees things that a reviewer who only reads documentation will miss. That experience usually shows up as sharper findings and a more realistic improvement roadmap, and the audit committee tends to give the conclusions more weight.
The assessor's practitioner background matters as much as the methodology they use. Ask about it before you sign any engagement letter.
Once the assessor is in place, it helps to know what the final EQA report should deliver to the people who commissioned it.
The final EQA report is a formal deliverable to the audit committee and, typically, to senior leadership. It includes conformance ratings against each applicable IIA Standard, findings organized by theme or domain, root-cause analysis for significant gaps, and a prioritized set of recommendations.
The best reports organize their observations into a clear plan for improvement. The audit committee needs to know what to do with the findings, and how the CAE plans to respond to them. A report that produces a conformance rating but leaves the audit committee unsure of next steps has not done its job.
Most EQA reports also include a management response section, where the CAE formally acknowledges each finding and commits to a remediation timeline. This structure creates accountability and gives the audit committee a baseline to track progress against in subsequent meetings.
The report should also be written for its main reader, the audit committee. If the board needs internal audit shorthand explained to it, the report has missed that audience.
How often an assessment is required also affects how much lead time the function has to get the report right.
The IIA's Global Internal Audit Standards require that every internal audit function complete an external quality assessment at least once every five years. That five-year requirement is a minimum. Functions going through significant change, such as new CAE leadership, a major expansion of scope, or material findings from regulators, should consider an assessment sooner.
We often see organizations that are three years past their last EQA without the audit committee raising it. Nobody is actively tracking the five-year requirement, and the CAE has been focused on delivering audits. By the time the next assessment is commissioned, the function has changed enough that the previous one is essentially irrelevant.
If you aren't sure when your five-year deadline falls, check now and start planning at year three. Selecting the assessor, aligning on scope, and scheduling interviews with audit committee members and senior leadership takes longer than most teams expect.
The most useful way to approach an external quality assessment is as a chance to build capability. The IIA Standards require the assessment, but the reason to do it well is that it gives the CAE an independent view of the function that internal teams can't generate for themselves.
Internal audit gives the organization independent assurance, and the EQA gives that same kind of assurance about internal audit. A function that hasn't been assessed externally in more than five years is relying on its own judgment about its own quality. Internal audit would flag that arrangement in any other part of the organization.
Seeing the EQA this way also changes how CAEs approach it. Rather than managing the assessment defensively, they use it to make the case for resources, technology investment, or expanded scope. A strong EQA report from a credible assessor gives the CAE support in audit committee conversations that would otherwise take a lot more persuasion.
That's the kind of external quality assessment worth commissioning: one that advances the function's standing and effectiveness in the organization.
If you're planning your next EQA or evaluating whether your function is positioned to meet evolving audit committee expectations, reach out to the Cherry Hill Advisory team.
Our external quality assessment work is designed for internal audit functions working under the 2025 Global Internal Audit Standards and growing board-level expectations.
Learn more about how Cherry Hill co-sources specialized internal audit expertise for internal audit teams.
Subscribe now to join the Risk Register community:
