What is an External Quality Assessment?

An External Quality Assessment (EQA) is an independent assessment of your Internal Audit function per IIA Standard 8.4. It examines the extent to which the standards are achieved, plus maturity and effectiveness. An Internal Audit function that applies the Global Internal Audit Standards must have an External Quality Assessment performed at least once every five years by a qualified, independent assessor or assessment team.

Which ratings does the assessment use?

The Global Internal Audit Standards use four ratings: Full Achievement, General Achievement, Partial Achievement and Non-Achievement. We assess against those per principle and per standard, so you see where the function stands and which points need attention, rather than a single summarised verdict.

How long does an External Quality Assessment take?

That depends on the size and complexity of the function. The assessment runs in four phases: scope and engagement letter; document review, interviews and methodology analysis; findings and draft report; final report and presentation to the audit committee and board.

Who performs the EQA?

A senior IIA-accredited reviewer with at least ten years of internal audit experience and hands-on experience as a Chief Audit Executive (CAE), independent of your organisation and of any prior advisory work. ONE Risk Advisory is a partner of IIA Netherlands.

What does an EQA deliver?

A substantiated report for your audit committee, a view of the maturity of the function and a development path. You receive a rating per principle and per standard of the Global Internal Audit Standards, supported by findings, that you can discuss with the board and audit committee.

Is an EQA mandatory for my organisation?

An Internal Audit function that applies the Global Internal Audit Standards has an EQA performed at least once every five years. For listed companies, best practice provision 1.3.2 of the Dutch Corporate Governance Code calls for a periodic assessment by an independent third party (comply or explain). In practice DNB and AFM expect the Standards to be followed. Public sector bodies that apply the Standards also follow Standard 8.4.

External Quality Assessment (EQA) of your internal audit function

An External Quality Assessment is also a moment to reflect on the role, positioning and added value of your internal audit function within the organisation.

Schedule an EQA intake Our approach

Quality, independence and professionalism

As Chief Audit Executive (CAE) you are the one who arranges the external assessment and who accounts for its outcome to the board and audit committee. That is why we address you first: on scope, planning and an outcome you can explain.

Periodic external assessment is required by professional standards (such as the IIA’s Global Internal Audit Standards) and expected under good governance. Internal supervisory bodies, such as supervisory boards and their audit committees, play an important role in safeguarding the quality and independence of the Internal Audit function.

Specialist support for your function

ONE Risk Advisory is a specialist provider of External Quality Assessments (EQA). We work exclusively with experienced quality assessors who have in-depth knowledge of internal auditing and professional standards (such as the Global Internal Audit Standards).

We support organisations with, among other things:

conducting EQAs, readiness checks or pre-assessments
assessment against applicable professional standards (such as the Global Internal Audit Standards)
evaluating the positioning, independence and effectiveness of the internal audit function
formulating concrete, achievable recommendations

We are available for both advisory and delivery roles. We can also support the implementation and embedding of improvements arising from external quality assessments carried out by others.

Our approach

Broad expertise

Our EQAs are carried out by professionals with extensive experience in internal auditing and external quality assessments. They understand the governance and supervisory context in which external quality assessments take place and communicate clearly with heads of Internal Audit, boards, supervisory boards and their audit committees.

Thanks to their broad experience, they are also able to benchmark and share relevant good practices, appropriate to the nature and size of the organisation.

IIA Global Internal Audit Standards 2024: five domains (Purpose, Ethics & Professionalism, Governing, Managing, Performing) with principles P1 to P15, and the rating scale Full, General, Partial and Non-Achievement. — IIA Global Internal Audit Standards 2024, a framework of five domains and fifteen principles.

Comparison

EQA, Quality Improvement or Self-Assessment?

Aspect	External Quality Assessment	Quality Improvement	Self-assessment with independent validation (SAIV)
Purpose	Independent assessment of the audit function against the IIA Standards	Targeted improvement, full breadth or a single component	Internal self-assessment with independent validation
Frequency	At least once every five years (mandatory)	Whenever you choose, independent of the EQA cycle	Interim, often in the years between two EQAs
Independence	Fully external and independent	Guided by an external specialist	Performed internally, validated externally
Framework	IIA Global Internal Audit Standards 2024, Standard 8.4	Your choice: GIAS or your own improvement goals	GIAS Standard 12.1 and 8.4 (validation)
Lead time	Depends on scope and complexity	Depending on scope	Shorter, depending on scope
Outcome	An independent rating per principle and standard, plus an improvement plan	Concrete improvements in design and delivery	Self-assessment, independently confirmed

EQA on the agenda? Schedule an intake.

In an intake we map your QAIP status and discuss the timing that suits your audit committee.

Schedule an EQA intake