What is an External Quality Assessment?

An External Quality Assessment (EQA) is an independent assessment of your Internal Audit function per IIA Standard 8.4. It examines the extent to which the standards are achieved, plus maturity and effectiveness. An Internal Audit function that applies the Global Internal Audit Standards must have an External Quality Assessment performed at least once every five years by a qualified, independent assessor or assessment team.

Which ratings does the assessment use?

The Quality Assessment Manual of the IIA uses four ratings: Full Achievement, General Achievement, Partial Achievement and Non-Achievement. We assess against those per principle and per standard, so you see where the function stands and which points need attention, rather than a single summarised verdict.

How long does an External Quality Assessment take?

That depends on the size and complexity of the function. The assessment runs in four phases: scope and engagement letter; document review, interviews and methodology analysis; findings and draft report; final report and presentation to the audit committee and board.

Who performs the EQA?

A senior IIA-accredited reviewer with at least ten years of internal audit experience and hands-on experience as a Chief Audit Executive (CAE), independent of your organisation and of any prior advisory work. ONE Risk Advisory is a partner of IIA Netherlands.

What does an EQA deliver?

A substantiated report for your audit committee, a view of the maturity of the function and a development path. You receive a rating per principle and per standard of the Global Internal Audit Standards, supported by findings, that you can discuss with the board and audit committee.

Is an EQA mandatory for my organisation?

An Internal Audit function that applies the Global Internal Audit Standards has an EQA performed at least once every five years. For listed companies, best practice provision 1.3.2 of the Dutch Corporate Governance Code calls for a periodic assessment by an independent third party (comply or explain). In practice DNB and AFM expect the Standards to be followed. Public sector bodies that apply the Standards also follow Standard 8.4.

External Quality Assessment (EQA) of your internal audit function

An External Quality Assessment (EQA) is an independent assessment of an internal audit function against the Global Internal Audit Standards of the Institute of Internal Auditors (IIA). Standard 8.4 requires such an assessment at least once every five years. ONE Risk Advisory performs EQAs with assessors listed by IIA Netherlands as qualified, and delivers a rating per principle and per standard with an improvement agenda for the board and the audit committee. An EQA is also a moment to reflect on the role, positioning and added value of your internal audit function.

Schedule an EQA intake Our approach

Quality, independence and professionalism

As Chief Audit Executive (CAE) you are the one who arranges the external assessment and who accounts for its outcome to the board and audit committee. That is why we address you first: on scope, planning and an outcome you can explain.

Periodic external assessment is required by professional standards (such as the IIA’s Global Internal Audit Standards) and expected under good governance. Internal supervisory bodies, such as supervisory boards and their audit committees, play an important role in safeguarding the quality and independence of the Internal Audit function.

Specialist support for your function

Since 2012, ONE Risk Advisory has performed more than 200 External Quality Assessments, at listed companies, financial institutions, healthcare institutions and semi-public organisations. ONE Risk Advisory is a specialist provider of External Quality Assessments (EQA). We work exclusively with experienced quality assessors who have in-depth knowledge of internal auditing and professional standards (such as the Global Internal Audit Standards).

We support organisations with, among other things:

conducting EQAs, readiness checks or pre-assessments
assessment against applicable professional standards (such as the Global Internal Audit Standards)
evaluating the positioning, independence and effectiveness of the internal audit function
formulating concrete, achievable recommendations

We are available for both advisory and delivery roles. We can also support the implementation and embedding of improvements arising from external quality assessments carried out by others.

Our approach

How does an EQA by ONE Risk Advisory proceed?

An EQA by ONE Risk Advisory follows four steps.

1. Scope and engagement letter: we set out the scope, the assessment frameworks and the planning, aligned with the meeting calendar of your audit committee.

2. Document review and interviews: we assess the charter, the methodology and a selection of engagement files, and speak with the CAE, the board, the audit committee and the main auditees.

3. Findings and draft report: you receive a rating per principle and per standard with a draft improvement agenda, which we discuss with you for factual accuracy.

4. Final report and board presentation: we present the report to the audit committee and the board.

IIA Global Internal Audit Standards 2024: five domains (Purpose, Ethics & Professionalism, Governing, Managing, Performing) with principles P1 to P15, and the rating scale from the IIA Quality Assessment Manual: Full, General, Partial and Non-Achievement. — IIA Global Internal Audit Standards 2024, a framework of five domains and fifteen principles.

Comparison

EQA, Quality Improvement or Self-Assessment?

Aspect	External Quality Assessment	Quality Improvement	Self-assessment with independent validation (SAIV)
Purpose	Independent assessment of the audit function against the IIA Standards	Targeted improvement, full breadth or a single component	Internal self-assessment with independent validation
Frequency	At least once every five years (mandatory)	Whenever you choose, independent of the EQA cycle	At least once every five years, as a full form of the EQA
Independence	Fully external and independent	Guided by an external specialist	Performed internally, validated externally
Framework	IIA Global Internal Audit Standards 2024, Standard 8.4	Your choice: GIAS or your own improvement goals	GIAS Standard 12.1 and 8.4 (validation)
Lead time	Depends on scope and complexity	Depending on scope	Shorter, depending on scope
Outcome	An independent rating per principle and standard, plus an improvement plan	Concrete improvements in design and delivery	Self-assessment, independently confirmed

EQA on the agenda? Schedule an intake.

In an intake we map your QAIP status and discuss the timing that suits your audit committee.

Schedule an EQA intake