What is an External Quality Assessment (EQA) and How to Get Ready: A Simple Guide for Internal Auditors

As internal audit professionals in the UK, we're all committed to doing the best job we can. We strive for excellence, provide valuable insights, and help our organisations achieve their goals. But how do we know we're truly hitting the mark? That's where an External Quality Assessment, or EQA, comes in.

Think of an EQA as a health check for your internal audit team. It's a way to get an independent, expert opinion on how well your internal audit function is operating and whether it's following best practices. The Institute of Internal Auditors (IIA) sets the standards for internal audit globally, and they have a clear definition of what an EQA entails.

So, what exactly is an External Quality Assessment according to the IIA? Simply put, an EQA is an independent review of your entire internal audit activity. This review is conducted by a qualified team or individual from outside your organisation. They come in with fresh eyes and assess how well your internal audit team is:

• Meeting the IIA's International Standards for the Professional Practice of Internal Auditing. These standards are the benchmark for how internal audit should be carried out. The EQA will check if your team's processes and work align with these guidelines.

• Operating effectively and efficiently. The reviewers will look at how well your team is organised, how you plan your audits, how you communicate your findings, and whether you're using your resources wisely.

• Adding value to the organisation. Ultimately, internal audit exists to help the organisation improve. The EQA will assess whether your work is relevant, impactful, and contributes to achieving the organisation's objectives.

• Adhering to your internal audit charter, policies, and procedures. This ensures that your team is following the rules and guidelines you've set for yourselves.

Why is an EQA important? An EQA isn't just a tick-box exercise. It offers several key benefits:

• Provides an independent and objective view: An external team can offer insights that you might miss internally.

• Identifies areas for improvement: The assessment will highlight what you're doing well and where you could enhance your practices.

• Enhances credibility: A positive EQA can boost the confidence stakeholders (like the board and senior management) have in your internal audit function.

• Ensures compliance: It helps confirm that you're meeting the internationally recognised standards for internal audit.

• Drives continuous improvement: The recommendations from an EQA can help you develop a roadmap for making your internal audit team even better.

Okay, so an EQA sounds important. How do we, as an internal audit team, prepare for one? Receiving an EQA doesn't need to be a stressful experience. With good preparation, it can be a valuable opportunity for growth. Here's a step-by-step guide to help you get ready:

1. Understand the Timeline: As soon as you know an EQA is on the horizon (usually required at least every five years by the IIA), start planning. Discuss the potential timeframe with senior management and agree on a realistic schedule.

2. Review Your Documentation: This is crucial. The EQA team will want to see evidence of how you operate. Gather and organise key documents, including:

   • Your internal audit charter.

   • Your internal audit plan (both strategic and annual).

   • Your risk assessment framework.

   • Your audit methodology and procedures.

   • Sample audit files (from planning to reporting and follow-up).

   • Your quality assurance and improvement program (QAIP) documentation and any self-assessments you've conducted.

   • Your team's structure, roles, and responsibilities.

   • Any relevant policies or guidelines.

3. Conduct a Self-Assessment: Before the external team arrives, take a good look at your own practices against the IIA Standards. Be honest about your strengths and weaknesses. This will not only help you identify areas to focus on but also demonstrate to the EQA team that you're proactive about quality.

4. Engage with Stakeholders: The EQA team will likely want to speak to key stakeholders, such as the audit committee, senior management, and auditees. Make sure these individuals are aware of the EQA and understand its purpose. Prepare them for potential interviews by outlining the kind of questions they might be asked (e.g., their perception of internal audit's value, their interaction with the team).

5. Be Organised and Accessible: When the EQA team is on-site (or conducting the review remotely), make sure they have easy access to the information and people they need. Designate a point of contact within your team to coordinate their requests and answer their questions.

6. Communicate Openly and Honestly: Be transparent with the EQA team. If there are challenges or areas where you know you need to improve, don't try to hide them. Open communication will lead to more constructive feedback.

7. Embrace the Feedback: The EQA report will contain recommendations for improvement. View these as opportunities to enhance your internal audit function. Discuss the findings as a team and develop an action plan to address the recommendations.

8. Follow Up: Once you've received the report, don't let it gather dust. Track your progress in implementing the agreed-upon actions and report back to the audit committee and senior management. This demonstrates your commitment to continuous improvement.

In Conclusion:

An External Quality Assessment, as defined by the IIA, is a vital process for ensuring the effectiveness and credibility of your internal audit function. While it might seem daunting, with thorough preparation and a positive mindset, it can be a valuable opportunity to learn, grow, and ultimately provide even greater value to your organisation. By understanding what an EQA entails and proactively preparing for it, you can navigate this process smoothly and demonstrate your team's commitment to excellence.