External Quality Assessment (EQA)
An independent assessment by an external, qualified assessor or assessment team of the internal audit function's conformance with the International Professional Practices Framework (IPPF), including the Code of Ethics, Core Principles, and IIA Standards. EQAs must be performed at least once every five years.
Source: IIA GIAS 2024, Standard 8.4
An External Quality Assessment (EQA) is an independent review of your internal audit function against the Global Internal Audit Standards (GIAS) 2024 of the Institute of Internal Auditors (IIA). The Standards require every function to undergo an external assessment at least once every five years (Standard 8.4, formerly Standard 1312 of the IPPF). An EQA evaluates whether the function conforms to the Standards and, just as important, whether it genuinely adds value for the board, the supervisory board and the audit committee.
The assessment covers the full breadth of the function: its mandate and charter, independence and positioning, the competencies of the team, the audit methodology and the quality assurance program. The assessor tests not only the design but also how it works in practice, drawing on engagement files, stakeholder interviews and a comparison with good practice in the market.
The outcome is a conformance rating at three levels, generally conforms, partially conforms or does not conform, together with a substantiated improvement agenda. Generally conforms is the highest rating and means the relevant Standards are consistently met. The result gives the audit committee well-founded assurance about the quality of the function and a concrete starting point for improvement.
An EQA must be performed by a qualified, independent assessor from outside the organisation. The assessor may have no stake in the outcome and holds demonstrable audit experience and knowledge of the Standards. A widely used alternative is the self-assessment with independent validation (SAIV), in which the function assesses itself and an external party validates that self-assessment.
ONE Risk Advisory performs EQAs independently, with a report aligned to the Global Internal Audit Standards 2024 and concrete improvement points for the audit plan, governance and added value. Our partners are IIA-accredited for quality assessments and have assessed functions at organisations including ASML, Heineken, Royal Philips and TVM.
Last updated:
Related service External Quality Assessment (EQA)
Frequently asked questions
Is an External Quality Assessment mandatory?
For functions that claim conformance with the Global Internal Audit Standards, yes. Standard 8.4 requires an external assessment at least once every five years. For many organisations it is also an expectation under the corporate governance code and, in financial services, from supervisors such as De Nederlandsche Bank (DNB).
How often must an EQA take place?
At least once every five years. Between two external assessments the function should maintain an ongoing quality assurance program, including periodic internal assessments.
Who may perform an EQA?
A qualified, independent assessor from outside the organisation, with no stake in the outcome and demonstrable knowledge of the Standards. This may be an individual assessor or a team.
What is the difference between an EQA and a self-assessment with independent validation?
In a full EQA the external assessor performs the entire review. In a self-assessment with independent validation (SAIV) the function assesses itself and an external party validates that self-assessment. Both satisfy Standard 8.4; the choice depends on the size and maturity of the function.