How should internal audit prepare for an external quality assessment?

Which parts of the function will the assessor examine?

An external quality assessment tests the whole internal audit function for conformance with the Global Internal Audit Standards. Under the guidance to Standard 8.4, the review should cover the mandate, charter, strategy, methodologies, risk assessment and audit plan of the function, its compliance with laws and regulations, and its performance measures. The review also looks at the competence of the people in the function and of the head of internal audit, whom the Standards call the chief audit executive, at how the function fits into the governance of the organisation, and at whether it meets the expectations of the board, senior management and other stakeholders.

Assessors now also check the Topical Requirements of the Institute of Internal Auditors (IIA). Each Topical Requirement becomes mandatory for assurance work on its topic 12 months after it is issued, and a quality assessment checks those in force during its period. The cybersecurity requirement applies from 5 February 2026, third-party from 15 September 2026, organisational behaviour from 15 December 2026 and organisational resilience from 30 April 2027.

The quality guidance from the IIA asks assessors to review the risk-based internal audit plan and judge whether those requirements were appropriately applied. A function can start from the same place, listing each engagement on cybersecurity or third parties since the relevant requirement applied and checking that its file shows the requirement was followed.

In the UK, the Chartered Institute of Internal Auditors says assessment providers will also benchmark against its Internal Audit Code of Practice. The review ends in a rating, and the quality guidance from the IIA says a function is in full conformance with the Standards only after a quality assessment rated Full Achievement or General Achievement.

What should already be written down and in use?

Every function needs an internal audit strategy (Standard 9.2), established methodologies (Standard 9.3), objectives for measuring its performance (Standard 12.2) and a quality assurance and improvement programme covering the whole function (Standard 8.3), each of them written down and in use. In a smaller function none of them needs to be long.

A periodic self-assessment shortly before the external one is worth scheduling, since Standard 12.1 notes that it may reduce the time and effort the external assessment takes. The self-assessment is also where a gap analysis against the current Standards fits.

A gap analysis matters most to a function last assessed under the previous Standards, which the current ones replaced on 9 January 2025. Until its five years are up, the quality guidance from the IIA lets such a function keep describing its work as conforming with the current Standards. Engagement supervision and its quality programme must support that claim, and any gap analysis must have found no material discrepancies. The function must also commit to a full external assessment, or a validated self-assessment, within the five years.

Who should carry out the assessment?

A qualified, independent assessor or assessment team should carry out the assessment, by either of the routes Standard 8.4 allows: a full external assessment, or validation of a comprehensive, fully documented self-assessment, confirming that it was carried out completely and accurately. At least one member of the team must hold an active Certified Internal Auditor designation, a rule the previous Standards did not have.

The guidance lists further qualifications to weigh, among them senior internal audit leadership, sector experience, previous quality assessments, assessment training the IIA recognises and an attestation of no conflict of interest.

Independence rules out anyone inside the organisation or its group. The guidance to Standard 8.4 excludes people from another department of the same organisation, from a parent company or an affiliate in the same group, and from a body with oversight of it. A reciprocal review between two organisations does not count either, although a rotation among three or more peers may.

The head of internal audit should also weigh past, present or anticipated future relationships with the organisation. Examples in the Standards include external audit of the financial statements, assistance to the internal audit function, personal relationships and advisory services on governance, risk management, control or financial reporting. For an audit committee chair, the practical question is whether the assessor has any reason to go easy on the function.

What should the audit committee approve?

The audit committee should approve the plan for the assessment, which Standard 8.4 expects to cover at least its scope and frequency, the competence and independence of the assessor, and any reason for choosing a self-assessment.

The same standard also expects the board, which in the Standards can mean an audit committee, to:

• discuss the plan for the assessment with the head of internal audit
• settle its scope and frequency with senior management and the head of internal audit
• require the complete results directly from the assessor
• approve the action plans and a timeline for them, and monitor progress

The Standards frame these as “essential conditions” for the board rather than requirements. If the board does not meet one of them and the head of internal audit does not accept its reasons, the Standards allow the conclusion that the function cannot conform.

The Code of Practice goes further for UK organisations that follow it. Under it, the audit committee should obtain an external assessment whatever the size of the organisation, include conformance with the Code itself, and have its chair oversee and approve how the assessor is appointed.

Separately, before fieldwork starts, the committee should ask to see how the audit plan applies the Topical Requirements in force.

Each source opens in a new tab.

• The Institute of Internal Auditors, Global Internal Audit Standards, published 9 January 2024: Domain III introduction and definition of board; Standards 8.3, 8.4 (requirements, essential conditions and considerations), 9.2, 9.3, 12.1 and 12.2 (the Standards in full, PDF)
• The Institute of Internal Auditors, Standards page (effective date, 9 January 2025), checked 29 September 2026
• The Institute of Internal Auditors, “The IIA Celebrates the Effective Date of the Global Internal Audit Standards”, press release, 16 January 2025
• The Institute of Internal Auditors, Topical Requirements, with the Cybersecurity, Third-Party, Organizational Behavior and Organizational Resilience pages (issue and effective dates), checked 1 October 2026
• The Institute of Internal Auditors, Internal Audit Quality Assurance FAQs, quoting the Quality Assessment Manual, 2024 edition (plan review, ratings, conformance statements after an assessment under the previous Standards), checked 29 September 2026
• The Institute of Internal Auditors, Implementation Guide 1312, External Assessments (the previous Standards, effective 1 January 2017; cited for the point that they had no Certified Internal Auditor rule)
• Chartered Institute of Internal Auditors, Internal Audit Code of Practice, September 2024, effective from January 2025: foreword (p.2) and Principle 34 (p.11)