An external quality assessment is not something you prepare for in the weeks before it starts. The audit functions that get the most out of the process have been preparing for years — whether they knew it or not.
The IIA requires that internal audit functions undergo an external quality assessment at least once every five years. For many functions, the EQA cycle is the primary driver of quality improvement activity. That is both understandable and worth reconsidering.
What an External Quality Assessment Actually Evaluates
An EQA assesses the internal audit function's conformance with the IIA's International Standards for the Professional Practice of Internal Auditing, the effectiveness of the function in fulfilling its mission, and the quality of its work products and processes.
The assessor will review documentation, conduct interviews with the chief audit executive, audit staff, and key stakeholders, and examine a sample of completed audit engagements. The result is a report that rates the function's conformance with IIA standards and identifies areas for improvement.
Conformance ratings fall into three categories: Generally Conforms, Partially Conforms, and Does Not Conform. A rating of Generally Conforms across all standards is the benchmark most audit committees and boards expect.
The Most Common Preparation Mistakes
Starting too late. Preparation that begins six months before the EQA is reactive. The documentation gaps, process inconsistencies, and staff knowledge issues that surface during that preparation window are the same issues that have been present for years. Addressing them under time pressure produces compliance artifacts, not genuine improvement.
Treating it as a documentation project. An EQA assessor is not just reviewing what is written down. They are evaluating whether the function operates the way its documentation says it does. Inconsistencies between policy and practice are among the most common findings in external quality assessments.
Underestimating the stakeholder interview component. The assessor will speak with the audit committee, senior management, and key business stakeholders — not just audit staff. How those stakeholders describe the audit function's value, responsiveness, and independence matters. If the function has not been actively managing those relationships, the EQA is not the time to discover the gaps.
What Genuine EQA Readiness Looks Like
Audit functions that consistently achieve strong EQA results share several characteristics.
They maintain an active QAIP that includes ongoing monitoring of engagement quality, not just periodic self-assessments. They document their methodology consistently and can demonstrate that staff follow it. They have a clear audit charter that is reviewed and approved by the audit committee on a regular basis. And they have a track record of communicating findings and recommendations in a way that stakeholders find credible and actionable.
EQA readiness is not a project. It is the cumulative result of operating with discipline and consistency over time.
How to Use an EQA Constructively
The most valuable outcome of an external quality assessment is not the conformance rating. It is the independent perspective on how the function is operating relative to leading practices.
Audit functions that approach the EQA as a learning opportunity — rather than a compliance exercise — tend to use the findings to make meaningful changes to how they operate. Those that approach it as a box to check tend to address the findings on paper and return to their existing practices.
LH Consulting Group conducts external quality assessments for internal audit functions and small consulting firms, and provides EQA readiness support for functions that want to close gaps before the assessment begins. Our approach is built on IIA standards and designed to give audit committees and chief audit executives an honest, credible view of where their function stands.