Skip to main content
Governance Authority
Category: Internal Audit and Assurance

External Quality Assessment

Also known as: EQA, External Quality Assessment Schemes, EQAS, external assessment
Simply put

In the internal audit context, an External Quality Assessment is a review of an internal audit function carried out by an independent party from outside the organization to evaluate how well the function is performing against professional standards and expectations. It helps confirm whether the audit function is operating effectively and identifies where it can improve. The same term is also used in a separate laboratory and clinical testing context, where it describes methods for comparing a laboratory's testing results against an outside source.

Formal definition

For internal audit, an External Quality Assessment is an independent evaluation of an internal audit activity conducted by a qualified, independent assessor or assessment team from outside the organization, generally to appraise the function's conformance with applicable professional standards and its overall effectiveness. Practitioner guidance addresses the frequency, types, and preparation practices associated with an EQA, and professionals typically prepare in advance to support a credible assessment. The term is distinct from its usage in the clinical and laboratory field, where EQA (also referred to as external quality assessment schemes, or EQAS) denotes a method that compares a laboratory's testing to an external source in order to examine and manage the effectiveness of the laboratory's quality management. The specific standards, required frequency, assessor qualifications, and scope applicable to any given EQA depend on the governing framework, sector, and the professional judgment of those involved; this entry is educational and not audit, legal, or compliance advice.

Why it matters

For internal audit functions, an External Quality Assessment provides independent confirmation that the function is operating effectively and in conformance with applicable professional standards. Because internal audit exists to give the board, its audit committee, and management objective assurance, the credibility of that assurance depends in part on the audit function itself being subject to periodic independent scrutiny. An EQA helps demonstrate to those charged with oversight that the assurance they rely on is soundly based, while also surfacing opportunities for the function to improve its practices.

An EQA also supports the independence and standing of the internal audit activity. A review conducted by a qualified party from outside the organization carries a weight that self-assessment alone typically cannot, particularly when stakeholders question whether the audit function is appropriately resourced, positioned, and performing to expectation. The specific standards against which conformance is measured, the required frequency of assessment, and the qualifications expected of an assessor depend on the governing framework, sector, and professional judgment, so the value and design of any EQA should be considered in that context.

A note of caution on terminology: the acronym EQA is also used in an entirely separate clinical and laboratory testing context, where external quality assessment schemes compare a laboratory's testing results against an external source to examine and manage the effectiveness of the laboratory's quality management. That usage is unrelated to internal audit assurance, and readers should confirm which sense is intended before applying any of the practices described here.

Who it's relevant to

Chief Audit Executives and Internal Audit Leaders
Those who lead the internal audit function are typically responsible for arranging an EQA, preparing the function for independent review, and acting on the findings. Practitioner guidance and self-study resources focus on how to prepare for an EQA and understand its frequency, types, and associated practices.
Audit Committees and Boards
As the parties charged with oversight of the internal audit function, audit committees and boards generally rely on EQA results to gain independent confirmation that the assurance they receive is credible and that the function conforms with applicable professional standards. The specifics they should expect depend on the governing framework and sector.
Internal Audit Practitioners
Individual auditors within the function are often involved in preparing for and supporting an EQA. Understanding what the assessment evaluates helps them align their day-to-day practices with the professional standards against which the function will be measured.
External Assessors and Assessment Teams
Qualified, independent parties from outside the organization conduct the EQA, evaluating the internal audit activity's conformance with applicable standards and its overall effectiveness. The qualifications expected of assessors depend on the governing framework and the scope of the engagement.
Clinical and Laboratory Quality Professionals (Distinct Context)
In the separate laboratory field, professionals managing testing quality use EQA or EQAS to compare their laboratory's testing to an external source and to examine and manage the effectiveness of their quality management systems. This usage is unrelated to internal audit assurance.

Inside EQA

Independent Assessor or Team
An External Quality Assessment (EQA) is conducted by a qualified, independent reviewer or team from outside the organization to evaluate the internal audit function. Independence from the function being assessed is central to the credibility of the result.
Conformance Evaluation Against Professional Standards
The assessment typically evaluates the internal audit activity's conformance with recognized professional standards and its charter. Under the framework promulgated by the Institute of Internal Auditors, an EQA is generally expected at least once every five years, though specific obligations depend on whether an organization has adopted those standards.
Assessment of Efficiency and Effectiveness
Beyond conformance, an EQA generally examines the effectiveness and efficiency of the internal audit function, including how well it adds value and meets the expectations of the board, audit committee, and senior management.
Two Delivery Approaches
An EQA is commonly delivered either as a full external assessment by an independent third party, or as a self-assessment with independent external validation. The appropriate approach depends on the organization's circumstances and the judgment of those charged with governance.
Reporting to the Board or Audit Committee
Results are typically communicated to senior management and the board or its audit committee, reflecting the board's oversight responsibility for the internal audit function, distinct from management's operational role.

Common questions

Answers to the questions practitioners most commonly ask about EQA.

Is an external quality assessment (EQA) the same as an external audit of the financial statements?
No. An EQA in this context typically refers to an independent evaluation of an internal audit function's conformance with recognized professional standards and its overall effectiveness, not an audit of the organization's financial statements. The two serve different purposes and involve different assessors: a financial statement audit is generally performed by the external auditor and provides assurance on the financial reporting, whereas an EQA evaluates the quality of the internal audit activity itself. Confusing the two can obscure where accountability sits, so it is important to keep the scope of each distinct.
Does passing an EQA mean the internal audit function has a clean bill of health and no work to do?
Not necessarily. An EQA generally assesses conformance with applicable professional standards and may identify both strengths and opportunities for improvement; a favorable conclusion typically indicates that the function's practices are broadly in line with recognized standards at the time of the review, rather than a guarantee of ongoing effectiveness or the absence of any deficiencies. Quality is generally expected to be maintained through continuous internal monitoring between external assessments, so an EQA is best treated as one point-in-time input into an ongoing quality improvement program rather than a final verdict.
How often is an EQA typically expected to be performed?
Under certain professional standards for internal auditing, an external assessment is generally expected on a periodic basis, with many frameworks pointing to a recurring cycle measured in years. The specific frequency, and whether an EQA is a requirement or a recommended practice, can depend on the standards the function has adopted, the entity type, and applicable regulatory expectations. Because requirements vary by framework and jurisdiction, organizations should confirm the applicable expectation against the specific standards they have committed to follow rather than assuming a single universal interval. This entry is educational and not a substitute for professional judgment or a review of the relevant standards.
Who typically commissions and oversees the EQA, and who selects the assessor?
Responsibility for the internal audit function's quality program generally rests with the chief audit executive, who typically arranges for the EQA. However, oversight of internal audit is generally an audit committee or board-level responsibility, so the audit committee is commonly involved in reviewing scope, endorsing the choice of assessor, and receiving the results. Separating these roles matters: the assessor should be genuinely independent of the function being reviewed, and the audit committee's involvement helps preserve that independence. The precise governance arrangement will depend on the organization's structure and applicable standards.
What are the common approaches to conducting an EQA?
EQAs are generally conducted either as a full external assessment performed by a qualified, independent external party, or as a self-assessment with independent external validation, in which the function assesses itself and an independent reviewer validates the results. The appropriateness of each approach can depend on the standards being applied, the assessor's qualifications, and the level of independence the organization and its audit committee consider necessary. Organizations typically consider assessor competence and independence when choosing between these approaches; the selection is ultimately a matter of professional judgment informed by the applicable framework.
How should the results of an EQA be reported and acted upon?
EQA results are typically documented in a report describing the assessment's scope, conclusions on conformance with applicable standards, and any recommendations or opportunities for improvement. These results are generally communicated to senior management and to the audit committee or board given their oversight role. Acting on the outcome usually involves developing an action plan to address identified matters and tracking progress through the function's ongoing quality monitoring. The manner and detail of reporting can vary by organization and applicable standards, and this description is educational rather than prescriptive.

Common misconceptions

An External Quality Assessment is a legal requirement for all organizations.
An EQA is generally a professional standard promulgated by the Institute of Internal Auditors rather than a universal statutory obligation. Whether it is required depends on the jurisdiction, sector, entity type, and whether the organization has adopted the relevant standards; in some regulated sectors it may be effectively expected, while for many entities it remains a voluntary best practice.
An EQA is the same as, or a substitute for, an internal quality assessment or ongoing monitoring.
An EQA is one component of a broader quality assurance and improvement program, which typically also includes ongoing internal monitoring and periodic internal self-assessments. The external assessment complements, rather than replaces, these internal activities.
An EQA evaluates the organization's overall risk management and compliance programs.
An EQA is generally focused on the internal audit function itself, assessing its conformance with standards and its effectiveness. It is not an assessment of enterprise risk management or the compliance function as a whole; those are separate disciplines with their own accountability and assurance arrangements.

Best practices

Confirm which professional standards and internal audit charter provisions the assessment will be measured against before the EQA begins, and clarify whether adoption of those standards is expected in your jurisdiction, sector, or entity type.
Select an assessor or validation provider that is demonstrably independent of the internal audit function and free of conflicts, since independence underpins the credibility of the conclusions.
Choose the delivery approach deliberately, weighing a full independent assessment against a self-assessment with independent validation based on the function's maturity, resources, and stakeholder expectations.
Ensure the scope addresses both conformance with standards and the function's effectiveness and efficiency in adding value, rather than treating the EQA as a purely compliance checklist.
Report results to the board or audit committee to support their oversight role, and keep that reporting distinct from management's operational responsibilities.
Integrate the EQA into a continuous quality assurance and improvement program that includes ongoing internal monitoring and periodic self-assessments, and track remediation of identified findings over time.