External Quality Assessment of Internal Audit: The Five-Year Requirement in Standard 8.4

Internal auditors review everyone else's controls. Standard 8.4 of the IIA Global Internal Audit Standards requires someone to review theirs. The requirement is brief, but planning for it touches the charter, the board, the budget and the quality program.

What the standard requires

The chief audit executive must develop a plan for an external quality assessment and discuss it with the board. The external assessment must be performed at least once every five years by a qualified, independent assessor or assessment team. The requirement can also be met through a self-assessment with independent validation. When selecting the assessor or team, the chief audit executive must make sure at least one person holds an active Certified Internal Auditor designation.

The standard also sets out essential conditions for the board. The board is to discuss the plan with the chief audit executive, collaborate with senior management on scope and frequency, consider the regulatory requirements of the function and the CAE, and review and approve the plan. The approval should cover scope and frequency, the competencies and independence of the assessor, and the rationale for choosing self-assessment with independent validation instead of a full external assessment. The board is to require receipt of the complete results directly from the assessor, review and approve the CAE's action plans for deficiencies and opportunities, and approve a timeline for completion while monitoring progress.

Two routes

The standard allows either route. The board's approval should cover the rationale for choosing self-assessment with independent validation instead of a full external assessment, so document it.

What the assessor reviews

An external assessment tests conformance with the Standards, so the evidence of conformance in the standards themselves becomes the checklist. Standard 12.1 also requires internal assessments to be documented and included in the evaluation by the independent third party, which means the assessor starts with the function's own internal assessment file. A function without one has a gap before the assessor arrives.

Key items to assemble:

• The charter, showing purpose, commitment to the Standards, mandate and reporting relationships (Standard 6.2).
• Annual confirmation of organizational independence to the board (Standard 7.1).
• The internal audit strategy and board-approved plan (Standards 9.2 and 9.4).
• Methodologies (Standard 9.3).
• A sample of engagement files: work program, workpapers with supervisory review, findings, final communication with chief audit executive approval (Standards 13.6, 14.6, 15.1).
• Internal assessment results and action plans (Standard 12.1).
• Performance measurement objectives and results (Standard 12.2).
• Board minutes showing the board received results and quality information (Standard 8.1).

An illustrative timeline for a five-year cycle

Doing the assessment in year four leaves time to remediate before the five-year limit and to carry open items into the next cycle.

Worked example

In this hypothetical, a company's three-person internal audit function last had an external review seven years ago, under the earlier standards. The chief audit executive tells the audit committee at the next meeting that the function is overdue, presents two options with cost estimates and timelines, recommends a validated self-assessment given the function's size (a judgment the committee must approve), and asks the committee to approve the route, the assessor and the scope. Because the standard requires at least one person with an active CIA designation on the assessor team, the CAE confirms credentials before engagement. Results go directly from the assessor to the committee chair. The committee approves a six-month remediation timeline for two identified gaps: no documented performance measurement methodology, and engagement files missing evidence of chief audit executive approval of work programs.

Independence of the assessor

The assessor must be independent. The standard's implementation text lists external audits of financial statements, assistance to the internal audit function, advisory services in governance, risk management and control processes, and previous or planned participation in internal quality assessments as examples of potential impairments to an assessor's independence. A firm that audits the company's financial statements or performed co-sourced internal audit work therefore needs a documented independence analysis before it assesses the function. Individuals from another department of the organization are not considered independent, and neither are reciprocal peer assessments between two organizations. Give the analysis to the board.

Pitfalls

• Treating the five-year clock as flexible. The standard says at least once every five years.
• Choosing the self-assessment route without documenting the rationale for the board.
• Receiving the assessor's report through the chief audit executive only. The standard's essential conditions call for the board to receive complete results directly.
• Skipping periodic internal assessments. Standard 12.1 requires the documented internal assessments to feed the external evaluation.

For the standards that make up the internal assessment, see /us/blog/internal-audit-quality-program-internal-assessments-and-performance-measurement.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• The IIA, Global Internal Audit Standards (2024), Standards 6.2, 7.1, 8.1, 8.4, 9.2, 9.3, 9.4, 12.1, 12.2, 13.6, 14.6, 15.1: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error