Preparing for an external quality assessment

 I have been through two external quality assessments (EQAs) myself, and have undertaken around 50 EQAs for diverse organisations. Whether a listed company, an NGO or public sector, your preparation is key. Here are my tips on practical steps to prepare for a smooth and value-added EQA.

   1.   Sort out the logistics in advance

Often one of the most challenging aspects of preparing for an EQA is making it straightforward to share documents with the assessment team. The nature of internal audit means we often have access to sensitive information.

Think about how to share documents securely and get this set up well in advance. If your assessor has a secure sharing portal, check this in advance with your information governance team. If you have a similar facility that you regularly use, and is approved for use, then provide the assessors access to documents through that.

The one factor that consistently creates delays to EQAs is Information Governance functions taking time to approve either the assessment team having access to certain documents, or the route through which documents will be made available.

   2.   Be prepared

Complete a thorough self-assessment against the Global Internal Audit Standards well in advance. Make sure your assessment focuses on domains and principles as well as individual standards.

Identify the evidence you will need to share with the assessment team, and either cross-reference to your self-assessment or make a clear list of what your evidence is and why you have shared it.

   3.   Be open about challenges

Don’t you love it when your internal audit customers are open about their views on what is working and the challenges they are facing when you’re planning an audit engagement?

Be that person.

Treat the EQA team as you hope your customers treat you – as a trusted advisor. While the EQA still needs to provide a conclusion of conformance and performance, understanding any issues facing the HIA or internal audit team is important context, and if there are actions underway to improve or enhance internal auditing activities, you should be open about this with the assessment team.

   4.   Expect (and demand) value from the EQA

Don’t just treat this as a tick box about conformance with internal auditing standards. Ask for advice and ideas. If you have selected the right assessor, they should be able to bring lots of experience from internal audit functions in your industry, and other sectors. They can share ideas, lessons learned and what has worked well for other teams.

   5.   Get the team involved

Whether or not you have someone who leads on quality for your internal audit function, it is sensible to get some of the wider team involved in the EQA. I find that teams who feel engaged during the process are more open to feedback, ideas and embracing change.

These also tend to be the internal audit functions which have the most realistic self-assessments because the assessment has input from the wider team and not just the person who developed the internal audit methodology.

Don’t consider the EQA solely as the domain of the Head of Internal Audit or the quality lead. Do give your team members a chance to get involved; there can be some useful development activities for some of the team.

   6.   Brief your stakeholders – but don’t give them a script

It is good practice to brief your stakeholders so that they understand the purpose of the EQA interviews, who they are meeting, and what the assessor will want to discuss. The assessor should be helping with this – I provide a briefing document that can be shared with stakeholders in advance.

I once undertook an EQA where it became clear that the chief audit executive had briefed all of the stakeholders with an explanatory email. Over time it became clear that he had also given them individual briefings. However, the stakeholders were so well briefed to tell the EQA team what the chief audit executive thought we wanted or needed to hear that every single interview felt the same, even to the extent of the language and specific words used. In this case, the internal audit function missed out on gaining valuable insight and feedback from their customers and stakeholders.

   7.   Don’t take it personally

We spend a lot of time in the day job.  It can be difficult not to take things personally when someone provides commentary or critique on your way of doing things. Incidentally, this is how many auditees feel when involved in an internal audit engagement, so being on the other side of the conversation can be an opportunity to understand what your customers experience during an audit.

Embrace the review, and do provide constructive challenge to the assessment team and their findings and recommendations. Don’t lose sight of the purpose of the EQA: helping your internal audit function be more effective.

If you are planning for your next external quality review, get in contact for a chat.

This article last updated 18 February 2025