An External Quality Assessment should provide confidence that an Internal Audit function conforms with the Global Internal Audit Standards. The most useful assessments also create an opportunity to stand back and ask a wider question: how well is the function serving the organisation now, and how well prepared is it for what comes next?
That distinction matters. An EQA can be approached as a periodic test, with evidence assembled and requirements checked. Done well, it becomes a much more valuable exercise. It brings together the Standards, the function’s strategy, the quality of its work and the experience of the people who rely on it.
Under Standard 8.4, an external assessment must be carried out at least once every five years. The current Standards also describe Internal Audit as strengthening an organisation’s ability to create, protect and sustain value through assurance, advice, insight and foresight. Conformance remains fundamental, but the definition of an effective function is deliberately broader.
Across our recent EQAs and strategic reviews, five themes have appeared repeatedly. These observations are not intended as a formal benchmarking study or a ranking of the profession. They are practical patterns that point to where Internal Audit functions are concentrating their attention and where some of the most useful conversations are now taking place.
1. Foresight is becoming part of good assurance
Internal Audit will always need to examine evidence, test controls and provide an objective view of what has happened. The opportunity is to use that work more deliberately to illuminate what may happen next.
This does not require auditors to become forecasters. It means connecting individual findings to root causes, emerging risks, strategic objectives and the conditions the organisation will need in order to succeed. A recurring control weakness may reveal a wider capability problem. A well-managed risk today may become more significant as the operating environment changes. A report can be entirely accurate and still arrive too late to influence the decision that matters.
The strongest functions retain the discipline of hindsight while becoming more confident in asking forward-looking questions. What is changing? Where could pressure build? Which assumptions sit underneath the organisation’s plans? What evidence would give the Board justified confidence that those plans remain achievable?
“The best audit work does not stop at explaining what has happened. It helps the organisation see what needs attention before the same weakness appears somewhere more important.”
Paul Haley, Co-founder, Littlechild & Haley
2. Demonstrating value requires more than reporting activity
Most Internal Audit functions can describe what they have delivered. They know how much of the audit plan is complete, how many recommendations have been agreed and whether reports were issued on time. Those measures are useful, but they mainly describe activity.
The harder question is what changed as a result.
Standard 12.2 now requires the Chief Audit Executive to develop a methodology for measuring performance, with input from the Board and senior management where appropriate. That creates an opening for a more mature conversation about value. In the IIA’s Vision 2035 research, half of respondents said that being misunderstood or undervalued was the greatest challenge facing the profession.
A useful performance picture does not discard conventional measures. It puts them alongside questions about outcomes and influence.
| Common measure | What it usefully shows | The further question |
|---|---|---|
| Percentage of the audit plan completed | Delivery against commitment | Did the work address the risks and objectives that mattered most? |
| Recommendations agreed or closed | Management response and follow-through | What improved, and is the underlying risk now better managed? |
| Reports issued on time | Operational efficiency | Did the insight arrive early enough to shape action? |
| Stakeholder satisfaction | The experience of working with Internal Audit | Do leaders trust the function and seek its advice at the right moments? |
| Audit coverage | The breadth of assurance activity | Does the coverage reflect a changing risk profile and future priorities? |
Value will look different in every organisation. It might be a better decision, earlier intervention, stronger oversight or clearer accountability. The important step is to agree what a valuable Internal Audit function should achieve, then measure more than the volume of work passing through it.
3. Accessible technology is changing the advantage of scale
Technology is no longer confined to large functions with specialist analytics teams and substantial investment budgets. Smaller teams can now test practical uses of data analytics, automation and generative AI with relatively low entry costs.
This is one of the most interesting patterns we are seeing. A smaller function may have limited capacity, but it can also have shorter decision paths and fewer layers between an idea and a controlled pilot. When that agility is combined with sound governance and professional judgement, a small team can make progress surprisingly quickly.
The wider profession clearly recognises the opportunity. In the IIA’s Vision 2035 research, 92% of respondents agreed that new technology is important to helping Internal Audit add more value. The question for each function is therefore becoming more practical: where can technology improve coverage, free up professional time or reveal something that manual work is unlikely to find?
Size alone is not the differentiator. A large department with established data capability may be well ahead. A small team with clear priorities and permission to experiment may move faster. In both cases, progress depends on choosing worthwhile uses, protecting information, validating outputs and keeping human judgement firmly in the process.
4. Stakeholder confidence turns technical quality into influence
Conformance with the Standards gives Internal Audit an essential foundation. It supports independence, objectivity and confidence in the quality of the function’s work. Yet stakeholder interviews during an EQA often reveal another dimension of effectiveness: whether people understand the function, trust its judgement and involve it early enough to make a difference.
The signs are usually practical. Does Internal Audit understand the organisation well enough to distinguish a significant issue from a merely technical one? Are reports clear about what matters and why? Can auditors challenge constructively without losing the relationship? Do senior leaders seek their perspective before a decision is fixed, or only after a problem has emerged?
A technically strong function can still have limited influence if its relationships are thin or its communication does not travel beyond the audit process. Equally, good relationships cannot compensate for weak evidence or a lack of independence. High-performing functions hold both: professional rigour and stakeholder confidence.
“You often learn as much from when stakeholders involve Internal Audit as from what they say about it. Being invited into the conversation early is a strong sign that trust has been earned.”
Donna Littlechild, Co-founder, Littlechild & Haley
5. The best EQA conversations are about maturity
An EQA must reach a clear view on conformance. For ambitious Internal Audit functions, that conclusion is the beginning of the value rather than the end of it.
Once the fundamentals have been tested, the conversation naturally moves towards maturity. Is the operating model still right for the organisation? Does the plan connect clearly to strategy and changing risk? Are skills and resources aligned with the work ahead? Is technology being used where it genuinely helps? Does the Board receive the assurance and insight it needs?
Maturity should not be confused with complexity. A function does not become better simply by adding more methodology, reporting or technology. In some cases, improvement means simplifying a process, being clearer about priorities or investing in one capability that has been missing. The aim is a function that is proportionate, trusted and able to keep developing as its organisation changes.
This is why an EQA should leave more than a rating. It should provide a realistic view of strengths, a prioritised route for improvement and a shared understanding between the Chief Audit Executive, senior management and the Board about what good should look like next.
Taken together, these five themes suggest a profession that is broadening its contribution while retaining its core disciplines. Assurance and conformance remain essential. Their value grows when they are combined with foresight, meaningful performance measures, thoughtful use of technology, trusted relationships and a commitment to continued development.
For organisations approaching their next EQA, the five-year requirement is only one reason to act. The more useful opportunity is to understand where the Internal Audit function stands, where it could have greater impact and what it will need for the next stage of its development.
References
- The Institute of Internal Auditors, Global Internal Audit Standards
- The Institute of Internal Auditors, Internal Audit Quality Assurance FAQs
- The Institute of Internal Auditors, Quality Assurance and Improvement Program
- Internal Audit Foundation, Internal Audit: Vision 2035
- The Institute of Internal Auditors, Performance Measurement Tool
