Internal audit is an independent, objective assurance and consulting activity designed to enhance and protect organizational value. They are your organization’s internal compass, helping navigate through risks while ensuring controls are working effectively.
But here’s an important question: Who ensures the effectiveness of internal audit functions?
The answer lies partially within the External Quality Assessment (EQA) process, a mandatory review that should be conducted at least every five years, as required by the Standards.
This fundamental requirement serves as the cornerstone of internal audit quality control, ensuring that audit functions maintain their effectiveness and relevance in an ever-evolving business.
The Reality of Current EQA Practices
As a Chief Audit Executive (CAE), we’ve had two EQAs performed by Big 4 firms. While these assessments confirmed to our board and senior management that we fully met the standards, which is the minimum requirement, they added little additional value.
This candid observation highlights a critical gap in the current assessment framework. The process often becomes a mere checkbox exercise rather than an opportunity for meaningful improvement and strategic insights.
Even more concerning is that a colleague even shared that some firms use these assessments as a way to gain access to boards and senior management.
This practice raises questions about the true motivations behind some quality assessments and whether they serve their intended purpose.
Interestingly, the EQA process doesn’t set a very high bar for assessors.
According to the EQA Manual (2024), a single team member with a CIA designation is sufficient to lead the assessment. This surprisingly low threshold for assessor qualifications stands in stark contrast to the complexity and importance of the role.
The irony deepens as the 2024 Quality Assessment Manual references ‘Professional Judgment’ 21 times. This raises the question: What truly defines professional judgment?
The Foundation of Professional Judgment
Here are five key aspects that should form its foundation:
1. Deep understanding of internal audit standards and practices: This encompasses comprehensive knowledge of both theoretical frameworks and their practical applications.
2. Practical experience leading internal audit functions: Real-world experience that can’t be replaced by theoretical knowledge alone.
3. Ability to provide unbiased and impactful recommendations: The skill to deliver actionable insights that drive meaningful change.
4. Insight into organizational governance and risk management: A broad understanding of how audit functions fit within the larger organizational context.
5. Strong ethical principles and decision-making skills: The backbone of professional judgment in any audit function.
Proposed Standard For CAE Experience
EQAs should only be performed by current or former CAEs with at least five years of experience. This ensures the professional judgment required to deliver real value.
This proposal would significantly raise the bar for quality assessments, ensuring that those who evaluate internal audit functions possess the depth of experience and expertise necessary to provide meaningful insights and recommendations.
This elevated standard would transform EQAs from perfunctory compliance exercises into valuable opportunities for genuine improvement and strategic development of internal audit functions. It’s time to ensure that those who audit the auditors are truly qualified for this critical responsibility.