The question comes up in almost every conversation: "don't we need an external assessment once every five years?" That's correct, but it's the smallest part of what the Global Internal Audit Standards require here. The external assessment is the capstone of a program that runs all year round, and that program is where most audit functions fall short.
What GIAS requires
Standard 8.3 Quality lays the foundation: the head of the internal audit function must develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the function. That program includes two types of assessments:
- Internal assessments (Standard 12.1);
- External assessments (Standard 8.4).
A communication requirement comes with it. The results of the internal quality assessment must go to the board and senior management at least once a year; those of an external assessment, on completion. In both cases, that communication must at minimum cover conformance with the Standards and the achievement of performance objectives.
The external quality assessment
Standard 8.4 External Quality Assessment is specific on four points:
- the CAE develops a plan for the external assessment and discusses it with the board;
- the assessment takes place at least once every five years;
- it is carried out by a qualified, independent assessor or assessment team;
- at least one person on that team holds an active Certified Internal Auditor® designation.
A self-assessment with independent validation (SAIV) also satisfies the requirement. For smaller audit functions, this is often the workable route: the function does the groundwork itself, and an independent validator assesses the outcome. It saves cost, but not rigor. The validator still has to be able to stand behind the conclusion.
Two things are consistently underestimated here. The plan must be discussed with the board beforehand, not presented afterward for information only. And "at least once every five years" is a maximum term, not a rhythm: after a major reorganization or a change of CAE, assessing sooner is wiser than waiting until the five-year mark arrives.
Internal assessment is two things, not one
This is where practice most often goes wrong. Standard 12.1 Internal Quality Assessment calls for a methodology that includes three elements:
- Ongoing monitoring of conformance with the Standards and of progress toward the performance objectives;
- Periodic self-assessments, or assessments by other people within the organization who have enough knowledge of internal audit practices to judge conformance;
- Communication with the board and senior management about the outcomes.
Ongoing monitoring is not the same as an annual self-assessment. It sits in the daily work: supervision on engagements, reviews of work programs, confirming that a file supports its conclusion. Standard 12.3 makes this explicit. The CAE or the engagement supervisor must provide guidance during the engagement, verify that work programs are complete, and confirm that the working papers adequately support the findings, conclusions, and recommendations.
A function that only runs an annual self-assessment misses half the requirement, and finds out only during the external assessment.
Performance objectives are part of it
Standard 12.2 Performance Measurement links quality to performance. The CAE must develop objectives to evaluate the function's performance, taking into account the input and expectations of the board and senior management. There must be a methodology for assessing progress, feedback must be sought where needed, and an action plan must be developed to address areas for improvement.
Conformance and performance are therefore two different things that belong in the same report. A function can be fully conformant and still fail to deliver what the board needs. We worked out that distinction in our article on an assessment framework for foresight under GIAS.
What does "conforms" actually mean?
A quality assessment ends in a rating for each standard. The IIA uses three levels for this: generally conforms, partially conforms, and does not conform. That rating is about demonstrability, not effort. The question is not whether the audit function works carefully, but whether it can show, requirement by requirement, that it meets each one: in methodologies, in files, and in documented communication with the board.
That's also why an assessment rarely fails on the content of the audit work. It fails on documentation: a charter that hasn't been updated, a risk analysis that can't be traced back to the annual plan, a quality program that exists but isn't documented. We've described what belongs in the report itself in The Audit Report: Structure, Findings, and Conclusion under GIAS.
From standards to practice: where to start
For audit functions still implementing GIAS, here is a workable order:
- Start with the charter. It sets out mandate, positioning, and independence, and it's the document an assessor asks for first. A worked-out starting point is available in our Internal Audit Charter template.
- Document the methodologies. The Standards refer to them constantly: for engagements, for reporting, for quality assurance. Without documentation, conformance cannot be demonstrated. See the Audit Manual template.
- Set up the internal assessment before the external one. Without ongoing monitoring and periodic self-assessment, an external assessment only produces a list of surprises.
- Make reporting to the board explicit. Annually for the internal assessment, on completion for the external one, covering both conformance and performance objectives.
- Assess in small, frequent steps. Working through one standard a month builds a complete picture within a year, without ever turning it into a major project.
Smaller audit functions run into their own questions here. We've addressed those separately in GIAS and Small Internal Audit Functions.