Qualifications and Independence of External Quality Assessors: A Complete CIA Part 3 Guide
Overview
An external quality assessment (EQA) is one of the strongest signals that an internal audit function conforms with the IIA's Standards. Its value depends on who performs it. If the assessor lacks competence, the conclusions are unreliable. If the assessor is not independent, the conclusions are not credible. For this reason, the IIA requires EQAs to be performed by a qualified and independent assessor or assessment team. The CIA exam often tests whether you can tell an acceptable assessor from an unacceptable one in short scenarios.
1. Why It Is Important
Credibility with stakeholders: The board, senior management, regulators and external auditors rely on the EQA opinion about conformance. A conflicted or unqualified assessor weakens that reliance.
Objective view of the function: Internal assessments, such as ongoing monitoring and periodic self-assessments, are done by people close to the function. The EQA adds an outside view that can spot blind spots, entrenched habits and gaps against leading practice.
Right to claim conformance: An internal audit function may state that it conforms with the Standards only if the quality assurance and improvement program (QAIP) supports that statement. A properly conducted EQA is a required part of that support.
Protection of the profession: Consistent rules on assessor qualifications and independence keep the quality of EQAs comparable across organizations and countries.
Governance accountability: The board relies on the EQA to judge the chief audit executive (CAE) and the function. A weak assessor undermines board oversight.
2. What It Is: The Requirements
Frequency: An EQA must be performed at least once every five years. This appears in Standard 1312 of the former IPPF and in Standard 8.4 of the Global Internal Audit Standards. The CAE should discuss with the board whether more frequent assessments are needed, for example after:
- a change in CAE or leadership;
- a major reorganization;
- significant regulatory pressure;
- prior poor results.
Who performs it: The assessment must be done by a qualified, independent assessor or assessment team from outside the organization.
Two acceptable approaches:
1. Full external assessment: The external team performs the entire review.
2. Self-assessment with independent external validation (SAIV): The internal audit function performs a thorough self-assessment. A qualified, independent external assessor then validates both the process and the conclusions.
Both approaches must meet the same qualification and independence requirements for the external party.
3. Qualifications of External Assessors
A qualified assessor or team demonstrates competence in two areas:
1. The professional practice of internal auditing: deep knowledge of the IIA's Standards and current leading practices. Under the Global Internal Audit Standards, at least one member of the team should hold an active Certified Internal Auditor (CIA) designation.
2. The external quality assessment process: knowledge of how to plan and perform an EQA, often supported by IIA-recognized quality assessment training and prior assessment experience.
Indicators of qualification include:
- Experience as an internal audit practitioner, ideally at management level such as CAE or audit director.
- Relevant professional certifications (CIA, plus others as needed such as CISA, CPA or CA).
- Completion of quality assessment or validation training.
- Prior participation in quality assessments.
- Industry knowledge suited to the organization, for example banking, the public sector or healthcare.
- IT and specialist knowledge when the audit universe requires it.
Team versus individual competence: Competence is judged at the team level. Not every member must have every skill, but the team as a whole must cover all required competencies. The team leader should have the overall experience and judgment to reach the final conclusion on conformance.
Judgment by the CAE and the board: The CAE, with board involvement, evaluates the assessor's qualifications before engagement. Many organizations require proposals that show CVs, certifications and prior assessment experience.
4. Independence of External Assessors
Independence means the assessor or team has no actual, potential or perceived conflict of interest. They must not be part of, or under the control of, the organization to which the internal audit function belongs. The test is whether a reasonable, informed third party would consider the assessor objective.
Common situations that IMPAIR independence (generally not acceptable):
- Employees of the same organization, even from another department, a separate risk function or a different location. They are not from outside the organization.
- Employees of a parent, subsidiary or affiliate in the same organizational group. Because the entities are related, they are not considered independent.
- Reciprocal peer reviews between two organizations, where Organization A reviews B and B reviews A. Each party has a mutual interest in a favorable result.
- Former employees or former members of the internal audit function, at least within a reasonable cooling-off period.
- Individuals or firms with significant prior involvement, such as those who:
- designed the function's methodology;
- provided co-sourced or outsourced internal audit services;
- performed consulting on the QAIP being assessed.
Here the assessor would be reviewing their own work.
- Close personal or family relationships with the CAE or key internal audit staff.
- Financial interests that would be affected by the outcome.
Situations requiring careful evaluation (may be acceptable with safeguards):
- The organization's external audit firm: This raises perceived independence concerns. The external auditor relies on internal audit work, and the firm may provide other services. It may be acceptable only if any conflict is evaluated, disclosed to the board and adequately mitigated, for example through a separate team with no involvement in the audit.
- Peer reviews among three or more organizations: These can be acceptable if they are structured so that no organization reviews another that reviews it back. Rotation, for example A reviews B, B reviews C and C reviews A, avoids direct reciprocity.
- Consulting firms that previously provided unrelated services: These require assessment of materiality and relevance.
Disclosure: Any potential conflict should be disclosed to the CAE and the board, who decide whether it is acceptable or whether another assessor should be chosen.
5. How It Works in Practice
Step 1: Planning. The CAE discusses the EQA with senior management and the board, covering:
- the form (full EQA or SAIV);
- frequency and timing;
- scope;
- the qualifications and independence of candidate assessors.
Step 2: Selection. The CAE issues a request for proposal or approaches candidate providers. Candidate assessors may include:
- the IIA's own quality services;
- accounting and consulting firms;
- independent practitioners;
- qualified peer teams.
Step 3: Evaluation of qualifications. The CAE reviews team composition, certifications (including at least one active CIA), assessment training, industry experience and references.
Step 4: Evaluation of independence. Each candidate confirms in writing that it has no conflicts. The CAE checks for prior relationships, services, employment and reciprocity, and documents the evaluation.
Step 5: Board involvement. The board, often through the audit committee, is informed of and ideally approves the selected assessor. This strengthens independence because the CAE alone is not choosing his or her own reviewer.
Step 6: Fieldwork. The assessor performs the work, which typically includes:
- reviewing the charter, methodology and workpapers;
- surveying stakeholders;
- interviewing board members, senior management and auditors;
- evaluating conformance with the Standards and the Code of Ethics or Ethics and Professionalism principles.
Step 7: Reporting. The assessor issues an opinion or conclusion on conformance, usually expressed as generally conforms, partially conforms or does not conform, along with recommendations. The CAE communicates the results and action plans to senior management and the board.
6. Exam Tips: Answering Questions on Qualifications and Independence of External Quality Assessors
Tip 1: Memorize the core rule. An EQA must be done at least once every five years by a qualified, independent assessor or team from outside the organization. If an answer option says every three years is required, or says internal staff may perform it, it is likely wrong.
Tip 2: Apply the 'outside the organization' test first. Anyone employed by the organization, including its parent, subsidiaries and affiliates, is not independent for EQA purposes. This holds even if they work in a completely different department or country. This is one of the most frequently tested traps.
Tip 3: Watch for reciprocity. A two-way peer review, where A reviews B and B reviews A, impairs independence. A peer review arrangement among three or more organizations that avoids direct reciprocity can be acceptable.
Tip 4: Remember the two competence areas. Qualification means competence in internal audit practice and in the external assessment process. Credentials in only one area, such as a strong external financial auditor with no quality assessment experience, may not be enough.
Tip 5: Know the CIA requirement. Under the Global Internal Audit Standards, at least one assessment team member must hold an active CIA designation. Questions may ask which team composition is sufficient.
Tip 6: Competence is assessed at team level. If a question asks whether every member must be a CIA or an industry expert, the answer is usually no. The team collectively must possess the required competencies.
Tip 7: Self-review threats. An assessor who designed the methodology, provided outsourced or co-sourced internal audit services, or recently worked in the function would be reviewing their own work. Treat this as an independence impairment.
Tip 8: The external auditor is not automatically excluded but raises concerns. The best answer often says the conflict must be evaluated and disclosed to the board and mitigated. It rarely says the external auditor is always prohibited, and it never says the external auditor is always the preferred choice.
Tip 9: SAIV still needs an independent validator. In a self-assessment with independent validation, the validator must meet the same qualification and independence requirements. Do not confuse a periodic internal self-assessment with an EQA.
Tip 10: Look for board involvement. When asked who should approve or oversee assessor selection, choose answers involving the board or audit committee together with the CAE. Avoid answers where the CAE selects the assessor alone or where senior management alone decides.
Tip 11: Use the reasonable third-party lens. If a scenario describes a relationship that a reasonable outsider would see as compromising objectivity, choose the answer identifying impaired independence. Examples include a family relationship, a financial interest or a recent former employee. Perceived conflicts matter as much as actual ones.
Tip 12: Read for the 'best' or 'most appropriate' answer. Several options may seem plausible. Rank them in this order:
1. Is the assessor outside the organization?
2. Are they free of conflicts?
3. Are they qualified in both competence areas?
4. Is the board involved?
The option satisfying all four is usually correct.
Sample Question
A CAE wants to meet the external assessment requirement at low cost. Which option is MOST appropriate?
A. The internal audit team of the company's wholly owned subsidiary performs the review.
B. The CAE of a peer organization reviews the function, and the CAE in turn reviews that organization next year.
C. A three-company consortium rotates reviews so that no company reviews a company that reviews it, using CIA-certified, QA-trained staff.
D. The compliance department performs the review because it reports separately to the board.
Answer: C.
- Option A fails because the subsidiary is part of the same organizational group.
- Option B is a reciprocal arrangement, which impairs independence.
- Option D uses staff inside the organization.
- Option C avoids reciprocity and uses qualified assessors.
Summary
An EQA is only as credible as the people who perform it. Qualified means competent in both internal audit practice and the assessment process, including at least one active CIA. Independent means outside the organization and free from actual or perceived conflicts. Key threats to check are reciprocity, self-review, related entities, former employment and personal relationships. On the exam, apply the outside-the-organization test first, then check for conflicts, then confirm both competence areas and board involvement.
