Get the Most Out of Your External Quality Assessment (EQA)
EQA is a process where the internal audit function is assessed against international standards (IPPF) by an external party. EQA should be done at least every five years if the company wants to follow the recommendations.
The Finnish FSA recently published a thematic review regarding Board work in financial institutions. The authority gave several recommendations, for example, regarding risk appetite documentation or the board’s role in challenging the management. Boards should also evaluate how well the independent control functions are resourced and how effectively they operate. One of the recommendations was to ensure that an External Quality Assessment Review (EQA) is executed for the Internal Audit Function every five years.
Future of Internal Audit
Generally, the pressure on internal control functions, including Internal Audit, is constantly increasing through different regulatory initiatives. The requirements are becoming more and more material and precise. This will set new levels regarding resourcing and competencies in the internal audit functions. The International Standards for the Professional Practice of Internal Auditing are currently under review. The IIA aims to have a draft of the new standards ready for public comment by the end of the first quarter of 2023.
Why not take it to the next level?
In many cases, being a Chief Audit Executive is somewhat of a lonely position. You are not always able to share and test your development ideas in the organization you are evaluating. An external assessment, such as an EQA, provides an opportunity to discuss and get feedback from other IA professionals. In our opinion, the full potential of the assessment is not achieved when performing an “out-of-the-box” EQA.
EQA is not only an evaluation of whether everything is done according to the standards. It is also an excellent platform to collect feedback and development ideas from all audit stakeholders. The process will provide top management with good visibility of how well the Internal Audit – the ultimate defense line – is operating. It provides valuable input to becoming an even better trusted advisor.
The assessment is also an excellent opportunity to collect feedback on improvement areas from the team, receive benchmarks from other organizations, challenge the current working procedures, and act as inspiration and knowledge enhancement for the team members and CAE.
To summarize, your primary objective for performing an EQA should not be to comply with regulatory requirements. You should see it as an opportunity to revitalize your team, improve your working procedures, and ensure that the great things that your audit function is delivering throughout the year are considered valuable and constructive input to improving your organization.
