Internal and External Quality Assessments
Internal assessments are the function's own evaluation machinery. Ongoing monitoring happens continuously and includes supervision, standardized workpapers, and performance indicators. Periodic self-assessments are discrete reviews, often annual, that test conformance against the standards and the function's charter.
External assessments bring independence. The assessor must be qualified (demonstrated competence in internal auditing and the assessment process) and independent of the audit activity and its organization - no conflicts of interest, no reporting lines to the chief audit executive. Candidates should be able to name acceptable forms: a full external assessment by an outside team, a self-assessment with independent external validation, or a peer review by qualified reviewers from outside the organization. A trap is assuming an external assessment must always be a full-scope site visit; the framework permits validated self-assessment.
The scope must cover conformance with the standards and the code of ethics, the effectiveness of the QAIP, and the function's ability to add value. The output is a report to the chief audit executive and, typically, to the audit committee and senior management.
Worked example: a small audit shop with three staff cannot credibly self-certify independence for a peer review. They should engage an external, qualified assessor. The self-assessment-with-validation route lets them do the groundwork internally while an independent party validates the conclusions - a common, cost-effective choice.
Rule of thumb: independence is about the assessor, qualification is about the assessor's competence; both must be satisfied.