Building a Better Auditor: Benefits of an EQA
Blogs John Hills Aug 29, 2023
An External Quality Assessment (EQA) should be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization, according to IIA Standard 1312: External Assessments.
In today’s world, five years seems to fly by in the blink of an eye. One minute you are going through an External Quality Assessment and the next, one is barreling your way. In 2023, PayPal’s internal audit function embarked on our third EQA conducted by the IIA since PayPal became an independent company after splitting from eBay in 2015. We decided to do this on an accelerated timeframe, with the belief that an EQA would help us mature our program, offer key insights on opportunities to improve, and provide feedback on the sustainability of our program — without waiting the full 15 years to cycle through three EQAs. Although an accelerated timeframe for EQAs is not suitable for all audit departments, our experience was one of learning, evolution, and ultimately refinement to ensure our team stays at the forefront of evolving in harmony with the Standards.
Planning for an EQA is as important as planning for an Audit.
Just like conducting an audit, planning is an integral part of success. When embarking on an EQA, preparation is key in the weeks leading up to the onsite review. We found that by dedicating resources and time a few months in advance to the onsite portion of the review, the IIA team was able to fully review and understand our processes in advance and focus the review more on the details of what would strengthen our current practices.
The EQA provided insights on four key areas within its review:
1. Enhancing Objectivity and Independence
As auditors, we are responsible for providing impartial and unbiased assessments of an organization's governance processes, controls, and risks. Through the EQA, the IIA evaluated the independence and objectivity of the internal audit function. This assessment ensured that auditors maintain a fair and unbiased approach, free from any undue influence or conflicts of interest. By demonstrating the integrity of our work, we as auditors can build trust among stakeholders, including management, board members, regulators, and investors.
2. Identifying Strengths and Areas for Improvement
The EQA provided our team with an external perspective on the effectiveness and efficiency of our processes and procedures. What we found most insightful was the focus not just on areas to improve, but also areas of strengths. The EQA can be utilized as an affirmation of good practices that should be continually monitored and we were able to identify these through having more frequent EQAs to ensure sustainability of good practices. Simultaneously, by identifying areas of improvement, our team was empowered to recognize opportunities to enhance processes, skills, and resources that otherwise might not have been considered.
3. Benchmarking against Global Standards
The IIA's EQA is conducted in accordance with the International Standards for the Professional Practice of Internal Auditing. By undergoing this assessment, organizations can benchmark their internal audit function against these globally recognized standards. This benchmarking exercise provided a reliable framework for evaluating the effectiveness of our internal audit activity and aligning them with best practices. Furthermore, through the vast experience of the team assigned to us by the IIA, we were able to gain insights into emerging trends, industry benchmarks, and leading practices to use when assessing improvement opportunities. This knowledge-sharing opportunity through the EQA empowers teams to stay ahead of the curve and adapt their internal audit practices to meet evolving business needs and regulatory requirements.
4. Strengthening Governance
The EQA provided valuable insights into our own internal audit governance structures as well as our inclusion in companywide governance structures, enabling our team to improve oversight and align our internal audit function with corporate governance best practices. This in turn allows key partners, as well as regulators, to be confident that internal audit is best aligned from a governance perspective.
Undertaking an EQA conducted by the IIA brought numerous benefits to our organization, from reinforcing objectivity and independence, to identifying areas for improvement, to benchmarking against global standards and strengthening governance. The biggest benefit that we gained from this process was having continuity in the core of the EQA review team who were able to provide initial insights back in 2017 and were able to then see the development and implementation of recommendations and provide commentary on the sustainability of our program through two additional EQAs. The next journey we will all embark on together will be the implementation and adoption of the new Global Internal Audit Standards to be rolled out in 2024.