Should an EQA be a priority right now?

With the significant business disruption caused by Covid-19, your 5 yearly External Quality Assessment (EQA) may not seem like a high priority right now. However, if your EQA is due in the next few months, the Institute recommends careful consideration of the implications of proceeding or delaying before this decision is made. 

Can a remote EQA work?

Key factors to consider include:

EQA stakeholders

Identify your EQA stakeholders and discuss the best approach with them. Your Audit Committee and executive management team will be obvious stakeholders.There may well be other parties, such as regulators and governing authorities, who utilise EQA results as part of their oversight activities. Will they be comfortable if this aspect of your organisation’s annual regulatory return shows a delay? 

In most cases the answer will be yes. Regulators in many sectors are anticipating and advising that some requirements cannot be met in the current climate. As always, the best approach is to talk to them upfront to avoid issues later.

If you are a provider of outsourced internal audit to client organisations, you will, of course, need to consult with your clients as to whether there is any impact on them if you cannot provide up to date details of your conformance with the IPPF.

Meeting arrangements

EQAs involve the review team meeting with stakeholders to discuss internal audit’s performance. If your business is significantly disrupted or large numbers of staff are furloughed, stakeholders may well not be able to participate, strengthening the case for a delay.

Workload and staffing

The workload and availability of internal audit staff will be another consideration. If your team is furloughed, deployed to the first line or urgently auditing emerging risks, an EQA will not be practical. Alternatively, if changes to the audit programme have led to under deployed team members, an EQA could be a valuable use of staff time.

The ability to commission an EQA should not be a deciding factor. EQAs can be carried out very effectively using remote technologies, in fact, the Institute’s EQA service has been continuing to deliver reviews during the Covid-19 crisis using its established technologies for secure file sharing and video conferencing.

For many IA functions, now may well not be the right moment for an EQA. If the decision to delay is taken, future EQA reviewers are likely to be understanding of the circumstances and it should not unduly impact your function’s level of conformance with the IPPF. There are, nevertheless, a number of recommended actions that you should consider in the meantime:

• Make sure that the decision to delay is agreed with all stakeholders and that there are records of these decisions.
• Set a clear timeline for undertaking the review and/or re-considering when the EQA should take place.
• Use any under-utilised staff time to ensure that you will be in good shape for the EQA when it comes around. For example, update documents such as the audit manual or charter and complete your own assessment of your compliance with the IPPF (use the Institute’s checklist) and develop a plan to address any gaps you identify.

Conclusion

In summary, consult your stakeholders, understand the full implications of a delay and then make the plans which will ensure you can get the most from an EQA either now or after the immediate crisis has passed.

Related guidance

Top reasons to press ahead with EQAs