—IIA 2024 · Standard 8.4
Standard 8.4: external quality assessment.
At least once every five years, an independent assessor tests whether your internal audit function conforms with the Standards. The 2024 edition gives the board a direct role — it approves the plan for the assessment and receives the results from the assessor.
—What the Standards Require
The requirements, in plain terms.
Standard 8.4
External Quality Assessment
At least once every five years, by a qualified, independent assessor or team including at least one active CIA. A self-assessment with independent validation is an accepted alternative.
Standard 8.4 · Board
The board's role
The CAE discusses the assessment plan with the board; the board approves it and receives the results directly from the assessor.
Standard 8.3
Quality
External assessment results are communicated to the board when the assessment is completed, as part of the quality assurance and improvement program.
Standard 12.1
Internal Quality Assessment
Ongoing monitoring and periodic self-assessments — whose results feed the external assessment.
—In Practice
What it looks like when it's done well.
Full assessment or validated self-assessment
Standard 8.4 allows either an external assessment by an independent team or a self-assessment with independent validation. The choice depends on the function's maturity and the board's appetite — and the board approves it.
Five years is long enough to forget
Assessors sample engagements across the period. If evidence of review, plan changes and follow-up has to be reconstructed from email, the assessment becomes a reconstruction exercise.
Use the internal assessments
Periodic self-assessments under 12.1 are a rehearsal. Their action plans, closed and evidenced, are some of the strongest material an external assessor can see.
—Evidence of Conformance
What an assessor will ask to see.
A board-approved plan for the external assessment (8.4)
Assessor independence and qualifications, including an active CIA (8.4)
Results of internal assessments and their action plans (12.1)
Action plans from the previous external assessment, tracked to closure (8.3)
How ControlVista Supports It
The ControlVista audit record
Five years of plans, working papers, review sign-offs and remediation in one traceable record — so an assessor samples the system rather than waiting for files to be found.
—Further Reading
From our resources.
—IIA 2024 Hub
More on the Standards.
—Frequently Asked
Questions audit leaders ask.
How often is an external quality assessment required?
At least once every five years under Standard 8.4.
Who can perform the external quality assessment?
A qualified, independent assessor or assessment team, with at least one person holding an active Certified Internal Auditor (CIA) designation.
Is a self-assessment acceptable?
A self-assessment with independent validation by a qualified, independent assessor is an accepted approach under Standard 8.4.
Last reviewed October 2026. Standards references paraphrase The IIA's Global Internal Audit Standards (2024); they are not a substitute for the official text.
—Request a demo
See ControlVista run your audit lifecycle, end to end.
A 30-minute walkthrough with the team that built it — from the audit universe to the board-ready committee pack, in English and Arabic.
A product of Vantage Technologies.