Almost every requirement placed on an internal audit function concerns how it examines somebody else. The external quality assessment is the exception. For a few weeks every five years, the function is the auditee — and the evidence under examination is its own.
For a Saudi audit function, the requirement now arrives from two directions at once — two of the three layers governing internal audit in the Kingdom.
Two rulebooks, one cycle
Under the IIA 2024 Global Internal Audit Standards, quality is governed by Principle 12, Enhance Quality. The internal side — periodic self-assessment, performance measurement, and communicating results to the board and senior management — runs through Standard 12.1. The external commitment sits under Standard 8.4: an external quality assessment at least every five years, satisfied either by a full EQA or by a self-assessment with independent validation (SAIV).
Under SAMA's Principles of Internal Auditing for Local Banks, the audit committee is responsible for arranging an independent external quality assessment on the same five-year cadence.
What an assessor is actually testing
An EQA is a conformance assessment against the Standards. In practice that resolves into a small number of questions the assessor will keep returning to, and none of them can be answered with an assertion:
- Is the risk assessment behind the plan documented and refreshed? Show the versions, and what changed between them.
- Did the board approve the plan, and can you show the trail from risk to plan to engagement? Not a slide asserting it — the record.
- Was the preparer → reviewer → approver chain intact on engagements? Sampled, at random, across the period.
- Were findings tracked to a verified close? Including the ones that slipped, and what escalation actually happened.
- Is the function independent in operation, not just on the org chart? Reporting lines, committee access, and what happened the last time a finding was uncomfortable for management.
Every one of those is a question about a trail that either exists or does not. The assessment does not reward a function that intended to do the right thing; it rewards a function that can prove it did.
The reconstruction problem
This is why the EQA is quietly brutal on functions running the lifecycle in spreadsheets and email.
Nothing about Excel prevents good audit work. What it prevents is cheap evidence of good audit work. Sign-off that lived in an email thread has to be found and reassembled. Plan versions overwritten in place cannot be diffed. A finding closed on the basis of a conversation has no artefact behind it. None of that means the work was poor — but four years later, "we did do that" and "here is the record" are very different answers to give an assessor.
The reconstruction is also expensive at exactly the wrong moment. A function preparing for an EQA is usually still running a full plan.
Preparing without a scramble
The functions that go through an EQA calmly tend to have done one thing: made the evidence a by-product of the work rather than a deliverable produced for the assessor.
That means the universe and its risk scoring carry version history. The plan records committee approval as a state, not a memory. Working-paper review is captured when the review happens. Findings carry ownership, ageing, escalation and verified closure as structured data. Committee reporting is generated from the same record the engagements produced.
Do that, and preparing for an assessment becomes a matter of running reports rather than rebuilding four years of history. It is the practical argument for running the lifecycle inside audit management software built around the IIA 2024 Standards, where conformance evidence falls out of the workflow — VistaField capturing sign-off as the work happens, VistaResolve tracking findings to a verified close, and VistaReport producing the committee view from the same record.
For Saudi functions weighing that decision, the deployment and residency detail sits on our audit management software for Saudi Arabia page, and the vendor comparison on best audit management software in Saudi Arabia.
See the platform or request a demo.