All Things Internal Audit: Tales from the EQA Trenches

In this episode, IIA Quality Services advisors share firsthand experience conducting external quality assessments (EQAs) in alignment with The IIA's Global Internal Audit Standards. From the importance of governance structure and CAE engagement to navigating the Standards, this episode highlights what makes a high-performing audit function and where even seasoned teams can stumble.

Host:

Warren Hersh, CIA, CISA, CPA, CFE

Director IIA Quality Services

Guests:

Susan Verghese, CIA, CISA

Lead Quality Advisor for IIA Quality Services LLC

Keith Kahl, CIA, CPA, CFE, CGMA, CRMA

Kahl Professional Services LLC
Lead Quality Advisor for IIA Quality Services LLC

Hania Abrous-McCarthy, CIA, CPA, CRMA, CGMA, CFE

Managing Director at Gladclif LLC
Lead Advisor for IIA Quality Services LLC

Key points

Introduction [00:00–00:00:56]
Welcome to Tales from the EQA Trenches — Introducing The IIA’s Quality Services team.
Common Challenges When Starting an EQA [00:01:07–00:05:36]
Susan Verghese discusses why understanding governance structures is critical, how CAE attitudes impact assessment outcomes, and common improvement areas like charters, manuals, and assurance mapping.
Governance and Leadership Support Make or Break Audit Quality [00:05:36–00:07:55]
Keith Kahl contrasts two real-world audit functions—one struggling under limited support and another thriving with strong audit committee engagement and trust.
Opportunities Under the New Global Standards [00:07:55–00:10:56]
Hania Abrous-McCarthy highlights how the new Standards give CAEs a chance to reset their functions, refresh independence, and fine-tune internal audit’s value proposition.
Advice for Organizations Preparing for EQAs [00:10:56–00:11:59]
Warren Hersh encourages teams to use the IIA’s Standards Knowledge Center and Quality Services webpage for resources like the Conformance Readiness Tool and insights on QAIPs and topical requirements.
Closing and Future Episodes [00:11:59–00:12:16]
Warren previews more “Tales from the Trenches” stories coming soon from The IIA’s Quality Services team.

IIA related content

Interested in this topic? Visit the links below for more resources:

Visit The IIA's website or YouTube channel for related topics and more.

View more episodes

00:00:02 The IIA

The Institute of Internal Auditors presents All Things Internal Audit.

00:00:06 The IIA

In this episode, we're welcoming you to the tales from the EQA trenches.

00:00:10 The IIA

We're taking you behind the scenes with the IIA's Quality Services team to hear what they're seeing in the field during external quality assessments.

00:00:17 The IIA

The wins, the challenges, and the lessons learned.

00:00:20 The IIA

Joining this episode is Warren Hirsch, Director of IIA's Quality Services.

00:00:25 The IIA

along with lead quality advisors, Susan Verghese, Keith Call, and Henia Abruce-McCarthy.

00:00:31 The IIA

So Warren, let's start with you.

00:00:32 The IIA

You've reviewed countless audit functions around the world.

00:00:35 The IIA

So what made you want to capture these stories and share them with our listeners today?

00:00:39 Warren Hersh

Well, Katie, our mission at IA Quality Service is to elevate internal audit quality around the world.

00:00:45 Warren Hersh

So we feel by sharing our stories, the trends that we're seeing, any emerging issues that we're able to help expand and meet that mission.

00:00:55 Warren Hersh

for internal auditors.

00:00:56 Warren Hersh

Today, we're diving into the world of external quality assessments, EQAs, conducted in alignment with the IA Global Internal Audit Standards.

00:01:04 Warren Hersh

So let's get into some of these examples.

00:01:07 Warren Hersh

We'll start with Susan Bergeese and hear what challenges tend to surface most often when starting a new external quality assessment.

00:01:15 Susan Verghese

The most important thing that we need to do is understand the structure of the organization and their governance.

00:01:23 Susan Verghese

How is that managed?

00:01:25 Susan Verghese

The reason why this becomes very important is these standards apply to every kind of organization.

00:01:32 Susan Verghese

However, the kinds of organizations that request these external quality assessment reviews are of completely different natures.

00:01:42 Susan Verghese

I personally have done organizations that are family run, where the internal audit is completely outsourced and there is just one individual in the organization that is managing this outsourced internal auditing.

00:01:58 Susan Verghese

We look at the US branches of various foreign banks,

00:02:03 Susan Verghese

government organizations, international organizations, and each one of these has a different kind of governance structure.

00:02:11 Susan Verghese

And that kind of brings up the requirement that whoever is doing these external quality assessments, we need to be really experienced in dealing with different kinds of organizations so that we can apply the global internal standards appropriately.

00:02:29 Susan Verghese

and not sort of call out because one organization does or does not have an audit committee or a board as is defined by the standard.

00:02:40 Susan Verghese

A second aspect about doing these quality assessment reviews is the benefit that the organization can get out of doing this external quality assessments very largely depends upon the CAE.

00:02:55 Susan Verghese

In doing some of these external quality assessment reviews, we've come across CAEs who are very eager to learn.

00:03:03 Susan Verghese

This may be the first time, or they may be multiple times that they have done it, and they are very eager to learn what is going on in the profession and other organizations, and how can I apply it to my own organization in order to improve myself.

00:03:19 Susan Verghese

So the mindset of the CAE is to learn and to improve.

00:03:24 Susan Verghese

We also come across some CAEs who feel that they know it all and are just going through the motions because it is required.

00:03:33 Susan Verghese

The amount of interaction that you tend to get with these kind of CAEs then kind of becomes very limited.

00:03:41 Susan Verghese

And in some cases, we end up, say, talking to somebody who is responsible for making sure the EQA is done,

00:03:49 Susan Verghese

And the CAE doesn't even meet the external quality assessment team, which for us is not quite the way you need to be approaching this.

00:03:57 Susan Verghese

And then we also have CAEs who like to be perfectionists, as I call it, because all they're interested in is I want the highest rating you can possibly give because

00:04:10 Susan Verghese

I think we are doing everything the way we need to do it.

00:04:13 Susan Verghese

And so that again means that when we come up with issues that need to be fixed, it becomes a very defensive stand or it becomes a long drawn out argument, which doesn't help.

00:04:27 Susan Verghese

In looking at some of the EQAs and gap assessments that we have done in the last couple of rounds, we find that some of the common issues that

00:04:36 Susan Verghese

we have noticed is relates to updating the internal audit and the audit committee charters, the internal audit manual, making sure that there is a strategic plan in place, if possible, looking at an assurance map, having that available, as well as using the IIA competency module, a model that is available online.

00:04:59 Susan Verghese

Another key issue that I seem to come across almost in every organization is the new standards require that domain 3 must be discussed by the CAE with the audit committee and senior management.

00:05:14 Susan Verghese

Domain 3 really talks about the oversight of the internal audit function and there are certain essential conditions that are outlined in the standards.

00:05:26 Susan Verghese

00:05:27 Susan Verghese

The CAE must discuss the, as well as document that this discussion has happened.

00:05:32 Susan Verghese

And those are some of the key things that I find.

00:05:36 Warren Hersh

Now we'll hear from Keith Kahl, who's seen that contrast firsthand.

00:05:39 Warren Hersh

Let's hear his example of how the environment made all the difference.

00:05:43 Keith Kahl

Not so much for us doing the quality assessment, but for the interwar and function.

00:05:48 Keith Kahl

On paper, the reporting relationship was direct to the audit committee.

00:05:52 Keith Kahl

and then dotted line to the chief accounting officer.

00:05:55 Keith Kahl

So the director of the audit committee was fine, very good, but the chief accounting officer is 1 level below the CFO.

00:06:02 Keith Kahl

The challenges were there was very little interaction between the CAE and the audit committee.

00:06:07 Keith Kahl

The audit committee really didn't support the internal audit function.

00:06:11 Keith Kahl

The chief accounting officer had roles beyond typical chief accounting officer, actually had some more operational roles like customer service billing,

00:06:21 Keith Kahl

in some other duties.

00:06:23 Keith Kahl

The chief accounting officer also tried to influence the audit reports in the internal audit team.

00:06:29 Keith Kahl

00:06:30 Keith Kahl

So this made it very difficult for internal audit to be accepted within the organization because also the CEO and CFO did not support internal audit.

00:06:39 Keith Kahl

They had no interest really in regularly meeting with the internal audit team.

00:06:44 Keith Kahl

And that cascaded down to management not really fully cooperating during audits.

00:06:49 Keith Kahl

So this resulted in an overall partially conforms for the internal audit function.

00:06:55 Keith Kahl

Complete opposite story is where on the charter, the chief audit executive reported direct to the audit committee.

00:07:05 Keith Kahl

The administrative reporting was to the CEO.

00:07:08 Keith Kahl

The audit committee and the CEO, CFO, and other senior executives highly supported

00:07:16 Keith Kahl

the internal audit function.

00:07:18 Keith Kahl

They met with the CAE on a regular basis.

00:07:22 Keith Kahl

The audit committee chair met at least monthly with the CAE.

00:07:26 Keith Kahl

On A bi-weekly basis, the CAE met with the CEO and CFO, and then typically with the other senior executives at least monthly.

00:07:34 Keith Kahl

Management routinely called in audit for recommendations, advice, insight, and foresight.

00:07:41 Keith Kahl

And this cascaded down throughout the organization where people regularly called on audit for insight, foresight, and advice on potential issues, how to manage risks.

00:07:52 Keith Kahl

Overall, they got a fully achieves rating.

00:07:55 Warren Hersh

Building on that with the new global internal audit standards now in effect, Henia will share how these changes are giving CAEs a chance to reset and strengthen their functions.

00:08:05 Hania Abrous-McCarthy

The new audit standards present an interesting inflection point and possibly opportunities for CAEs to go back to the basics.

00:08:14 Hania Abrous-McCarthy

Review the audit manual, go back to the team, make sure that the standards that surround what we do and how we do it are clear.

00:08:22 Hania Abrous-McCarthy

It's an opportunity to refresh around independence.

00:08:27 Hania Abrous-McCarthy

review the reporting lines, which is frequently something that we come across as advisors performing EQAs and gap analyses around organizations to consider the documentation of how we're adhering to the standards.

00:08:43 Hania Abrous-McCarthy

In terms of what we're seeing, what I'm seeing, you know, there's obviously going to be a range.

00:08:49 Hania Abrous-McCarthy

It can be driven partially by a maturity curve, but also environmental conditions.

00:08:56 Hania Abrous-McCarthy

One example, in a governmental entity where there is a brand new CAE, the culture in that particular governmental agency has presented some challenges.

00:09:08 Hania Abrous-McCarthy

And with the new standards and are performing an analyses, it does allow for providing that particular organization with

00:09:19 Hania Abrous-McCarthy

with some recommendations that support the CAE, that support the standards and help the CAE go back out to the audit committee as well as senior leadership with what is best practice out there around governmental entities, but also entities in general.

00:09:37 Hania Abrous-McCarthy

Another challenging situation was a global public company.

00:09:42 Hania Abrous-McCarthy

The CAE had been there forever.

00:09:44 Hania Abrous-McCarthy

And somehow they had no charter and no audit manual.

00:09:49 Hania Abrous-McCarthy

Everything had just been done because that's how we did it last year.

00:09:53 Hania Abrous-McCarthy

So our working with the organization was an opportunity to help them go out there and start formalizing their processes and bringing them in to line with the new standards.

00:10:04 Hania Abrous-McCarthy

All the way on the other side of the range,

00:10:07 Hania Abrous-McCarthy

is an internal audit shop that had been very successfully able to position itself as a value add to their organization from a regulatory perspective as the key interface with the regulators.

00:10:22 Hania Abrous-McCarthy

the internal audit team was able to demonstrate that the organization had been listening to the regulators, remediating in line with what they were looking for and really successfully partnering.

00:10:34 Hania Abrous-McCarthy

And that was incredibly obvious through the interview process.

00:10:39 Hania Abrous-McCarthy

And they were really able to go out there to the regulators and champion the value of their organization.

00:10:46 Hania Abrous-McCarthy

There's definitely a range and there's an opportunity with the new standards.

00:10:50 Hania Abrous-McCarthy

for an internal audit team and a CAE to fine-tune their value proposition to an organization.

00:10:56 The IIA

So Warren, before we close, for organizations listening who might be preparing for an external assessment, what's one piece of advice you'd leave them with?

00:11:04 Warren Hersh

I would encourage them to access the IA website, specifically the Standards Knowledge Center as one, because there's a lot of things up there that could help them.

00:11:14 Warren Hersh

One would be the conformance readiness tool, the performance measurement tool,

00:11:19 Warren Hersh

There's global guidance on strategic planning.

00:11:22 Warren Hersh

There's a whole bunch of other things up there that you would probably want to look at.

00:11:26 Warren Hersh

The key thing is the conformance readiness tool.

00:11:28 Warren Hersh

That really lays out all the new standards.

00:11:31 Warren Hersh

The second thing is I would access the quality services webpage on the IAA website.

00:11:36 Warren Hersh

We publish a ton of information, including our insights to quality on a number of topics.

00:11:42 Warren Hersh

For example, strategic planning, QAIP, we just published one on conformance with the topical requirements.

00:11:49 Warren Hersh

So there's a lot of information up there.

00:11:51 Warren Hersh

And of course, if you have any questions, you can always schedule a consultation with us at Quality Services, and we can answer any of your technical questions.

00:11:59 The IIA

Thank you, Warren, and your team for sharing your tales from the EQA trenches.

00:12:03 Warren Hersh

Thank you.

00:12:03 Warren Hersh

Well, we look forward to more episodes like this with some of our expert quality advisors from Quality Services, and we'll share more stories and more insights.

00:12:12 Warren Hersh

So look for more of these episodes in the future.

00:12:16 The IIA

Ready to lead with confidence?

00:12:18 The IIA

Join the IIA's 2025 RISE Virtual Conference on December 5th, all online.

00:12:25 The IIA

Earn up to 7.2 CPEs while diving into resilience, innovation, strategy, and ethics with today's top audit leaders.

00:12:35 The IIA

Save your spot now at theia.org.

00:12:38 The IIA

If you like this podcast, please subscribe and rate us.