An expert conversation on External Quality Assessments, the evolving role of Internal Audit, and what it takes to create lasting organisational value.
An External Quality Assessment (EQA) is more than an exercise in demonstrating compliance. It is an opportunity to evaluate whether an Internal Audit function is independent, strategically aligned, effective and equipped to help an organisation navigate an increasingly complex risk environment.
At the UAE Internal Auditors Association (IAA) CAE Conference 2026, Reefat Maniar, COO & Partner – Internal Audit and Nadeem Maniar, Partner, explored some of the common misconceptions surrounding EQAs, what assessors look for beyond documentation, and how Internal Audit functions can prepare for the challenges ahead.
In this candid Q&A, Reefat shares her perspective on moving beyond compliance towards credibility, influence and measurable impact.
1. Rethinking the EQA: Myths vs Reality
What is the biggest myth about EQAs that refuses to go away?
The biggest myth is that an EQA is an inspection designed to catch Internal Audit doing something wrong. I see it differently. An EQA evaluates conformance, but its real value lies in understanding whether the function is trusted, strategically relevant and capable of improving the organisation.
A polished methodology may get you through the front door, but it will not carry you through the entire assessment if the work does not influence decisions or address the risks that matter.
What should keep a Chief Audit Executive awake the night before an EQA, and what should not?
An untidy file or a missing document can cause unnecessary anxiety. My advice is not to lose sleep over an imperfect template. The more important questions are whether the function can explain why it audits what it audits, how it evaluates its effectiveness, and whether the board and management recognise the value it delivers.
No function is perfect. What concerns me is a function that cannot recognise, discuss or address its own weaknesses.
How much of an EQA is really about documentation?
Documentation is evidence, but it is not the whole story. It tells me what the function intended to do. Interviews, workpapers, stakeholder feedback and outcomes help establish what it actually did.
For example, if the Internal Audit Charter states that the function is strategically aligned, but the audit plan has not evolved despite significant changes in the business, the documentation and reality are moving in different directions.
Can you tell early in an assessment whether an Internal Audit function will perform well?
I can usually form an early hypothesis, but would never treat it as a conclusion. It is important to look for consistency.
Does the Chief Audit Executive describe the same purpose that the audit team demonstrates? Do the audit committee and management recognise the same value proposition? Do the audit plan, resources, fieldwork and reporting connect?
Strong functions establish a clear link between strategy, risk, assurance, insight and follow-up. The next step is to test that connection against the evidence.
2. What Quality Assessors Really Look For
What is the first thing you ask for when you walk into an audit function?
I begin by asking the Chief Audit Executive to explain, in plain language, how the audit plan connects to the organisation's strategy and most significant risks.
Before opening a file, the understanding of the logic behind the function is key. What is the organisation trying to achieve? What could prevent it from succeeding? Where does Internal Audit provide assurance, where does it advise, and where are the gaps?
The audit plan is more than a schedule. It reflects the function's priorities and its willingness to address the issues that matter most.
What do Chief Audit Executives often consider their greatest strength, but assessors may view differently?
Stakeholder satisfaction is a common example. A Chief Audit Executive might say, "Management likes us and the audit committee supports us." That is positive, but popularity is not the same as effectiveness.
I look for constructive challenge, independence of mind and evidence that the function addresses difficult issues, even when the findings are uncomfortable.
The strongest Internal Audit functions are respected, not merely liked.
What separates an audit function that complies from one that genuinely creates value?
A function focused on compliance can demonstrate that it followed a process. A value-creating function can demonstrate how its work helped change a decision, strengthen a control, identify an emerging risk or improve organisational resilience.
The difference is not about abandoning standards. It is about using them as a foundation for meaningful impact.
I look for insight, foresight and influence, not simply completed testing.
What is harder: being independent or being relevant?
I would say relevance, because independence can be supported through an appropriate mandate, reporting lines, access and safeguards. Relevance, however, has to be earned continuously.
That said, relevance without independence can become agreement, while independence without relevance can become isolation.
Strong Internal Audit functions need both: the courage to say what must be said and the judgement to communicate it in a way that leads to action.
3. The Future of Internal Audit Quality
Five years from now, what will assessors expect that many functions are not ready for today?
Greater scrutiny of how Internal Audit provides assurance over digital transformation, data, artificial intelligence, cybersecurity, third-party ecosystems, organisational culture and resilience. Assessors will also consider how functions govern their own use of technology.
It will not be enough to invest in new tools. Functions will need to demonstrate that they have the right skills, ethical safeguards, reliable data, an understanding of model risk and the professional judgement to challenge what technology produces.
The future-ready function will combine technological capability with professional scepticism and a strong understanding of the business.
Will AI change the way quality assessments are performed?
Yes. AI can help assessors analyse larger volumes of reports and workpapers, identify recurring themes, compare documentation and highlight inconsistencies.
However, it cannot replace professional judgement. AI may identify a pattern, but an assessor still needs to understand its context, verify the evidence and evaluate its significance and impact.
The assessor of the future will use AI as a powerful analytical aid, not as the final decision-maker.
Looking ahead, which matters most: conformance, insight, influence or impact?
Impact is the destination, but the other three are the route.
Conformance provides discipline and a foundation for credibility. Insight makes the work relevant. Influence helps that insight reach the right decision-makers. Impact demonstrates whether something has improved.
I would not trade one for another. The objective is to connect them: conformance should enable insight, insight should create influence, and influence should lead to impact.
4. The Takeaway: Prepare to Improve, Not to Look Perfect
If readers remembered only one thing from this conversation, what should it be?
Do not prepare for an EQA by trying to look perfect. Prepare by becoming more honest, more aligned and more useful.
The strongest Internal Audit functions are not only those with no findings. They also understand their environment, recognise changing risks and have the courage to adapt.
Ultimately, an EQA should be viewed as more than a compliance exercise. It is an opportunity to understand whether the Internal Audit function has the credibility, capability and independence to help the organisation navigate risk and create value.
The real measure of quality is not simply whether the function can demonstrate that it followed the right process. It is whether that process enables Internal Audit to make a meaningful difference.