Every five years, the audit committee must commission an independent external quality assurance review of the internal audit function.