Our IA function was recently outsourced. Is an external QA required and if so when does the five-year period begin?

Yes. An external QA is required, regardless of whether the internal audit activity was in-house or outsourced. The five-year requirement began when the IA activity was first enacted, regardless of whether it was outsourced, co-sourced, or in-house. Adoption of the Standards establishes the intent of the IA activity to comply, and as a result is considered the starting point of the five-year period before an external QA is required. Evidence to examine to support the date of the adoption of the Standards would include audit committee minutes, updates to the audit charter, and the use of the phrase "conducted in conformance with the Standards" in audit reports, etc.