Our external audit already performs phishing tests, should we conduct phishing tests ourselves?

It depends on your organization. It is much like vulnerability scans. Even though an audit or security firm may perform such tests annually, it does not mean that a company has no need to perform such tests more frequently. Contact Us if you would like to discuss your specific situation.