Coordinating with and Relying on Other Assurance Providers

Overview
Internal audit is rarely the only function giving assurance to the board and senior management. Risk management, compliance, information security, quality assurance, health and safety, external auditors, regulators and specialist consultants all examine parts of the organization's governance, risk management and control. The CIA Challenge Exam expects you to know how the chief audit executive (CAE) coordinates with these providers, when internal audit may rely on their work, and who stays accountable when it does.

1. Why It Is Important
Efficiency: Coordination reduces duplicated effort, gaps in coverage and audit fatigue among managers who are reviewed by several functions.
Comprehensive coverage: Combining internal audit's work with other providers' work lets the CAE give a broader, more reliable view of risk across the organization.
Better information for the board: The board gets one consistent picture of assurance instead of fragmented or conflicting reports.
Better use of resources: Internal audit can focus on high-risk areas that no one else covers, or that other providers cover poorly.
Professional requirement: The IIA Global Internal Audit Standards (Domain IV, Principle 9, Standard 9.5 Coordination and Reliance) require this activity. It was formerly Standard 2050 under the IPPF.

2. What It Is
Coordination means aligning the timing, scope, methods and reporting of assurance activities among providers. The aim is to reduce duplication and close gaps.
Reliance means internal audit uses the work of another provider as part of the evidence for its own conclusions, instead of repeating that work.

Types of assurance providers:
Internal providers (often second-line roles under the IIA Three Lines Model):

• Risk management
• Compliance
• Information security
• Quality
• Environmental, health and safety
• Internal control and SOX teams
• Legal

First-line management also contributes through control self-assessments. Because it is not independent, it is the least objective source.
External providers:

• External (statutory) auditors
• Regulators and examiners
• Certification bodies, such as ISO auditors
• Outsourced specialists and consultants
• Service organization auditors, who issue SOC 1 and SOC 2 reports

Key tools:
Assurance map: A matrix that lists significant risks or risk areas against the providers covering them. It shows the extent and nature of coverage and reveals gaps and overlaps.
Combined (integrated) assurance: A coordinated approach in which the providers align their efforts and report a consolidated view to the board.

3. How It Works
Step 1 - Identify providers. The CAE identifies all internal and external providers and understands each one's objectives, scope, methods and reporting lines.

Step 2 - Map coverage. The CAE builds or updates an assurance map against the organization's key risks. This shows where the risks are covered, where coverage is duplicated and where gaps exist.

Step 3 - Coordinate. The CAE agrees with the other providers on:

• Timing of work
• Shared terminology and risk-rating scales
• Information sharing, such as access to work papers and reports
• Reporting formats

Coordination with the external auditor usually includes sharing audit plans, discussing control findings and agreeing on areas of mutual reliance.

Step 4 - Evaluate whether reliance is appropriate. Before relying on another provider's work, the CAE evaluates the following:

• Independence and objectivity: Reporting lines, conflicts of interest, and whether the provider is assessing its own work.
• Competence: Qualifications, experience and professional certifications.
• Due professional care: The quality of the methodology, planning, supervision, documentation and evidence.
• Scope, objectives and results: Whether the work is relevant to internal audit's objectives and covers the right period and risks.
• Consistency of findings: Whether the conclusions are consistent with internal audit's own knowledge.

Step 5 - Decide the degree of reliance. Reliance can take three forms:

• Full reliance: Rare, and only for high-quality, objective providers.
• Partial reliance: Internal audit re-performs selected tests or reviews the other provider's work papers.
• No reliance: Internal audit performs the work itself.

The higher the risk, the more internal audit should verify independently.

Step 6 - Document and communicate.

• The CAE documents the basis for relying on the other provider's work.
• If the CAE decides not to rely, the reasons are documented.
• The coordination approach and reliance decisions are reflected in the internal audit plan and communicated to senior management and the board.

Step 7 - Retain responsibility. Even when relying on others, the CAE and internal audit stay fully responsible for their own conclusions and opinions. Reliance never transfers accountability.

4. Common Scenarios

• External auditor wants to use internal audit's work: Internal audit cooperates and shares information. The external auditor makes its own evaluation under its own standards. Internal audit's independence and priorities must not be compromised.
• Compliance has tested a regulatory control: Internal audit may rely on that testing after evaluating compliance's competence, objectivity and methodology. A sample of the testing may be re-performed.
• Management self-assessment: This has low objectivity, so it can inform risk assessment but generally needs independent validation.
• SOC report from a service provider: Check:
  • The report type. A Type 2 report covers operating effectiveness; a Type 1 report covers design only.
  • The period covered.
  • Any exceptions.
  • The complementary user entity controls.
• Gap found in the assurance map: The CAE considers including the area in the risk-based internal audit plan and informs the board.

Exam Tips: Answering Questions on Coordinating with and Relying on Other Assurance Providers
1. Remember who is accountable. The CAE remains responsible for internal audit's conclusions even when relying on others. Reject any option that says responsibility shifts to the other provider.

2. Evaluate before relying. The correct answer usually involves assessing objectivity, competence and due professional care before accepting the work. Be wary of options that accept work at face value, even from reputable firms.

3. Objectivity hierarchy. External independent providers and internal audit sit at the top. Second-line functions are in the middle. First-line self-assessments rank lowest. Choose the answer that applies more verification as objectivity decreases.

4. Know the assurance map. If a question asks for the best tool to identify gaps and overlaps in assurance coverage, the answer is typically an assurance map.

5. Documentation is required. Expect answers stating that the basis for reliance, or the reasons for not relying, must be documented.

6. Coordination is the CAE's role. The board oversees and senior management supports, but the CAE coordinates. Watch for questions asking who should take the lead.

7. Purpose of coordination. The best answer usually mentions both reducing duplication and ensuring proper coverage, not just cutting costs.

8. Independence is never sacrificed. Coordinating with external auditors or regulators must not compromise internal audit's independence or let others dictate the audit plan.

9. Look for key words. Terms such as first, most appropriate and best often point to the evaluation step, like reviewing work papers or methodology, rather than final reporting.

10. Link to the audit plan. Reliance decisions affect the risk-based plan and resource allocation. Areas well covered by reliable providers may get less internal audit attention, while uncovered high-risk areas get priority.

Sample Question
The compliance function has completed testing of anti-money-laundering controls, and the CAE wants to avoid duplicating this work. What should the CAE do first?
A) Include compliance's conclusions directly in the internal audit report.
B) Evaluate the competence, objectivity and methodology of the compliance function's work.
C) Ask the board to approve transferring responsibility for AML assurance to compliance.
D) Re-perform all of compliance's testing.
Answer: B.

• A skips the required evaluation.
• C is wrong because accountability cannot be transferred.
• D defeats the purpose of coordination.

Summary
Coordination aligns assurance efforts to reduce duplication and close gaps, often through an assurance map. Reliance allows internal audit to use others' work after evaluating:

• Objectivity
• Competence
• Due professional care
• Relevance of scope

The CAE documents the basis for reliance and always retains responsibility for internal audit's conclusions.