Declining or Adjusting Work That Lacks Competence
5 minutes
5 Questions
In the Certification in Risk Management Assurance (CRMA) framework and the broader internal audit profession, the principle of declining or adjusting work that lacks competence is rooted in the IIA's Global Internal Audit Standards, particularly the Competency principle. Internal auditors must only accept engagements for which they possess, or can obtain, the necessary knowledge, skills, and experience. When auditors lack the required competence for an assurance or advisory engagement, they have a professional obligation to either decline the work or adjust its scope so that it falls within their capabilities, or secure competent advice and assistance. In risk management assurance roles, this is especially critical. Evaluating enterprise risk management (ERM) frameworks often requires specialized understanding of risk modeling, regulatory environments, information technology, or complex financial instruments. An auditor who proceeds without sufficient expertise risks issuing inaccurate conclusions, giving management and the board false assurance, and ultimately undermining the credibility of the internal audit function. The Chief Audit Executive (CAE) bears primary responsibility here. The CAE must assess whether the internal audit function collectively holds the competencies needed before accepting an engagement. If gaps exist, options include co-sourcing with external specialists, providing training, reassigning staff with relevant skills, narrowing the engagement objectives, or formally declining the engagement and communicating the reasons to senior management and the board. Declining or adjusting work is not a sign of weakness; it demonstrates integrity, objectivity, and due professional care. The IIA Code of Ethics requires auditors to perform only services for which they are qualified. Transparency is key: limitations in scope or competence must be disclosed in engagement communications so stakeholders can interpret results appropriately. For CRMA candidates, understanding this principle reinforces that credible risk assurance depends on honest self-assessment, continuous professional development, and the courage to set boundaries that protect both the organization and the profession's reputation.
Declining or Adjusting Work That Lacks Competence (IIA CRMA: Internal Audit Roles and Responsibilities)
Overview
One of the most fundamental professional obligations of an internal auditor is to perform only the work for which they are competent. The Institute of Internal Auditors (IIA) builds this requirement directly into its ethical principles and its Standards: when an internal auditor or an internal audit function does not possess the knowledge, skills, and abilities needed to perform an engagement with due professional care, the work must be declined, deferred, modified in scope, or supplemented with competent assistance. For the CRMA exam, this concept sits inside the Internal Audit Roles and Responsibilities domain and connects closely to independence, objectivity, due professional care, and the limits of assurance the internal audit function can provide over risk management.
Why It Is Important
1. Protects the credibility of assurance. Internal audit exists to give the board and senior management reliable, independent assurance over governance, risk management, and control. An opinion issued by someone who did not understand the subject matter is not assurance; it is false comfort. If the board relies on an unqualified assessment of, say, a complex derivative hedging program or a cybersecurity architecture, and the auditor lacked the expertise to evaluate it, the organization may be exposed to serious, unrecognized risk.
2. It is an ethical requirement, not merely a quality preference. The IIA Code of Ethics principle of Competency requires internal auditors to apply the knowledge, skills, and experience needed in the performance of internal audit services and to engage only in those services for which they have the necessary knowledge, skills, and experience. Under the Global Internal Audit Standards, Principle 3 (Demonstrate Competency) and Standard 3.1 (Competency) carry the same obligation forward and add a specific duty to communicate when competence is lacking.
3. It is a shared responsibility of the individual auditor and the Chief Audit Executive (CAE). The individual auditor must recognize and disclose their own limitations. The CAE must ensure the function collectively has the competencies to execute the audit plan, and when it does not, must obtain competent advice and assistance (co-sourcing, outsourcing, guest auditors, subject-matter experts) or decline the engagement and inform the board.
4. It intersects with risk management assurance specifically. CRMA candidates are expected to understand that assurance over enterprise risk management (ERM) often requires specialized knowledge: quantitative risk modeling, actuarial concepts, regulatory capital frameworks, cyber risk, environmental and climate risk, and so on. Internal auditors frequently face pressure to opine on these areas. Knowing when to adjust the scope, bring in experts, or decline protects both the auditor and the organization.
5. It protects the organization legally and reputationally. Incompetent assurance can mislead regulators, investors, and the board; it can expose the organization and the auditor to liability; and it undermines confidence in the entire internal audit function.
What It Is
Declining or adjusting work that lacks competence means that, before accepting and while performing an engagement, the internal auditor and the CAE assess whether the required knowledge, skills, and abilities are available. If they are not, there are several professional responses, generally applied in this order of preference:
Obtain competent assistance. Engage internal or external subject-matter experts, co-source or outsource the specialized portion, borrow a guest auditor from another department (while safeguarding objectivity), or provide targeted training if time permits.
Adjust the scope or objectives. Narrow the engagement to the areas the team can competently assess, and clearly communicate the limitation in the engagement scope and final report so that stakeholders understand exactly what was and was not covered.
Defer the engagement. Postpone until the needed competence is obtained, if the risk and timing allow.
Decline the engagement. When assistance cannot be obtained and the scope cannot be meaningfully adjusted, the work should not be performed as assurance. The CAE communicates this to senior management and the board, explaining the gap and its implications for the audit plan and for risk coverage.
Importantly, this is distinct from declining work because of impairment to independence or objectivity (for example, auditing an area the auditor managed within the past year). Competence is about ability; objectivity is about bias. The two can occur together, but the exam will often test whether you can tell them apart.
Key Standards and Ethical References
IIA Code of Ethics, Competency principle and rules of conduct: internal auditors shall engage only in those services for which they have the necessary knowledge, skills, and experience; shall perform services in accordance with the Standards; and shall continually improve their proficiency.
Global Internal Audit Standards, Principle 3 and Standard 3.1 (Competency): internal auditors must possess or obtain the competencies to perform their responsibilities; they must not undertake an engagement for which they lack the competencies unless they are supervised by someone who has them; and they must communicate to the CAE when they lack the competencies required.
Standard 4.2 (Due Professional Care): competence is a precondition for exercising due care.
Standard 10.2 (Human Resources Management): the CAE must ensure the function collectively possesses the competencies needed to fulfill the internal audit mandate and must obtain external assistance when gaps exist.
Standard 8.3 / 9.4 context (Quality and Resources): the CAE must inform the board and senior management when resource limitations, including competency gaps, affect the function's ability to deliver the plan.
Legacy Standards (still useful for understanding): 1210 Proficiency, 1210.A1 (CAE must obtain competent advice and assistance if staff lack the knowledge, skills, or other competencies to perform all or part of the engagement), 1210.C1 (the CAE must decline a consulting engagement or obtain competent advice and assistance if the staff lack competence), and 1220 Due Professional Care.
How It Works in Practice
Step 1: Competency assessment at planning. During annual risk-based planning and again at individual engagement planning, the CAE maps required competencies against the team's skills inventory. Specialized engagements (IT, actuarial, treasury, fraud forensics, ESG, model risk, regulatory capital) are flagged early.
Step 2: Individual self-assessment and disclosure. Each auditor is obligated to speak up when assigned work beyond their competence. Silence is a violation of the Code of Ethics. The auditor informs the engagement supervisor or CAE as soon as the gap is identified, including mid-engagement if it becomes apparent only after fieldwork begins.
Step 3: Evaluate options. The CAE weighs: Can an expert be engaged in time? Is budget available? Can another team member supervise who has the competence? Can the scope be reduced while still meeting the engagement objective? What is the risk to the organization if the engagement is deferred or declined?
Step 4: Use of experts. When experts are used, the internal auditor remains responsible for the engagement conclusions. The auditor must understand the expert's objectives, scope, methods, and assumptions well enough to evaluate the reasonableness of the work, must assess the expert's qualifications, independence, and objectivity, and must document reliance in the workpapers.
Step 5: Adjust and communicate. If scope is modified, the engagement objectives, scope, and limitations are revised in the planning memorandum and communicated to engagement clients. The final report explicitly describes any scope limitation and its effect on the conclusion. Stakeholders must never be left to assume coverage that did not occur.
Step 6: Escalate and document. If work is declined or significantly limited, the CAE informs senior management and the board, explains the risk-coverage gap, and recommends alternatives (external assurance providers, management self-assessment, second-line reviews). The decision and rationale are documented.
Step 7: Close the gap long term. Competency gaps feed into the function's training plan, recruiting strategy, and resourcing requests, consistent with the requirement for continuous professional development and the Quality Assurance and Improvement Program (QAIP).
Consulting versus Assurance Nuance
For assurance engagements, a lack of competence most often results in obtaining assistance or limiting scope, because the board needs the coverage. For consulting engagements, the Standards historically required the CAE to decline the engagement or obtain competent advice, since consulting is advisory and discretionary and management can obtain the advice elsewhere. On the exam, if a question involves a consulting request the team cannot competently perform and no expert is available, declining is usually the best answer.
Risk Management Assurance Application (CRMA focus)
Internal audit's core role in ERM is to provide assurance on risk management processes, on the evaluation of key risks, and on the reporting of key risks. Many of these areas are technically demanding. Typical exam scenarios include: being asked to validate a value-at-risk model, assess cyber threat intelligence, evaluate insurance reserve adequacy, review a climate scenario analysis, or opine on the effectiveness of a sophisticated quantitative risk appetite framework. The correct professional response is to recognize the specialized nature of the work, obtain competent assistance or adjust scope, and be transparent about limitations, rather than issuing a conclusion the team cannot support.
Common Pitfalls
Accepting the engagement to avoid disappointing management or the audit committee.
Assuming that reading a few articles or completing a short online course provides sufficient competence for a highly technical area.
Relying on an expert without understanding or evaluating the expert's work, and then presenting the conclusion as the internal auditor's own.
Failing to document the competency assessment and the rationale for scope changes.
Confusing a competence problem with an objectivity problem and applying the wrong remedy.
Quietly narrowing scope without telling the engagement client or the board, creating an expectation gap.
Letting management choose the external expert without the CAE assessing the expert's independence and qualifications.
How to Answer Exam Questions on This Topic
CRMA questions are scenario based and ask for the best or most appropriate action. Use the following reasoning sequence:
1. Identify the real problem. Is the issue a lack of knowledge, skills, or abilities (competence), or is it a conflict of interest, prior operational responsibility, or bias (objectivity)? Only apply competence remedies to competence problems.
2. Identify who has the obligation. If the scenario is written from the individual auditor's perspective, the answer usually involves disclosing the limitation to the CAE or supervisor. If it is from the CAE's perspective, the answer usually involves obtaining competent assistance, adjusting scope, or declining and informing the board.
3. Apply the hierarchy of responses. Prefer obtaining competent assistance first; adjust or limit scope with transparent disclosure second; defer or decline third. Declining outright is correct when assistance is unavailable, the engagement is consulting in nature, or any other approach would produce misleading assurance.
4. Look for transparency. Answers that involve hiding the limitation, issuing an unqualified conclusion anyway, or letting the client assume full coverage are always wrong.
5. Remember accountability when using experts. The internal auditor must still understand and evaluate the expert's work and remains responsible for the overall conclusion. Answers that say the auditor can simply rely on the expert without review are wrong.
6. Escalate appropriately. If the competency gap affects the audit plan or leaves a significant risk area without assurance, the board (audit committee) must be informed. Answers that stop at informing only the engagement client are usually incomplete.
Exam Tips: Answering Questions on Declining or Adjusting Work That Lacks Competence
Tip 1: Memorize the key phrase: engage only in services for which you have the necessary knowledge, skills, and experience. If an answer choice contradicts this, eliminate it immediately.
Tip 2: When the scenario says an auditor is assigned to a highly technical area and the options include proceed as planned, the correct answer is almost never proceed as planned. Look for the option that involves disclosure, obtaining expertise, or adjusting scope.
Tip 3: Watch for the word consulting. For consulting engagements lacking competence with no available expert, declining is the textbook response. For assurance engagements, obtaining competent advice and assistance is usually preferred before declining.
Tip 4: Distinguish competence from objectivity. If the auditor used to manage the area, that is an objectivity impairment (reassign the auditor). If the auditor has never worked with the subject matter and lacks the skills, that is a competence issue (obtain expertise or adjust scope). Exams love to mix these in distractors.
Tip 5: The CAE's collective responsibility is a frequent test point. The function as a whole must have the competencies; no single auditor must know everything. If a question asks what the CAE should do when staff lack skills, the answer is to obtain competent advice and assistance, not to cancel the audit plan or to perform the work personally regardless of expertise.
Tip 6: Any answer that involves issuing an opinion while silently narrowing the work, or that lets stakeholders believe full coverage was achieved, violates due professional care and integrity. Eliminate it.
Tip 7: When using an external expert, the best answer typically includes evaluating the expert's qualifications and objectivity, understanding the expert's work, and retaining responsibility for the conclusion. An answer that says the auditor can transfer responsibility to the expert is incorrect.
Tip 8: If the scenario involves mid-engagement discovery of a competence gap, the correct action is to stop, communicate to the CAE immediately, and reassess, not to finish quickly and note it informally afterward.
Tip 9: Think about the board. When a competency gap means a significant risk area cannot receive assurance, the CAE must report the limitation and its impact to senior management and the board. Choose answers that close the loop with governance.
Tip 10: Remember that declining work is a last resort but a legitimate and sometimes mandatory one. Do not be afraid to pick the decline option when the scenario makes clear that no assistance is available and any work performed would be unreliable.
Quick Scenario Practice
Scenario A: An audit committee asks internal audit to assess the adequacy of the insurer's actuarial reserving model. No one on the team has actuarial training. Best action: the CAE obtains competent actuarial assistance (co-source or external expert), supervises the work, retains responsibility for conclusions, and discloses the use of experts in the report. Declining is only appropriate if such assistance cannot be obtained.
Scenario B: Management requests internal audit to design and implement a new cyber risk quantification model as a consulting engagement. The team lacks the expertise and no budget exists for external help. Best action: the CAE declines the consulting engagement and explains why, suggesting alternative sources of expertise.
Scenario C: During fieldwork on an ERM assurance engagement, an auditor realizes the risk aggregation methodology relies on statistical techniques they do not understand. Best action: inform the engagement supervisor and CAE immediately so that competent assistance can be obtained or the scope can be adjusted and the limitation disclosed.
Scenario D: An auditor was the treasury risk manager eight months ago and is asked to audit treasury risk management. Best action: this is an objectivity issue, not a competence issue; the auditor should be reassigned even though they are highly competent.
Summary
Declining or adjusting work that lacks competence is a direct expression of the IIA's Competency principle and the Standards on proficiency, due professional care, and resource management. Individual auditors must disclose their limitations; the CAE must ensure collective competence, obtain assistance where needed, adjust or decline engagements transparently, and keep the board informed of any resulting gaps in risk coverage. On the CRMA exam, identify whether the issue is competence or objectivity, apply the hierarchy of obtain assistance, adjust scope, defer, or decline, insist on transparency, keep responsibility for expert work with the internal auditor, and escalate significant limitations to the board.
One of the most fundamental professional obligations of an internal auditor is to perform only the work for which they are competent. The Institute of Internal Auditors (IIA) builds this requirement directly into its ethical principles and its Standards: when an internal auditor or an internal audit function does not possess the knowledge, skills, and abilities needed to perform an engagement with due professional care, the work must be declined, deferred, modified in scope, or supplemented with competent assistance. For the CRMA exam, this concept sits inside the Internal Audit Roles and Responsibilities domain and connects closely to independence, objectivity, due professional care, and the limits of assurance the internal audit function can provide over risk management.
Why It Is Important
1. Protects the credibility of assurance. Internal audit exists to give the board and senior management reliable, independent assurance over governance, risk management, and control. An opinion issued by someone who did not understand the subject matter is not assurance; it is false comfort. If the board relies on an unqualified assessment of, say, a complex derivative hedging program or a cybersecurity architecture, and the auditor lacked the expertise to evaluate it, the organization may be exposed to serious, unrecognized risk.
2. It is an ethical requirement, not merely a quality preference. The IIA Code of Ethics principle of Competency requires internal auditors to apply the knowledge, skills, and experience needed in the performance of internal audit services and to engage only in those services for which they have the necessary knowledge, skills, and experience. Under the Global Internal Audit Standards, Principle 3 (Demonstrate Competency) and Standard 3.1 (Competency) carry the same obligation forward and add a specific duty to communicate when competence is lacking.
3. It is a shared responsibility of the individual auditor and the Chief Audit Executive (CAE). The individual auditor must recognize and disclose their own limitations. The CAE must ensure the function collectively has the competencies to execute the audit plan, and when it does not, must obtain competent advice and assistance (co-sourcing, outsourcing, guest auditors, subject-matter experts) or decline the engagement and inform the board.
4. It intersects with risk management assurance specifically. CRMA candidates are expected to understand that assurance over enterprise risk management (ERM) often requires specialized knowledge: quantitative risk modeling, actuarial concepts, regulatory capital frameworks, cyber risk, environmental and climate risk, and so on. Internal auditors frequently face pressure to opine on these areas. Knowing when to adjust the scope, bring in experts, or decline protects both the auditor and the organization.
5. It protects the organization legally and reputationally. Incompetent assurance can mislead regulators, investors, and the board; it can expose the organization and the auditor to liability; and it undermines confidence in the entire internal audit function.
What It Is
Declining or adjusting work that lacks competence means that, before accepting and while performing an engagement, the internal auditor and the CAE assess whether the required knowledge, skills, and abilities are available. If they are not, there are several professional responses, generally applied in this order of preference:
Obtain competent assistance. Engage internal or external subject-matter experts, co-source or outsource the specialized portion, borrow a guest auditor from another department (while safeguarding objectivity), or provide targeted training if time permits.
Adjust the scope or objectives. Narrow the engagement to the areas the team can competently assess, and clearly communicate the limitation in the engagement scope and final report so that stakeholders understand exactly what was and was not covered.
Defer the engagement. Postpone until the needed competence is obtained, if the risk and timing allow.
Decline the engagement. When assistance cannot be obtained and the scope cannot be meaningfully adjusted, the work should not be performed as assurance. The CAE communicates this to senior management and the board, explaining the gap and its implications for the audit plan and for risk coverage.
Importantly, this is distinct from declining work because of impairment to independence or objectivity (for example, auditing an area the auditor managed within the past year). Competence is about ability; objectivity is about bias. The two can occur together, but the exam will often test whether you can tell them apart.
Key Standards and Ethical References
IIA Code of Ethics, Competency principle and rules of conduct: internal auditors shall engage only in those services for which they have the necessary knowledge, skills, and experience; shall perform services in accordance with the Standards; and shall continually improve their proficiency.
Global Internal Audit Standards, Principle 3 and Standard 3.1 (Competency): internal auditors must possess or obtain the competencies to perform their responsibilities; they must not undertake an engagement for which they lack the competencies unless they are supervised by someone who has them; and they must communicate to the CAE when they lack the competencies required.
Standard 4.2 (Due Professional Care): competence is a precondition for exercising due care.
Standard 10.2 (Human Resources Management): the CAE must ensure the function collectively possesses the competencies needed to fulfill the internal audit mandate and must obtain external assistance when gaps exist.
Standard 8.3 / 9.4 context (Quality and Resources): the CAE must inform the board and senior management when resource limitations, including competency gaps, affect the function's ability to deliver the plan.
Legacy Standards (still useful for understanding): 1210 Proficiency, 1210.A1 (CAE must obtain competent advice and assistance if staff lack the knowledge, skills, or other competencies to perform all or part of the engagement), 1210.C1 (the CAE must decline a consulting engagement or obtain competent advice and assistance if the staff lack competence), and 1220 Due Professional Care.
How It Works in Practice
Step 1: Competency assessment at planning. During annual risk-based planning and again at individual engagement planning, the CAE maps required competencies against the team's skills inventory. Specialized engagements (IT, actuarial, treasury, fraud forensics, ESG, model risk, regulatory capital) are flagged early.
Step 2: Individual self-assessment and disclosure. Each auditor is obligated to speak up when assigned work beyond their competence. Silence is a violation of the Code of Ethics. The auditor informs the engagement supervisor or CAE as soon as the gap is identified, including mid-engagement if it becomes apparent only after fieldwork begins.
Step 3: Evaluate options. The CAE weighs: Can an expert be engaged in time? Is budget available? Can another team member supervise who has the competence? Can the scope be reduced while still meeting the engagement objective? What is the risk to the organization if the engagement is deferred or declined?
Step 4: Use of experts. When experts are used, the internal auditor remains responsible for the engagement conclusions. The auditor must understand the expert's objectives, scope, methods, and assumptions well enough to evaluate the reasonableness of the work, must assess the expert's qualifications, independence, and objectivity, and must document reliance in the workpapers.
Step 5: Adjust and communicate. If scope is modified, the engagement objectives, scope, and limitations are revised in the planning memorandum and communicated to engagement clients. The final report explicitly describes any scope limitation and its effect on the conclusion. Stakeholders must never be left to assume coverage that did not occur.
Step 6: Escalate and document. If work is declined or significantly limited, the CAE informs senior management and the board, explains the risk-coverage gap, and recommends alternatives (external assurance providers, management self-assessment, second-line reviews). The decision and rationale are documented.
Step 7: Close the gap long term. Competency gaps feed into the function's training plan, recruiting strategy, and resourcing requests, consistent with the requirement for continuous professional development and the Quality Assurance and Improvement Program (QAIP).
Consulting versus Assurance Nuance
For assurance engagements, a lack of competence most often results in obtaining assistance or limiting scope, because the board needs the coverage. For consulting engagements, the Standards historically required the CAE to decline the engagement or obtain competent advice, since consulting is advisory and discretionary and management can obtain the advice elsewhere. On the exam, if a question involves a consulting request the team cannot competently perform and no expert is available, declining is usually the best answer.
Risk Management Assurance Application (CRMA focus)
Internal audit's core role in ERM is to provide assurance on risk management processes, on the evaluation of key risks, and on the reporting of key risks. Many of these areas are technically demanding. Typical exam scenarios include: being asked to validate a value-at-risk model, assess cyber threat intelligence, evaluate insurance reserve adequacy, review a climate scenario analysis, or opine on the effectiveness of a sophisticated quantitative risk appetite framework. The correct professional response is to recognize the specialized nature of the work, obtain competent assistance or adjust scope, and be transparent about limitations, rather than issuing a conclusion the team cannot support.
Common Pitfalls
Accepting the engagement to avoid disappointing management or the audit committee.
Assuming that reading a few articles or completing a short online course provides sufficient competence for a highly technical area.
Relying on an expert without understanding or evaluating the expert's work, and then presenting the conclusion as the internal auditor's own.
Failing to document the competency assessment and the rationale for scope changes.
Confusing a competence problem with an objectivity problem and applying the wrong remedy.
Quietly narrowing scope without telling the engagement client or the board, creating an expectation gap.
Letting management choose the external expert without the CAE assessing the expert's independence and qualifications.
How to Answer Exam Questions on This Topic
CRMA questions are scenario based and ask for the best or most appropriate action. Use the following reasoning sequence:
1. Identify the real problem. Is the issue a lack of knowledge, skills, or abilities (competence), or is it a conflict of interest, prior operational responsibility, or bias (objectivity)? Only apply competence remedies to competence problems.
2. Identify who has the obligation. If the scenario is written from the individual auditor's perspective, the answer usually involves disclosing the limitation to the CAE or supervisor. If it is from the CAE's perspective, the answer usually involves obtaining competent assistance, adjusting scope, or declining and informing the board.
3. Apply the hierarchy of responses. Prefer obtaining competent assistance first; adjust or limit scope with transparent disclosure second; defer or decline third. Declining outright is correct when assistance is unavailable, the engagement is consulting in nature, or any other approach would produce misleading assurance.
4. Look for transparency. Answers that involve hiding the limitation, issuing an unqualified conclusion anyway, or letting the client assume full coverage are always wrong.
5. Remember accountability when using experts. The internal auditor must still understand and evaluate the expert's work and remains responsible for the overall conclusion. Answers that say the auditor can simply rely on the expert without review are wrong.
6. Escalate appropriately. If the competency gap affects the audit plan or leaves a significant risk area without assurance, the board (audit committee) must be informed. Answers that stop at informing only the engagement client are usually incomplete.
Exam Tips: Answering Questions on Declining or Adjusting Work That Lacks Competence
Tip 1: Memorize the key phrase: engage only in services for which you have the necessary knowledge, skills, and experience. If an answer choice contradicts this, eliminate it immediately.
Tip 2: When the scenario says an auditor is assigned to a highly technical area and the options include proceed as planned, the correct answer is almost never proceed as planned. Look for the option that involves disclosure, obtaining expertise, or adjusting scope.
Tip 3: Watch for the word consulting. For consulting engagements lacking competence with no available expert, declining is the textbook response. For assurance engagements, obtaining competent advice and assistance is usually preferred before declining.
Tip 4: Distinguish competence from objectivity. If the auditor used to manage the area, that is an objectivity impairment (reassign the auditor). If the auditor has never worked with the subject matter and lacks the skills, that is a competence issue (obtain expertise or adjust scope). Exams love to mix these in distractors.
Tip 5: The CAE's collective responsibility is a frequent test point. The function as a whole must have the competencies; no single auditor must know everything. If a question asks what the CAE should do when staff lack skills, the answer is to obtain competent advice and assistance, not to cancel the audit plan or to perform the work personally regardless of expertise.
Tip 6: Any answer that involves issuing an opinion while silently narrowing the work, or that lets stakeholders believe full coverage was achieved, violates due professional care and integrity. Eliminate it.
Tip 7: When using an external expert, the best answer typically includes evaluating the expert's qualifications and objectivity, understanding the expert's work, and retaining responsibility for the conclusion. An answer that says the auditor can transfer responsibility to the expert is incorrect.
Tip 8: If the scenario involves mid-engagement discovery of a competence gap, the correct action is to stop, communicate to the CAE immediately, and reassess, not to finish quickly and note it informally afterward.
Tip 9: Think about the board. When a competency gap means a significant risk area cannot receive assurance, the CAE must report the limitation and its impact to senior management and the board. Choose answers that close the loop with governance.
Tip 10: Remember that declining work is a last resort but a legitimate and sometimes mandatory one. Do not be afraid to pick the decline option when the scenario makes clear that no assistance is available and any work performed would be unreliable.
Quick Scenario Practice
Scenario A: An audit committee asks internal audit to assess the adequacy of the insurer's actuarial reserving model. No one on the team has actuarial training. Best action: the CAE obtains competent actuarial assistance (co-source or external expert), supervises the work, retains responsibility for conclusions, and discloses the use of experts in the report. Declining is only appropriate if such assistance cannot be obtained.
Scenario B: Management requests internal audit to design and implement a new cyber risk quantification model as a consulting engagement. The team lacks the expertise and no budget exists for external help. Best action: the CAE declines the consulting engagement and explains why, suggesting alternative sources of expertise.
Scenario C: During fieldwork on an ERM assurance engagement, an auditor realizes the risk aggregation methodology relies on statistical techniques they do not understand. Best action: inform the engagement supervisor and CAE immediately so that competent assistance can be obtained or the scope can be adjusted and the limitation disclosed.
Scenario D: An auditor was the treasury risk manager eight months ago and is asked to audit treasury risk management. Best action: this is an objectivity issue, not a competence issue; the auditor should be reassigned even though they are highly competent.
Summary
Declining or adjusting work that lacks competence is a direct expression of the IIA's Competency principle and the Standards on proficiency, due professional care, and resource management. Individual auditors must disclose their limitations; the CAE must ensure collective competence, obtain assistance where needed, adjust or decline engagements transparently, and keep the board informed of any resulting gaps in risk coverage. On the CRMA exam, identify whether the issue is competence or objectivity, apply the hierarchy of obtain assistance, adjust scope, defer, or decline, insist on transparency, keep responsibility for expert work with the internal auditor, and escalate significant limitations to the board.
Test mode:
CRMA - Declining or Adjusting Work That Lacks Competence Example Questions
Test your knowledge of Declining or Adjusting Work That Lacks Competence
Question 1
Senior management asks the internal audit function to advise on building a quantitative model that estimates potential losses from emerging climate-related risks. No one on the audit staff has statistical modeling experience, and the request is due in six weeks. The chief audit executive proposes accepting the engagement as requested and assigning a staff auditor, who will complete an online modeling course during fieldwork. Which evaluation of this proposal is MOST appropriate?
Question 2
The audit committee asks the internal audit function for assurance over the organization's climate risk management. The request includes testing whether the assumptions in the physical-risk scenario model are reasonable. The team has strong experience auditing risk governance and processes but has no climate modeling or actuarial expertise, and the deadline is fixed. Which conclusion is MOST appropriate for the chief audit executive to reach when analyzing the request?
Question 3
The audit committee asks the chief audit executive to provide assurance on the organization's actuarial reserving model within the next quarter. No one in the internal audit function has actuarial training. The budget allows outside resources, and the committee needs an opinion it can rely on. Which action is MOST appropriate for the chief audit executive?
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3053 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Declining or Adjusting Work That Lacks Competence questions
17 questions (total)
Other Internal Audit Roles and Responsibilities concepts
Advisory and Consulting Services on Risk ManagementAdvocating for Enterprise Risk ManagementAssessing Internal Audit Skill GapsAssurance Services on Risk ManagementBuilding an Organizationwide Risk Assurance MapChief Audit Executive Roles Beyond Internal AuditingChoosing Assurance or Advisory for a Risk RequestCombined AssuranceCompetencies for Risk Management AssuranceCoordinating Assurance Across ProvidersCore Internal Audit Roles in Enterprise Risk ManagementCo-Sourcing and Outsourcing Risk ExpertiseDeveloping Risk Management Competence in StaffEvaluating Reliance on Other Assurance ProvidersFinding Gaps and Overlaps with an Assurance MapFunctional and Administrative Reporting LinesImpairments from Risk Management ResponsibilitiesImproving Existing Risk Management ProcessesInternal Audit ERM Roles That Need SafeguardsInternal Audit's Role When No Risk Process ExistsMaintaining and Updating the Assurance MapOrganizational Independence of Internal AuditRecommending an Organizationwide Risk StrategyRelying on External Auditors and RegulatorsReporting Impairments to the Board and ManagementRoles Internal Audit Should Not Take in ERMSafeguards When Internal Audit Leads Risk WorkThe Three Lines ModelUsing External Experts in Risk Engagements