Evaluating Reliance on Other Assurance Providers

Why This Topic Matters
Modern organizations are covered by many layers of assurance: management monitoring, compliance functions, risk management, quality teams, external auditors, regulators, and third-party certifiers. If internal audit duplicates all of this work, it wastes resources and frustrates stakeholders. If it blindly trusts others, it risks giving the board false comfort. The CRMA exam tests whether you understand how the Chief Audit Executive (CAE) and internal auditors decide when, how much, and under what conditions they may rely on work performed by other assurance providers, while still owning the opinions they issue.

This topic sits at the intersection of IIA Global Internal Audit Standards (notably coordination and reliance requirements in Domain III and the engagement standards), the Three Lines Model, and the concept of combined assurance. It is a frequently tested area because it requires judgment, not memorization.

What It Is
Reliance on other assurance providers means internal audit uses the results, testing, or conclusions of another party to reduce the scope of its own procedures or to support its own conclusions. Other assurance providers include:
• Second-line functions: risk management, compliance, information security, quality assurance, health and safety, legal.
• First-line management self-assessments and control self-assessment (CSA) programs.
• External auditors (financial statement audit, ICFR/SOX testing).
• Regulators and supervisory examinations.
• Third-party assurance reports (SOC 1/SOC 2, ISO certifications, penetration testers).
• Other internal audit functions (e.g., group vs. subsidiary audit, co-sourced or outsourced providers).

Two key principles frame the topic:
1. Coordination – the CAE must share information and coordinate activities with other providers to minimize duplication and ensure adequate coverage (an assurance map is the common tool).
2. Accountability remains with internal audit – the CAE and internal auditors remain responsible for the conclusions they report, even when relying on others. Reliance never transfers responsibility.

How It Works: The Evaluation Framework
Before relying on another provider, internal audit assesses the provider and its work against several dimensions. Remember the acronym I-C-O-Q (Independence, Competence, Objectivity, Quality of work):

1. Independence and Objectivity of the Provider
• Where does the provider sit organizationally? Does it report to the people whose work it reviews?
• Is it a first-line (management) function, second-line (oversight) function, or genuinely independent?
• Are there incentives or conflicts that might bias results?
Generally, the less independent the provider, the less reliance internal audit can place, and the more re-performance is needed. Management self-assessment deserves far more skepticism than an external auditor's tested conclusion.

2. Competence and Qualifications
• Does the provider have the technical knowledge, certifications, training, and experience relevant to the area?
• Is there evidence of supervision and review within the provider's own work?

3. Due Professional Care and Quality of Work
• Is there a documented methodology? Are scope, sampling, and testing approaches defined?
• Is work adequately documented and supported by evidence?
• Are findings and conclusions consistent with the evidence?
• Does the provider have its own quality assurance or external review program?

4. Relevance and Scope Fit
• Does the provider's work actually cover the risks and controls internal audit needs assurance on, over the right period?
• Are definitions, risk tolerances, and control objectives aligned with internal audit's?
• Gaps between the provider's scope and internal audit's objectives must be filled by internal audit's own work.

5. Timeliness
• Is the work recent enough to be relevant? Have processes or systems changed since it was performed?

Steps in Practice
1. Build an assurance map linking key risks to the assurance activities covering them and identifying gaps or overlaps.
2. Decide the proposed level of reliance (none, partial, substantial) for each area.
3. Evaluate the provider using the criteria above; document the evaluation.
4. Perform verification procedures proportional to the reliance: review the provider's workpapers, re-perform a sample of tests, interview staff, or test controls over the provider's process.
5. Adjust internal audit's engagement scope accordingly, and document the rationale in workpapers.
6. Disclose the extent of reliance in the audit report where it is significant to understanding the conclusions.
7. Reassess periodically—reliance is not permanent; changes in staff, structure, or performance require re-evaluation.

Special Cases
• Reliance on external auditors: Typically high confidence, but scope is narrow (financial reporting). Coordination usually flows both ways; external auditors have their own standards for relying on internal audit.
• Reliance on outsourced/co-sourced providers: The CAE remains fully responsible; the engagement letter should define quality expectations, access to workpapers, and review rights.
• SOC and third-party reports: Check the report type, period covered, the service auditor's independence, complementary user entity controls, and whether exceptions were noted.
• Group/subsidiary audit functions: Evaluate adherence to a common methodology and quality program before rolling up results.

Benefits and Risks of Reliance
Benefits: efficiency, broader coverage, reduced audit fatigue on the business, better integrated reporting to the board (combined assurance).
Risks: inheriting weaknesses in the provider's work, loss of independence of judgment, gaps in coverage falsely assumed to be filled, and damaged credibility if a reliance-based conclusion later proves wrong.

Exam Tips: Answering Questions on Evaluating Reliance on Other Assurance Providers

Tip 1 – Responsibility never transfers. Any answer option suggesting the CAE is relieved of accountability because another party performed the work is wrong. The CAE remains responsible for the opinion and for the adequacy of the basis for it.

Tip 2 – Independence and objectivity come first. When asked what internal audit should evaluate first or primarily, the strongest answers address the provider's organizational independence and objectivity, followed by competence and quality of work. Cost savings and convenience are distractors.

Tip 3 – Match reliance level to provider type. Expect scenarios contrasting management self-assessments, second-line compliance testing, and external audit work. Rank reliance: management self-assessment (lowest) < second-line functions < independent external assurance (highest), always subject to evaluation of quality and scope fit.

Tip 4 – "Evaluate then verify" beats "accept" or "redo." The correct answer usually involves assessing the provider and performing proportionate verification (reviewing workpapers, re-performing a sample). Options that say "accept the report as sufficient evidence" (too trusting) or "perform all testing independently regardless" (ignores coordination requirements) are usually wrong.

Tip 5 – Watch for scope and timing gaps. If a scenario describes a provider's review that covered a different period, a subset of locations, or a different control objective, the answer should recognize that internal audit must fill the gap with its own procedures rather than relying fully.

Tip 6 – The assurance map is the coordination tool. Questions about how a CAE should identify duplication and gaps across assurance providers point toward developing or updating an assurance map and sharing it with senior management and the board.

Tip 7 – Disclose significant reliance. When reliance materially supports a conclusion, the engagement communication should state it. An option that hides or omits reliance in the final report is incorrect.

Tip 8 – Outsourced providers do not dilute CAE duties. For co-sourcing or outsourcing scenarios, the CAE must still ensure conformance with the Standards, supervise the work, and retain the right to review workpapers.

Tip 9 – Reliance is re-evaluated, not permanent. If a scenario mentions staff turnover, a reorganization, or prior quality issues at the provider, the correct answer calls for re-assessment before continuing to rely.

Tip 10 – Use the Three Lines lens. When a question is ambiguous, classify each party as first line, second line, third line (internal audit), or external assurance. This instantly clarifies independence and the appropriate degree of skepticism.

Quick Recall Summary
• Reliance reduces duplication but never removes internal audit's accountability.
• Evaluate independence, objectivity, competence, due care, scope relevance, and timeliness.
• Verify proportionately—review workpapers and re-perform samples.
• Document the evaluation and disclose significant reliance in reports.
• Coordinate through an assurance map and reassess reliance regularly.

Master these points and you will handle both the knowledge-based and scenario-based CRMA questions on this topic with confidence.