Relying on External Auditors and Regulators

Why This Topic Matters

Internal audit does not operate in a vacuum. Organisations are examined by many assurance providers: the external (statutory) auditor, banking or insurance regulators, tax authorities, health and safety inspectors, ISO certification bodies, and others. The IIA's Standards expect the Chief Audit Executive (CAE) to be aware of this landscape, coordinate with it, and, where appropriate, rely on it rather than duplicate it. For a CRMA candidate this matters for three reasons:

1. Efficiency and coverage – internal audit resources are finite. Reliance on the work of others frees capacity to cover risks that nobody else is examining, which is central to providing assurance over the whole risk management framework.
2. Avoiding assurance fatigue – management and the board suffer when the same control is tested by four different parties. Coordinated reliance reduces disruption and improves the credibility of all assurance providers.
3. Forming an overall opinion – when the CAE expresses an opinion on governance, risk management and control, the Standards require that the work of other assurance providers be considered. You cannot form an enterprise-level view of risk management without understanding what external auditors and regulators have (and have not) concluded.

The topic is also tested heavily because it touches a fundamental principle: reliance is permitted, but responsibility is never transferred. The CAE remains accountable for every conclusion internal audit reports.

What It Is: Key Concepts and Standards

Coordination and Reliance (IIA Standard 2050 / Global Internal Audit Standards 9.5)
The CAE should share information, coordinate activities, and consider relying upon the work of other internal and external assurance and consulting providers to ensure proper coverage and minimise duplication of effort. The 2024 Global Internal Audit Standards elevate this to an explicit requirement that the CAE establish a basis for reliance and understand the roles, responsibilities and activities of other providers.

External auditors
The statutory or external auditor's primary objective is to express an opinion on whether the financial statements are free from material misstatement. In some jurisdictions (for example SOX section 404 in the United States) they also attest to internal control over financial reporting. Their work is governed by auditing standards such as ISA or PCAOB standards, and their materiality threshold is set relative to the financial statements as a whole, which is usually far higher than the thresholds internal audit uses for operational or compliance reviews.

Regulators
Regulators (central banks, prudential and conduct authorities, data protection commissioners, environmental agencies, etc.) examine the organisation to confirm compliance with laws, regulations and licence conditions and to protect the public interest. Their findings are often authoritative, but their scope is defined by their statutory mandate, not by the organisation's own risk profile. Access to their detailed working papers is frequently restricted and their reports may be confidential or privileged.

Assurance mapping and combined assurance
An assurance map plots the organisation's key risks against every assurance provider and shows the level and nature of assurance each gives. It exposes gaps (risks nobody covers) and overlaps (risks covered by several parties). Combined assurance is the governance model, strongly associated with the King codes and the Three Lines Model, in which management, internal audit and external providers deliberately coordinate so the board receives a coherent, integrated picture.

The Three Lines Model
External assurance providers sit outside the three lines. They provide additional, independent assurance to the governing body, but they do not replace the internal audit function (the third line). The model stresses that the governing body must understand what each provider delivers and ensure appropriate coordination.

How It Works: The Reliance Process

Before relying on the work of an external auditor or regulator, the CAE should follow a disciplined process:

Step 1 – Understand the provider's purpose, scope and timing. What question were they trying to answer? What period and which entities did they cover? Was testing substantive, control-based, or both? A regulator reviewing capital adequacy tells you nothing about procurement fraud.

Step 2 – Assess competence. Consider professional qualifications, regulatory oversight (for example audit regulators inspecting the external audit firm), experience with the industry, and the rigour of their methodology.

Step 3 – Assess objectivity and independence. External auditors are bound by independence rules; regulators are structurally independent of the organisation. Still, consider any factors that could limit objectivity, such as significant non-audit services or long-standing relationships.

Step 4 – Evaluate due professional care and the quality of the work. Review reports, management letters, and, where accessible, working papers or summaries of testing. Determine whether evidence was sufficient and conclusions were supported. Where direct access is denied (common with regulators), rely on the formal report plus discussion with management and, if permitted, with the regulator.

Step 5 – Determine the extent of reliance and perform any additional work. Reliance can be full, partial, or none. Partial reliance is most common: for example, using the external auditor's testing of general IT controls over the financial ledger but performing additional work on operational systems they did not scope. Re-performance of a sample may be necessary to validate the work.

Step 6 – Document the basis for reliance. The working papers should record the evaluation performed, the conclusion reached, and the residual procedures internal audit carried out. This documentation is also essential for quality assurance reviews.

Step 7 – Incorporate results into risk assessment, planning and reporting. Regulator findings and external audit management letter points should feed into the annual risk assessment, be tracked for remediation, and be reflected in reports to senior management and the board. When forming an overall opinion, the CAE must make clear which parts of the opinion rest on the work of others and the limitations of that reliance.

Two-way reliance
Coordination runs in both directions. External auditors may rely on internal audit under ISA 610 or PCAOB AS 2605 after evaluating the function's competence, objectivity and systematic approach. Regulators in many sectors also review internal audit reports and may require the function to cover specific regulatory areas. Effective CAEs hold regular tripartite meetings with the external auditor and audit committee, share audit plans and results, and agree on areas of shared testing.

Common Limitations and Pitfalls

• Different objectives – the external auditor's focus on material misstatement means many operational, strategic and compliance risks receive no coverage.
• Different materiality – a control deficiency that matters to management may be immaterial to the financial statements and therefore unreported.
• Timing gaps – regulatory examinations may occur every two or three years; conditions can change quickly.
• Restricted access – confidentiality may prevent review of underlying evidence, limiting the degree of reliance.
• Scope creep in reverse – management sometimes argues that a clean external audit or regulatory report means internal audit need not review the area. The CAE must resist substituting other providers' conclusions for an independent risk-based judgement.
• Abdication – the most serious error is treating reliance as delegation. The CAE always retains responsibility for the sufficiency of coverage and the validity of conclusions.

How to Answer Exam Questions on This Topic

CRMA questions on reliance are usually scenario-based. They describe a CAE under pressure (budget cuts, a confident external auditor, a satisfied regulator) and ask what the CAE should do, what is the best response, or which statement is correct. Apply the following reasoning sequence:

1. Identify who retains responsibility. If an option implies the CAE can hand off accountability, eliminate it.
2. Look for the evaluation step. The best answer almost always involves assessing competence, objectivity, scope and quality of work before relying.
3. Check scope alignment. Ask whether the external work actually addresses the same risk, period and objective as the internal audit engagement.
4. Prefer coordination over duplication, but not over coverage. An answer that saves effort while leaving a key risk unexamined is wrong.
5. Consider reporting. Correct answers often include communicating the extent and limitations of reliance to the board or audit committee.

Exam Tips: Answering Questions on Relying on External Auditors and Regulators

• Tip 1 – Memorise the four evaluation criteria: competence, objectivity/independence, scope and nature of work, and quality or results of work. Any option that skips evaluation and goes straight to reliance is a distractor.
• Tip 2 – Remember the materiality trap. If a scenario says the external auditor found no significant deficiencies and asks whether internal audit can conclude controls are effective, the answer is no; external audit materiality and objectives differ from internal audit's.
• Tip 3 – Regulators test compliance, not enterprise risk. A satisfactory regulatory examination supports a compliance conclusion in the examined area only. It does not provide assurance over strategic, operational or reputational risk management.
• Tip 4 – Watch for words like 'duplication', 'coverage', 'gaps' and 'assurance map'. These signal Standard 2050 / 9.5 and point toward coordination, assurance mapping and combined assurance as the correct answer.
• Tip 5 – Residual procedures are normal. Options describing partial reliance plus targeted additional testing are usually stronger than options describing either complete reliance or complete re-performance.
• Tip 6 – Documentation matters. If two answers seem equally reasonable, the one that includes documenting the basis for reliance in the working papers is typically preferred.
• Tip 7 – Overall opinions must disclose reliance. When the CAE issues an opinion on risk management effectiveness, the correct answer requires consideration of other providers' work and disclosure of any limitations in the scope relied upon.
• Tip 8 – Confidentiality is a constraint, not an excuse. If regulator working papers are unavailable, the CAE should rely only to the extent the formal report and discussions allow and should perform additional work for the remainder, rather than ignoring the area or relying fully.
• Tip 9 – Beware of management pressure scenarios. When management or the board suggests dropping an audit because the external auditor or regulator already covered it, the correct response is to evaluate the external work against internal audit's risk-based objectives, not simply to comply or simply to refuse.
• Tip 10 – Think Three Lines. External providers sit outside the lines and supplement, never replace, the independent assurance of internal audit to the governing body.

Quick Recap

Relying on external auditors and regulators is encouraged by the Standards because it improves coverage and reduces duplication, but it is conditional. The CAE must understand each provider's objectives and scope, evaluate their competence, objectivity and quality of work, decide how much reliance is justified, perform additional procedures to fill the gaps, document the basis for reliance, and communicate its extent and limitations to the board. Above all, reliance never shifts responsibility: the CAE owns every conclusion internal audit reports. Keep that principle at the centre of your reasoning and most exam questions on this topic will resolve themselves.