Using External Experts in Risk Engagements

1. Why This Topic Matters

Risk-based assurance and consulting engagements increasingly touch areas that go far beyond traditional accounting and control knowledge: cyber security, actuarial reserving, derivative valuation, environmental liabilities, engineering safety, data analytics, legal exposure, and complex financial models. The internal audit function cannot realistically employ specialists in every one of these fields, yet the Chief Audit Executive (CAE) is still responsible for providing reliable assurance on the organisation's risk management processes.

The IIA addresses this directly. Under the 2017 International Standards, Standard 1210.A1 states that the CAE must obtain competent advice and assistance if internal auditors lack the knowledge, skills, or other competencies needed to perform all or part of an engagement (1210.C1 applies the same idea to consulting engagements, where the CAE must decline or obtain assistance). Under the 2024 Global Internal Audit Standards, the same requirement appears in Standard 3.1 (Competency), Standard 10.2 (Human Resources Management) and Standard 13.5 (Engagement Resources), which require the CAE to identify competency gaps and, where necessary, obtain qualified external service providers.

For the CRMA exam, this topic sits inside the domain on internal audit roles and responsibilities. It tests whether you understand how to extend the capability of the audit function without surrendering accountability for the conclusions. Questions commonly probe three ideas: when an expert is needed, how to evaluate the expert, and who ultimately owns the result.

2. What Is an External Expert?

An external expert (also called an external service provider, specialist, or subject-matter expert) is a person or firm, outside the internal audit function and usually outside the organisation, who possesses specialised knowledge, skills, or experience in a particular discipline that the internal audit team does not have. Examples relevant to risk engagements include:

• Actuaries assessing insurance or pension liabilities
• Information security and penetration-testing specialists
• Valuation experts for complex financial instruments, intangibles, or real estate
• Engineers, geologists, or environmental scientists evaluating physical or environmental risks
• Forensic accountants and fraud investigators
• Lawyers or regulatory compliance specialists
• Statisticians, data scientists and model-validation specialists
• Health, safety and quality-management specialists
• Co-sourcing partners from external audit or consulting firms

Note that an expert may be external to the organisation (a hired consultant) or external to the audit function but internal to the organisation (for example, borrowing a credit risk quant from the risk department). The IIA guidance applies to both, although the independence and objectivity analysis differs, because an internal specialist may be auditing an area in which they have operational responsibility.

3. The Core Principle: Responsibility Cannot Be Outsourced

The single most important point for the exam is this: the CAE retains responsibility for the engagement, its conclusions, and the quality of the work, even when an expert performs part of it. Using an expert is a resourcing decision, not a transfer of accountability. The internal audit function must:

• Decide that the expert is needed
• Satisfy itself about the expert's competence and objectivity
• Define and agree the scope of the expert's work
• Supervise and evaluate the work
• Decide how much reliance to place on the results
• Take ownership of the opinion or conclusion communicated to management and the board

If a question offers an answer suggesting the CAE can disclaim responsibility because an expert did the work, that answer is wrong.

4. How It Works – The Process Step by Step

Step 1 – Identify the competency gap
During engagement planning (and at the annual planning stage, when the CAE assesses whether the function's collective knowledge, skills and competencies are sufficient for the risk-based plan), the CAE compares the skills needed to the skills available. The gap may be technical (a valuation methodology), industry-specific (clinical trial risk), or capacity-based (not enough hours). The decision to use an expert should be documented and should link to the engagement objectives and risk assessment.

Step 2 – Evaluate the expert's competence
Before engaging, the CAE or engagement supervisor should consider:
• Professional qualifications, licences, certifications and memberships
• Relevant experience, including experience in the organisation's industry
• Reputation and references
• Knowledge of the specific subject, methodology or technology
• Where a firm is engaged, the competence of the actual individuals assigned

Step 3 – Evaluate independence and objectivity
The CAE must assess whether the expert has any relationship that could impair objectivity with respect to the activity under review. Factors include:
• Financial interest in the organisation or the area being audited
• Personal or business relationships with management of the area
• Prior or concurrent work for the organisation (for example, designing the very model now being validated)
• Whether the expert is being paid by, or reports to, the management being reviewed
• For internal specialists, whether they have operational responsibility for the area

If the external expert is also the organisation's external auditor or another provider with existing commitments, potential conflicts should be considered and, where relevant, disclosed to the board or audit committee. Impairments that cannot be removed should be disclosed in the final communication.

Step 4 – Agree the scope in writing
A written engagement letter or contract should cover:
• Objectives and scope of the expert's work
• Specific matters the expert will address and the methodology to be used
• Deliverables, format and timing
• Access to records, systems and personnel
• Ownership and custody of workpapers
• Confidentiality and data protection
• Fees and performance measures
• Communication protocols, including who the expert reports to (normally the CAE or engagement supervisor, not operational management)
• Compliance with the IIA Code of Ethics or equivalent professional standards

Step 5 – Supervise the work
Standard 2340 (Engagement Supervision) and GIAS Standard 12.3 apply to expert work just as to internal auditor work. The engagement supervisor should monitor progress, review interim findings, resolve scope issues, and ensure the work stays aligned with engagement objectives.

Step 6 – Evaluate the results
Internal audit must assess whether the expert's work supports the conclusions drawn. This includes reviewing:
• The reasonableness of assumptions and methods
• The source, relevance and reliability of data used
• Whether findings are consistent with other evidence gathered
• Whether the work actually covered the agreed scope
Internal auditors are not expected to re-perform the specialist analysis, but they must understand it well enough to judge its adequacy and to challenge anomalies. Blind reliance is not acceptable.

Step 7 – Document and communicate
Workpapers should record the decision to use the expert, the competence and objectivity assessment, the scope agreement, the supervision performed, and the evaluation of results. In the final communication, the CAE decides whether and how to refer to the expert. If reliance on an expert is significant, or if there was an objectivity impairment or scope limitation, this should be disclosed. The conclusion is issued by internal audit, not by the expert.

5. Specific Considerations in Risk Management Assurance

Because the CRMA focuses on assurance over risk management, several nuances are worth remembering:

• Model risk: When assessing risk models (credit, market, liquidity, catastrophe), experts frequently validate assumptions and calibration. Internal audit should ensure the expert validates against the organisation's own data and risk appetite, not merely industry norms.
• Second line as a resource: Internal audit may draw on risk management or compliance specialists, but must be alert to the objectivity problem when the second line assesses its own framework. Using the work of the second line is a related but distinct topic (reliance on other assurance providers, Standard 2050).
• Emerging risks: Experts are especially useful for ESG, climate, cyber and AI risk where internal skills lag. The CAE should also use the engagement as a knowledge-transfer opportunity so the function builds competence over time.
• Co-sourcing and outsourcing: Where the whole function or large parts of it are outsourced, the organisation must still have a designated CAE-level person responsible for oversight, and the board must retain the ability to direct and evaluate the work.
• Confidentiality and data: Risk data is highly sensitive; contracts should address data handling, residency and destruction.

6. Common Pitfalls

• Hiring an expert because management recommended them, without independent assessment
• Allowing management to brief, direct or pay the expert, undermining objectivity
• Accepting an expert's report without understanding it
• Failing to document the competence and objectivity evaluation
• Omitting disclosure of significant reliance or impairments in the final report
• Assuming an expert's professional reputation removes the need for supervision
• Confusing the use of experts with the use of other internal assurance providers

7. Exam Tips: Answering Questions on Using External Experts in Risk Engagements

Tip 1 – Anchor on the Standard. The trigger for using an expert is a lack of knowledge, skills or competencies in the audit function for all or part of the engagement. If the stem describes a gap, the correct response is to obtain competent assistance, not to proceed anyway and not necessarily to cancel the engagement (cancelling is only for consulting engagements when assistance cannot be obtained).

Tip 2 – Responsibility stays with the CAE. Any option that transfers accountability for conclusions, quality or supervision to the expert, to management, or to the external auditor is a distractor. The best answer keeps the CAE in control.

Tip 3 – Competence AND objectivity. When a question asks what the CAE must assess before relying on an expert, look for the answer that covers both professional competence (qualifications, experience, reputation) and independence/objectivity (relationships, financial interests, prior work). An answer mentioning only one dimension is usually incomplete.

Tip 4 – Written scope. Questions about engagement letters or contracts are looking for objectives, scope, deliverables, access, confidentiality, ownership of workpapers and reporting lines. The expert should report to internal audit, not to the auditee.

Tip 5 – Evaluation before reliance. If the stem says the expert has delivered a report, the next correct step is for internal audit to evaluate the reasonableness of assumptions, methods and data, and consistency with other evidence. Issuing the audit report immediately is wrong.

Tip 6 – Disclosure rules. If reliance on the expert is significant, or if an objectivity impairment or scope limitation exists, the final communication should disclose it. Minor assistance does not require disclosure, so read the stem for words like significant or material.

Tip 7 – Watch for internal specialists. If the scenario uses a specialist from inside the organisation (for example, from the risk function), check whether they have operational responsibility for the area reviewed. If so, objectivity is impaired, and the answer should address that impairment.

Tip 8 – Distinguish related topics. Using experts (Standard 1210 / GIAS 3.1, 10.2, 13.5) is different from relying on other assurance providers (Standard 2050 coordination) and from outsourcing the entire function (governance and CAE oversight). Identify which the question is really asking about.

Tip 9 – Use the best-answer approach. CRMA questions often have two plausible options. Choose the one most consistent with the Standards and the principle of retained accountability, and prefer answers that involve documented assessment, written agreement and supervision over informal or trust-based approaches.

Tip 10 – Think like a CAE. Ask yourself what a prudent CAE would do to be able to defend the conclusion to the audit committee. That mindset usually leads to the correct answer: identify the gap, vet the expert, define the scope, supervise, evaluate, document, disclose and own the result.

8. Quick Revision Summary

• Experts fill competency gaps; they do not replace internal audit judgement.
• 2017 Standard 1210.A1 / 1210.C1 and 2024 GIAS Standards 3.1, 10.2 and 13.5 require the CAE to obtain competent assistance when skills are lacking.
• Assess competence (qualifications, experience, reputation) and objectivity (relationships, interests, prior work).
• Agree scope, deliverables, access, confidentiality and reporting lines in writing.
• Supervise and evaluate the work; never rely blindly.
• Document everything; disclose significant reliance or impairments.
• The CAE remains responsible for the engagement and its conclusions.