Using Other Providers' Work in an Overall Assessment

Why This Topic Matters
No internal audit function has the resources to independently test every risk and control in an organization. Modern organizations are covered by multiple assurance providers: management self-assessments, compliance functions, risk management, quality assurance, information security, external auditors, regulators, and third-party specialists. The Chief Audit Executive (CAE) who forms an overall assessment or overall opinion on governance, risk management, and control must decide how much of this other work can be relied upon, and how to combine it into a coherent, defensible conclusion. This is a core CRMA competency because the CRMA exam emphasizes the Three Lines Model, combined assurance, and the ability to provide risk management assurance efficiently without duplicating effort or compromising independence. Getting this wrong has two failure modes: over-relying on weak work (leading to an unsupported opinion) or ignoring good work (wasting resources and annoying the business). The exam tests whether you know how to strike the right balance.

What It Is
Using other providers' work means the internal audit activity deliberately incorporates assurance activities performed by parties other than itself into its own conclusions. The IIA's International Standards for the Professional Practice of Internal Auditing address this in Standard 2050 Coordination and Reliance: the CAE should share information, coordinate activities, and consider relying upon the work of other internal and external assurance and consulting service providers to ensure proper coverage and minimize duplication. The related IIA Practice Guide Reliance by Internal Audit on Other Assurance Providers provides the methodology. Under the 2024 Global Internal Audit Standards, the same principles appear in Standard 9.5 Coordination and Reliance and connect to the requirements for an overall opinion in the communication standards. The critical rule, which appears repeatedly in exam questions, is this: when the CAE relies on the work of others, the CAE remains responsible for ensuring adequate support for the conclusions and opinions reached by the internal audit activity. Reliance can be placed on work; responsibility cannot be transferred.

Other providers fall broadly into three groups:
1. First line / management-based assurance - control self-assessments, operational monitoring, supervisory reviews.
2. Second line functions - risk management, compliance, legal, information security, health and safety, quality, finance control functions.
3. External providers - external auditors, regulators, certification bodies (e.g., ISO, SOC reports), outsourced specialists, and co-sourced internal audit staff.

The overall assessment (sometimes called a macro-level or overall opinion under Standard 2450) is a conclusion covering the organization's governance, risk management, and control processes as a whole or for a major component. Because such an opinion aggregates many individual results, it is the natural place where other providers' work is combined with internal audit's own engagements.

How It Works: The Reliance Process
Step 1 - Map the assurance universe. Build an assurance map that lists key risks across one axis and assurance providers across the other, identifying who provides what level of assurance over each risk. This reveals gaps (risks with no coverage) and overlaps (duplicated effort). The assurance map is the foundation of combined assurance and of a risk-based audit plan.

Step 2 - Evaluate the provider. Before placing any reliance, internal audit assesses three attributes of the other provider:
- Competence: qualifications, experience, training, and professional standards of the people doing the work.
- Objectivity and independence: the provider's reporting line, incentives, and freedom from conflicts. A second-line compliance function reporting to the executive it monitors is less objective than one reporting to the board; a first-line self-assessment is the least objective.
- Due professional care and methodology: whether the work followed a structured, documented, and supervised approach with a sound evidential basis.

Step 3 - Evaluate the work itself. Determine whether the scope, timing, and objectives of the other provider's work actually address the risk internal audit needs covered. A SOC 1 report on a service organization may cover financial reporting controls but not operational resilience. Compliance testing performed eighteen months ago may be stale. Internal audit reviews the working papers, methodology, sample sizes, and conclusions, and may re-perform a sample of the testing to validate quality.

Step 4 - Decide the degree of reliance. Reliance is not binary. The practice guide describes a sliding scale: full reliance (minimal additional work), partial reliance (internal audit performs supplementary testing), or no reliance (internal audit performs its own work). The appropriate level is driven by the significance of the risk and the strength of the provider. Higher risk and lower provider objectivity both push toward less reliance and more direct testing by internal audit.

Step 5 - Perform supplementary procedures. Where reliance is partial, internal audit fills the gaps with targeted testing, interviews, analytics, or re-performance so that the combined evidence is sufficient, reliable, relevant, and useful.

Step 6 - Aggregate and form the overall assessment. The CAE combines the results of internal audit's own engagements and relied-upon work, weighted by risk significance and by the degree of reliance placed. Consistent rating scales across providers are essential, otherwise a 'satisfactory' from compliance may mean something different from a 'satisfactory' from internal audit. The CAE considers the cumulative effect of individual findings, trends, and unaddressed gaps before concluding.

Step 7 - Document and communicate. The basis for reliance must be documented in working papers. When an overall opinion is issued, Standard 2450 requires it to include the scope, time period, scope limitations, consideration of related projects including the reliance on other assurance providers, the risk or control framework used, and a summary of supporting information. Disclosing reliance allows the board and senior management to understand the strength of the evidence behind the opinion.

Step 8 - Monitor and refresh. Reliance decisions are revisited as providers change, risks shift, or quality issues emerge. A provider whose work previously qualified for full reliance may need to be downgraded after staff turnover or a failed re-performance test.

Special Situations the Exam Likes
- External auditors: Internal audit can use external audit results, but the external auditor's objective (fair presentation of financial statements) is narrower than internal audit's. Reliance should be limited to the scope actually covered. Note the reverse relationship: external auditors deciding to use internal audit's work follow their own auditing standards, which is not what this topic covers.
- Management self-assessment: Useful for coverage and risk awareness, but low objectivity means it generally supports only limited reliance and usually requires validation testing.
- Outsourced or co-sourced providers engaged by internal audit: Their work is performed on behalf of the internal audit activity, so the CAE is directly accountable for its quality and must supervise it as if performed in-house.
- Third-party certification reports: Evaluate the certifying body's reputation, the report period, the scope, exceptions noted, and complementary user-entity controls before relying.
- Group or multinational structures: Divisional audit functions may feed a group-level opinion; the group CAE must assess their conformance with the Standards and consistency of methodology.

How to Answer Exam Questions on This Topic
CRMA questions on this subject are usually scenario-based. You will be given a situation such as: 'The CAE wants to issue an overall opinion on risk management and intends to use the compliance department's testing results. Which of the following should the CAE do first?' or 'Which factor most limits the extent of reliance that can be placed on another provider?' The correct answer almost always flows from a handful of principles:
1. The CAE never surrenders responsibility for the opinion.
2. Assess competence, objectivity, and due care before relying.
3. Match the degree of reliance to risk significance and provider quality.
4. Confirm scope alignment; coverage of a different objective is not coverage of yours.
5. Document the basis for reliance and disclose it in the overall opinion.
6. Coordination is about reducing duplication and ensuring coverage, not about eliminating internal audit's own work.

Exam Tips: Answering Questions on Using Other Providers' Work in an Overall Assessment

Tip 1 - Look for the 'retains responsibility' answer. Any option implying that relying on another provider shifts accountability for the opinion away from the CAE is wrong. If an option says the CAE 'is no longer responsible' or 'may issue the opinion without further consideration,' eliminate it immediately.

Tip 2 - 'First step' questions point to assessment, not reliance. When asked what the CAE should do first before using another provider's work, the answer is to evaluate the provider's competence, objectivity, and methodology (or to obtain and review their work and working papers). Jumping straight to incorporating results or issuing the opinion is premature.

Tip 3 - Objectivity is usually the deciding factor among providers. If a question asks which provider's work warrants the least reliance, pick the one closest to the activity being assessed (e.g., management self-assessment or a function reporting to the process owner). If it asks which warrants the most, pick the one with the strongest independence and professional standards, provided the scope matches.

Tip 4 - Watch for scope mismatch traps. A question may describe a well-qualified, independent provider whose work covered a different period, a different entity, or a different control objective. The correct response is that reliance is limited and supplementary testing is needed, no matter how competent the provider is.

Tip 5 - Higher risk means more internal audit work. When a scenario involves a critical or high-risk area, the best answer typically involves re-performance or additional direct testing by internal audit rather than full reliance, even if the other provider appears reliable.

Tip 6 - Remember what the overall opinion must disclose. If a question asks what should be included when communicating an overall opinion built partly on others' work, the answer includes the scope, time period, scope limitations, the risk/control framework used, and explicitly the reliance placed on other assurance providers.

Tip 7 - Distinguish coordination from reliance. Coordination (sharing plans, aligning timing, avoiding duplication) is always appropriate and relatively low-risk. Reliance (using results as evidence for your own conclusion) requires the evaluation steps. Questions that confuse the two often have an answer choice that treats coordination alone as sufficient justification for reliance; that is a distractor.

Tip 8 - Assurance maps and combined assurance are 'planning' answers. If the question is framed around risk-based audit planning, the best answer is usually to develop or update an assurance map to identify coverage gaps and overlaps, then allocate internal audit resources to the gaps and high-risk areas.

Tip 9 - Outsourced work done for internal audit is internal audit's work. Do not treat a co-sourced specialist engaged by the CAE as an 'other provider' to be relied upon; the CAE must supervise and own that work directly.

Tip 10 - Use the elimination approach. Eliminate answers that (a) transfer responsibility, (b) skip the evaluation of the provider, (c) ignore scope or timing, or (d) fail to document or disclose. What remains is usually the correct, standards-aligned answer. Read the stem carefully for qualifiers such as 'most appropriate,' 'primary,' 'least,' and 'first,' because these determine which principle the question is testing.

Quick Summary
Using other providers' work lets the internal audit activity deliver a broader, more efficient overall assessment of governance, risk management, and control. The process is: map the assurance landscape, evaluate the provider's competence, objectivity, and due care, evaluate the scope and quality of the work, decide the degree of reliance in proportion to risk, supplement where necessary, aggregate consistently, document the basis, and disclose the reliance in the overall opinion. Throughout, the CAE retains full responsibility for the conclusion. If you can apply these principles to a scenario, you can answer virtually any CRMA question on this topic.