A chief audit executive plans a cloud-migration audit and finds nobody on staff has ever read a container configuration. The engagement still has to happen. That gap, and how it gets closed, is what this objective tests.
The Global Internal Audit Standards place the competency duty on the function as a whole, not only on the individual auditor. Collective competency means the function possesses, in aggregate, the knowledge, skills, and competencies needed to perform its plan. An individual auditor may lack a skill without breaching anything, provided the function supplies it.
Two ways to close a gap:
- Develop: Train, rotate, coach, or hire for the skill so it lives inside the function permanently.
- Procure: Obtain the skill from outside for a defined need, through a guest auditor from another department, a co-source arrangement, or an external specialist.
DECISION: Develop when the skill recurs across the audit plan and the organization will keep needing it. Procure when the need is one-off, highly technical, or urgent. If the gap appears in one engagement next month, procure.
Common mistakes
- Treating competency as individual only. The obligation is collective. One auditor's gap is a breach only if the function fails to develop or procure the skill.
- Assuming procurement transfers responsibility. The chief audit executive evaluates the specialist's competence and objectivity, supervises the work, and owns the conclusion.
- Using a specialist who built the control. The vendor that implemented the wallet controls cannot objectively assess them; procure someone else.
Bottom line
- Competency is collective: the function must possess the knowledge, skills, and competencies to deliver its plan, whether developed internally or procured externally.
- Develop for recurring needs (train, hire, rotate); procure for one-off, urgent, or highly technical needs (guest auditor, co-source, external specialist).
- Procurement never transfers responsibility; the chief audit executive evaluates competence and objectivity, supervises, and owns the conclusion.
- A specialist who designed or implemented the control under audit is impaired and cannot provide the assurance work.
Exam shortcut
Sort the stem by what is missing. Missing skill on a one-time technical engagement means procure. Missing skill across several engagements a year means develop. Missing skill with a deadline that beats any training calendar means procure regardless of recurrence. When an outside expert appears, run three checks in order: competence, objectivity, then supervision.
The full lesson (about 1,930 words, 13 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 4
Browse all free CIA Part 1 lessons or jump into free CIA Part 1 practice questions.