Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CIA] CIA1: Coordination with External Auditors: A Guide to GIAS-Compliant Collaboration
Transcript
- Emma: Marcus, let's talk about a relationship that can be either a huge asset or a huge headache for a CAE: the one with the external auditors. Where does it go wrong? Marcus: It often goes wrong with a simple lack of communication, and the cost is enormous. Think of a global company. Their internal audit team flies to a remote warehouse to test inventory controls. A month later, the external audit team flies to the *exact same* warehouse to test the *exact same* controls. Emma: Ouch. That’s two expensive trips, and I can't imagine the plant manager was happy about being audited twice on the same thing. Marcus: Exactly. And the real failure? While both teams were focused on that one redundant area, neither had the time or scope to look at a critical cybersecurity risk in the company's new ERP system. That's not just inefficient; it's a failure of governance. Emma: So, the goal is to work together. The terms I always hear are 'coordination' and 'reliance'. They sound similar, but I know the exam treats them very differently. What's the fundamental distinction? Marcus: That’s the crucial question. They are absolutely not the same. Coordination is about aligning activities. It's a collaborative, peer-to-peer relationship to ensure efficient audit coverage and minimize that duplication we just talked about. Emma: Okay, so we're sharing plans, sharing risk assessments. Marcus: Right. Now, reliance is different. That's when the external auditor decides to use the specific work of the internal audit function to change the nature, timing, or extent of their own audit procedures. This isn't just a friendly chat; it's a formal evaluation process. Emma: Can you give me an analogy? Marcus: Think of a new skyscraper being built. You have two inspectors. One is the client's own quality assurance inspector—that's internal audit. The other is the city's building code inspector—that's external audit. Emma: Both have a job to do. Marcus: Yes. They coordinate by sharing blueprints and schedules. They make sure they aren't both trying to test the same electrical panel on the same Tuesday. That’s just smart planning between peers. Emma: Makes sense. So what would reliance look like in that analogy? Marcus: For the city inspector to rely on the internal inspector's report on, say, the HVAC system, they can't just take their word for it. They first have to formally assess if the internal inspector is competent, objective, and followed a rigorous, documented process. The city inspector doesn't work for the client. Emma: Got it. One is a conversation between equals, and the other is a formal assessment where one party is evaluating the other. Marcus: Precisely. And that changes the entire dynamic. In coordination, the relationship is collaborative. In reliance, it's evaluative and, in a sense, hierarchical. The external auditor is sitting in judgment of internal audit's work. Emma: Which means the day-to-day activities must look different, too. Marcus: They do. Coordination involves regular meetings, sharing risk assessments, and discussing findings. For reliance, the external auditors are digging much deeper. They’re reviewing internal audit's workpapers, maybe even re-performing some of our tests, and formally assessing our team's competence and objectivity. Emma: That second one—reliance—sounds like it could create some independence issues for the internal audit function. Marcus: That’s the big risk. With coordination, the CAE keeps full control over the internal audit plan and scope. But with reliance, especially if it involves providing direct assistance, the CAE has to be very careful that it doesn't impair our objectivity for future internal audits in that same area. Emma: Okay, so if reliance is so formal, what triggers it? When can an external auditor actually rely on internal audit's work? Marcus: They can't just decide to. Their own professional standards require them to perform a formal evaluation of the internal audit function first. They have to be satisfied in three key areas. Emma: And what's the first one? Marcus: The first is Objectivity. They look at our organizational status. Does the CAE report functionally to the board or audit committee? Are there policies in place to make sure individual auditors are free from conflicts of interest on their assignments? Emma: That sounds like it ties directly back to the Global Internal Audit Standards. Marcus: It does. It aligns perfectly with the GIAS principles on independence and objectivity. The second area they must evaluate is Competence. Emma: Does the team have the right skills for the job? Marcus: Exactly. They'll look at the training, the professional certifications like the CIA, and the overall expertise of the team. Do we have the technical knowledge required for the specific work they're considering for reliance? Emma: Okay, so they've checked our objectivity and our competence. What's the third and final piece? Marcus: They have to assess our Systematic and Disciplined Approach. This is about process. They'll review our audit methodology, our documentation standards, and our Quality Assurance and Improvement Program, or QAIP. Emma: So, basically, do we work like professionals? Is our work planned, performed, and documented in a rigorous way that’s consistent with the Standards? Marcus: You’ve got it. Objectivity, Competence, and a Systematic and Disciplined Approach. Without a formal and favorable evaluation of all three, there can be no reliance. Emma: Let's put this into a real-world scenario. Can you walk me through an example? Marcus: Sure. Let's say you're the CAE at a company called Nexus Solutions. You're in a meeting with the new external audit partner. To be helpful, the partner suggests that to reduce the annual audit fees, your internal audit team could perform all the testing of IT general controls for SOX compliance. Emma: And the external audit firm would then just 'rely' on that work. That sounds tempting. Saving the company money is a good thing. Marcus: It is tempting. And that’s the trap. But a good CAE thinks through the steps. First, you acknowledge the shared goal: efficiency and avoiding duplication of effort. That’s a great starting point. Emma: But you don't just agree. Marcus: You absolutely do not just agree. Your second step is to evaluate the request. You know that for reliance to even be possible, the external auditors must first conduct that formal assessment of your function's competence, objectivity, and methodology. That hasn't happened. This is a new partner. Emma: And what's the third step? I'm guessing this is where independence comes in. Marcus: It's the most important step. You have to protect your independence. You would explain that while your team does have a robust plan to audit ITGCs, that plan's scope and objectives were set by *your* audit committee, based on *your* risk assessment. Performing work at the direction of the external auditor could impair your team's objectivity for future internal audits of those same controls. Emma: So you're not saying no, but you're re-framing the conversation. What do you propose instead? Marcus: You propose coordination, not immediate reliance. You offer to share your internal audit plan and your testing schedule for ITGCs. This lets the external auditor see the work you're already planning to do. They can use that information to adjust their own timing, and maybe even reduce their sample sizes after they do their own review. Emma: So you achieve the same goal of efficiency, but you do it without giving up control or compromising independence. The CAE stays in the driver's seat of the internal audit plan. Marcus: Exactly. The tempting-but-wrong answer is to immediately say yes to save the fees. That subordinates your function and bypasses the rules. Emma: It seems the most common pitfall here is confusing this idea of helpful coordination with subordination, where the external auditor is basically telling internal audit what to do. Marcus: That’s the number one mistake. The CAE is responsible for the internal audit plan, period. While you should always align your work with other assurance providers, the external auditor cannot dictate your scope, timing, or conclusions. If it ever looks like the external auditor is 'managing' your staff, you've crossed a line and impaired your independence. Emma: This is a lot to remember. Is there a good memory aid for the key elements of effective *coordination*? Marcus: There is. For effective communication and coordination, just think about how you SHARE. S-H-A-R-E. Emma: Okay, let's break that down. What's the 'S'? Marcus: S is for Schedule. Hold regular meetings to discuss plans, risks, and any emerging issues. Emma: 'H'? Marcus: H is for Harmonize. Align your risk assessments and audit timing to prevent those gaps and overlaps we talked about. Emma: 'A'? Marcus: A is for Access. Provide mutual access to relevant reports and workpapers, always respecting confidentiality, of course. Emma: 'R'? Marcus: R is for Resolve. Discuss significant findings and monitor the status of management's corrective actions together. Emma: And finally, 'E'? Marcus: E is for Escalate. When you see pervasive control themes or major issues, you can jointly communicate those to the audit committee, which adds a lot of weight. Emma: SHARE: Schedule, Harmonize, Access, Resolve, Escalate. That’s very helpful. Okay, last question. It's exam day. I get a question about this. What's the one thing I should look for in the answer choices? Marcus: Always, always select the 'Independence First' option. The best answer on the CIA exam will be the one that promotes efficiency and collaboration while explicitly safeguarding internal audit's independence and the CAE's authority over the audit plan. Any answer that suggests the CAE cedes control is almost certainly incorrect. Emma: That’s a great rule of thumb. Marcus: And if you're looking for more ways to practice applying these rules, VoraPrep is a full exam-prep app. It has lessons, thousands of practice questions, and even an AI tutor in one place. You can find it at Vora Prep dot com to get started and try it out. Emma: Fantastic. So, to wrap this all up, what are the key takeaways? Marcus: First, coordination and reliance are different. Coordination is collaborative; reliance is evaluative and requires a formal assessment. Second, the CAE is responsible for coordinating, minimizing duplication, and optimizing assurance for the organization. Emma: And third? Marcus: Third, before relying on our work, external auditors must evaluate our objectivity, competence, and systematic approach. And finally, the most important point: internal audit's independence must never be compromised. The CAE, not the external auditor, directs the activities of the internal audit function. Emma: Perfect. A crystal-clear guide to a critical relationship. Thanks, Marcus. And for everyone listening, keep up the great work. You've got this. We'll see you next time on VoraPrep Audio.