An organization's chief audit executive (CAE) determines that the internal audit staff does not have the requisite skills to conduct an audit of the financial derivatives area. Which of the following would be the best course of action for the CAE to follow?

This approach is the most comprehensive and compliant with professional standards. It addresses the immediate competency gap for the high-risk financial derivatives audit by engaging an external expert, thereby ensuring the engagement is conducted with the required proficiency as mandated by IIA Standard 1210.A1. Simultaneously, it addresses the long-term development of the internal audit staff through supplementary training. This dual strategy represents effective resource management by solving the current problem while building internal capabilities for the future, ensuring the internal audit activity can fulfill its responsibilities effectively.

A. Outsourcing without informing the audit committee is inappropriate. The CAE has a responsibility to communicate significant issues, including resource limitations and sourcing decisions, to senior management and the board/audit committee.
B. Delaying a critical audit significantly is not a prudent course of action, as it leaves a potentially high-risk area unexamined. The immediate need for assurance is not met by a long-term training plan alone.
C. Assigning auditors who are known to lack the requisite skills violates the fundamental IIA Standard 1210 on Proficiency. The "most competent" among an unqualified team is still not competent for the specific engagement.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards).

Standard 1210: Proficiency: "The internal audit activity must collectively possess or obtain the knowledge, skills, and other competencies needed to perform its responsibilities."

Standard 1210.A1: "The chief audit executive must obtain competent advice and assistance if the internal auditors lack the knowledge, skills, or other competencies needed to perform all or part of the engagement." This standard directly supports the action of employing an expert consultant.

Standard 2060: Reporting to Senior Management and the Board: This standard requires the CAE to report on resource limitations, which contradicts the approach in option A.

2. The Institute of Internal Auditors (IIA). (2017). Practice Guide: Sourcing the Internal Audit Function.

Section: Co-sourcing, Page 10: The guide explains that co-sourcing is a common strategy to "fill gaps in skill sets" for specialized areas. It states, "Co-sourcing is often used to address skill gaps in specialized or technical areas (e.g., derivatives, treasury, and certain IT areas)." This directly validates using an expert for a financial derivatives audit.

3. Anderson, U. L., Head, M. J., Ramamoorti, S., Riddle, C., & Salamasick, M. (2017). Internal Auditing: Assurance & Advisory Services (4th ed.). The Institute of Internal Auditors Research Foundation.

Chapter 17, "Managing the Internal Audit Activity," Page 17-11: The text discusses staffing and resource management, stating, "When the internal audit function lacks specific expertise for a particular engagement, it may be necessary to use external resources... This is a common practice for audits of highly technical areas such as derivatives..." This academic source confirms that engaging experts for specialized audits is a best practice.