Implementation Guide 2050

Standard 2050 Coordination and Reliance

The chief audit executive should share information, coordinate activities, and consider
relying upon the work of other internal and external assurance and consulting service
providers to ensure proper coverage and minimize duplication of efforts.

Interpretation:

In coordinating activities, the chief audit executive may rely on the work of other
assurance and consulting service providers. A consistent process for the basis of reliance
should be established, and the chief audit executive should consider the competency,
objectivity, and due professional care of the assurance and consulting service providers.
The chief audit executive should also have a clear understanding of the scope,
objectives, and results of the work performed by other providers of assurance and
consulting services. Where reliance is placed on the work of others, the chief audit
executive is still accountable and responsible for ensuring adequate support for
conclusions and opinions reached by the internal audit activity.

Revised Standards, Effective 1 January 2017

Getting Started
The roles of assurance and consulting service providers vary by organization. Thus, to start
the task of coordinating their efforts, the chief audit executive (CAE) identifies the various roles
of existing assurance and consulting service providers by reviewing the organization chart and

1
 Implementation Guide 2050 / Coordination and Reliance

board meeting agendas or minutes. The roles are generally categorized as either internal
providers or external providers.

Internal providers include oversight functions that either report to senior management
or are part of senior management. Their involvement may include areas such as
environmental, financial control, health and safety, IT security, legal, risk
management, compliance, or quality assurance. These are often considered second
line of defense activities, according to The IIAs Three Lines of Defense model.
External assurance providers may report to senior management or external
stakeholders, or they could be hired by and report to the CAE.

Once the providers of assurance and consulting services have been identified, the CAE
considers the type and amount of information that may be shared with them, in accordance
with the organizations confidentiality requirements. It is important that the CAE considers the
limitations of sharing confidential information, particularly with external parties.

Considerations for Implementation

The CAE meets with each of the providers to gather sufficient information so that the
organizations assurance and consulting activities may be coordinated. Within the limitations of
the organizations confidentiality requirements, the parties share the objectives, scope, and
timing of upcoming reviews, assessments, and audits; the results of prior audits; and the
possibility of relying on one anothers work.

The process of coordinating assurance activities varies by organization. In smaller

organizations, coordination may be informal. In large or heavily regulated organizations,
coordination may be formal and complex.

One way to coordinate assurance coverage is to create an assurance map by linking identified
significant risk categories with relevant sources of assurance and rating the level of assurance
provided for each risk category. Because the map is comprehensive, it exposes gaps and
duplications in assurance coverage, enabling the CAE to evaluate the sufficiency of assurance
services in each risk area. The results can be discussed with the other assurance providers so

2
 Implementation Guide 2050 / Coordination and Reliance

that the parties may reach an agreement about how to coordinate activities to minimize
duplication of efforts and maximize the efficiency and effectiveness of assurance coverage.

Another approach to coordinating assurance coverage is a combined assurance model, where

internal audit may coordinate assurance efforts with second line of defense functions, such as
a compliance function, to reduce the nature, frequency and redundancy of internal audit
engagements.

Examples of coordinating activities include:

Synchronizing the nature, extent, and timing of planned work.

Ensuring a common understanding of assurance techniques, methods, and
terminology.
Providing access to one anothers work programs, workpapers, and reports.
Relying on one anothers work to minimize duplication of effort.
Meeting intermittently to determine whether it is necessary to adjust the timing of
planned work, based on the results of work that has been completed.

The CAE may choose to rely on the work of other providers for various reasons, such as to
assess specialty areas outside of the internal audit activitys expertise or to enhance risk
coverage beyond the internal audit plan. However, if the internal audit activity relies on the
work of another service provider, the CAE retains ultimate responsibility for internal audit
conclusions and opinions. Thus, it is essential that the CAE establish a consistent process and
set of criteria to determine whether the internal audit activity may rely on the work of another
provider. In this process, the CAE may:

Evaluate objectivity by considering whether the provider has, or may appear to have,
any conflicts of interest and whether they have been disclosed.
Consider independence by examining the providers reporting relationships and the
impact of this arrangement.
Confirm competency by verifying whether the providers professional experience,
qualifications, certifications, and affiliations are appropriate and current.
Assess due professional care by examining elements of the practice the provider

3
 Implementation Guide 2050 / Coordination and Reliance

applies to complete the work (i.e., the providers methodology and whether the work
was appropriately planned, supervised, documented, and reviewed).

The CAE may also seek to gain an understanding of the scope, objectives, and results of the
actual work performed to determine the extent of reliance that may be placed on the providers
work. The CAE typically considers whether the providers findings appear reasonable and are
based on sufficient, reliable, and relevant audit evidence. The CAE determines whether
additional work or testing is needed to obtain sufficient evidence to support or increase the
level of reliance desired. If additional work is needed, the internal audit activity may retest the
results of the other provider.

Considerations for Demonstrating Conformance

Evidence of conformance with Standard 2050 could include communications regarding distinct
assurance and consulting roles and responsibilities, which may be documented in the notes
from meetings with individual providers of assurance and consulting services or in minutes of
meetings with the board and senior management. Conformance with the requirements
regarding reliance on the work of other providers may also be evidenced through the CAEs
documentation of the process and criteria applied to determine whether the internal audit
activity may rely on a providers work. Conformance with the requirement to coordinate the
providers of assurance and consulting services is evidenced through assurance maps and/or
combined internal audit plans that identify which provider is responsible for providing
assurance or consulting services in each area.

4
 Implementation Guide 2050 / Coordination and Reliance

About The IIA

The Institute of Internal Auditors (The IIA) is the internal audit professions most widely recognized advocate, educator,
and provider of standards, guidance, and certifications. Established in 1941, The IIA today serves more than 180,000
members from more than 170 countries and territories. The associations global headquarters are in Lake Mary, Fla.
For more information, visit www.globaliia.org or www.theiia.org.

About Implementation Guidance

Implementation Guidance, as part of The IIAs International Professional Practices Framework (IPPF), provides
recommended (non-mandatory) guidance for the internal audit profession. It is designed to assist both internal auditors
and internal audit activities to enhance their ability to achieve conformance with the International Standards for the
Professional Practice of Internal Auditing (Standards).

Implementation Guides assist internal auditors in applying the Standards. They collectively address internal audit's
approach, methodologies, and consideration, but do not detail processes or procedures.

For other authoritative guidance materials provided by The IIA, please visit our website at
www.globaliia.org/standards-guidance or www.theiia.org/guidance.

Disclaimer
The IIA publishes this document for informational and educational purposes. This guidance material is not intended to
provide definitive answers to specific individual circumstances and, as such, is only intended to be used as a guide.
The IIA recommends that you always seek independent expert advice relating directly to any specific situation. The IIA
accepts no responsibility for anyone placing sole reliance on this guidance.

Copyright
Copyright 2016 The Institute of Internal Auditors. For permission to reproduce, please contact [email protected].