Coordinate assurance and decide when to rely on other work
Coordination reduces gaps and unnecessary duplication, but reliance requires an assessment of the provider and the actual work. Consider competence, objectivity, scope, timing, method, and support for the results. Another team’s report is not automatically suitable evidence for your objective.
Before relying, inspect the match
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Provider | Assess relevant capability and whether relationships could affect judgment. | Assuming a familiar brand guarantees suitable work. |
| Work performed | Compare the objective, period, population, procedures, and depth with your assurance need. | Relying on a design-only review for a conclusion about operating effectiveness. |
| Results and documentation | Understand exceptions and the evidence supporting the conclusions. | Using a favorable summary while ignoring exclusions and unresolved findings. |
Provider
Assess relevant capability and whether relationships could affect judgment.
Avoid: Assuming a familiar brand guarantees suitable work.
Work performed
Compare the objective, period, population, procedures, and depth with your assurance need.
Avoid: Relying on a design-only review for a conclusion about operating effectiveness.
Results and documentation
Understand exceptions and the evidence supporting the conclusions.
Avoid: Using a favorable summary while ignoring exclusions and unresolved findings.
A decision path you can use
- 1Identify overlapping assurance work
- 2Evaluate the provider and coverage
- 3Document reliance and remaining work
Understand the method
Work through the reasoning
Identify what other providers actually cover
Other internal and external providers may perform compliance, risk, quality, financial, security, or other assurance-related work. Understand their objectives, scope, periods, methods, and reporting. Similar titles do not guarantee that their work answers the same question as internal audit’s proposed engagement.
Coordination can reduce unnecessary duplication and reveal gaps. Discuss planned work and share appropriate information within authorized arrangements. Keep responsibilities clear: management monitoring, external assurance, and independent internal audit can contribute different perspectives without becoming interchangeable.
Evaluate the basis for reliance
Before relying on another provider, consider competence, objectivity, due professional care, and the relevance and quality of the work. Understand the methods, evidence, findings, and limitations sufficiently for the intended use. A respected provider’s name is not a substitute for evaluating its actual coverage.
Consider timing and changes since the work was performed. A sound assessment of last year’s system configuration may not cover a recent migration. Determine whether additional procedures or updated evidence are needed before using the result to support a current conclusion.
Document how the work supports the objective
Identify which portions of the other provider’s work will be used and how they connect to the engagement or plan. Record the assessment supporting reliance and any supplementary procedures. If access to underlying information is restricted, evaluate how that affects the ability to rely.
The chief audit executive retains responsibility for internal audit’s conclusions. Coordination does not transfer that accountability to the other provider. Avoid presenting a conclusion broader than the evidence obtained directly and the work appropriately relied upon.
Maintain coordination as coverage changes
Regularly update understanding of provider activities, particularly after organizational or system changes. An assurance map can help visualize who covers which risks, but its entries must reflect evaluated evidence. The linked map-maintenance lesson focuses on keeping that record accurate over time.
Where appropriate coordination is not possible, communicate concerns through the relevant leadership route. Explain the consequence, such as duplication, missing assurance, or inability to assess reliance. The goal is coherent coverage with clear accountability, not eliminating every instance of overlapping work.
Original teaching example
Apply the method to a decision
The scenario
Compliance reviewed policy design last quarter. Internal audit must assess whether transaction monitoring operated this quarter. The CAE considers cancelling all testing because compliance issued a positive report.
The decision
Use the design work where appropriate, but it does not answer the current operating-effectiveness objective.
The subject overlaps, while purpose and period differ. Assess the work’s quality and identify what remains to be tested. Coordination is useful precisely because it makes both usable coverage and gaps explicit.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
A strong report covers the wrong period
The situation
A qualified external provider reviewed access controls before a major identity-system migration. The current audit concerns controls after migration.
Reason through it
The provider’s competence does not make the earlier configuration representative of the new one. Evaluate what remains relevant and what new evidence is required.
Take the decision
Rely only to the extent supported by the scope, timing, and quality assessment. Address the post-migration gap explicitly.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Does reliance transfer responsibility for internal audit’s conclusion?
No. Internal audit must understand and justify how the other work supports its conclusion and what additional work remains necessary.
Does coordination always mean eliminating duplicate testing?
No. Some overlap may be justified by different objectives, periods, responsibilities, or required levels of assurance. Evaluate whether work is genuinely duplicative and whether reliance is appropriate before reducing procedures.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Internal Audit Plan (15% of Part 3). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Standard 9.5. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
- IIA Three Lines Model: 2026 Statement of Position
- Coordination and reliance among the three lines, pages 15-16. Explains coordination and reliance across roles. Use it with Standard 9.5 when evaluating the competence, objectivity, scope, and evidence relevant to a reliance decision.
Part 3: Internal Audit Function. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.