When the chief audit executive (CAE) is uncertain whether the internal audit team has the necessary knowledge to conduct a specific engagement, such as reviewing testing procedures for a large information system, the most appropriate course of action is to engage an external service provider with the required expertise. This option helps to preserve the independence and objectivity of the internal audit activity.
Detailed Explanation:
IIA Standard 1210 - Proficiency:
This standard requires that internal auditors possess the knowledge, skills, and other competencies needed to perform their responsibilities. If the current team lacks the necessary skills, the CAE must seek external expertise.
Preserving Independence:
Engaging an external service provider helps maintain the independence of the internal audit function, as the expertise is sourced from an independent party. This prevents potential conflicts of interest that might arise if resources are borrowed from within the organization (e.g., from the IT department).
IIA Practice Advisory 1210.A1-1:
This advisory suggests that the CAE may employ external experts to provide specialized knowledge for certain audit engagements, ensuring the audit activity remains independent and objective.
Why Not Other Options?
Option A (Contract with the software vendor): This could compromise independence, as the vendor may have a vested interest in the outcome of the audit.
Option B (Ask for a knowledgeable resource from IT): Using internal resources, especially from the IT department being audited, could impair independence and objectivity.
Option D (Request resources through the external auditor): This might be appropriate in some cases, but it is not as direct and effective as hiring an external provider with specialized skills for this specific engagement.
Conclusion: Option C is correct as it ensures the internal audit function maintains its independence while acquiring the necessary expertise to conduct the engagement effectively, in line with IIA standards.