SIA 270 provides a framework for internal auditors to engage experts or third parties when internal audit teams lack the necessary knowledge or technical skills. Experts may cover specialized areas such as IT, engineering, actuarial services, or financial products. The Internal Auditor remains responsible for the audit conclusions, even when relying on expert work, and must ensure independence, professional competence, and proper supervision. This standard clarifies that engagement of external service providers for regular audits follows separate guidance under SIA 120 but similar principles apply for oversight, methodology, and accountability.
The standard requires the Internal Auditor to assess the qualifications, credentials, and independence of experts or third parties, define the scope and approach of their work, and evaluate the outputs to ensure reliability. Documentation of procedures, findings, scope limitations, and review processes must be maintained for quality review and governance oversight. SIA 270 emphasizes that expert findings can only be included in internal audit reports if evaluated and validated by the Internal Auditor, ensuring that audit conclusions remain credible, reliable, and in compliance with ICAI pronouncements.
The Institute of Chartered Accountants of India
Standard on Internal Audit
(SIA) 270
Experts and Third-Party
Engagement
1. Introduction
1.1 An Expert is a person or an entity (such as an association of persons or a firm or a company) which possesses certain special skills or unique knowledge, along with some years of experience and expertise in a particular area, field or discipline.
1.2 In conducting internal audit assignments, the Chief of Internal Audit may seek the assistance and place reliance on the work of an Expert. This may be in the form of specific audit procedures covering a complex area or field (such as, Information Technology, Civil/ Electrical/ Mechanical Engineering etc., Banking, Oil and Gas Industry etc.) or a unique and specialised discipline (such as Actuarial Services, Forensic Audit, Taxation, Treasury operations, financial products, Risk Modelling, Intellectual Property or Business Valuations etc.).
1.3 An Expert is generally appointed to help complete part of an internal audit assignment in situations where the required skills are not available within the internal audit team or function. The Expert can be an employee of the company, much like an Internal Auditor provided all criteria concerning his independence and objectivity with respect the internal audit assignment is fulfilled.
1.4 Scope: This Standard applies to all internal audit assignments where part of the internal audit work is completed by an Expert or third-party and relied upon by the Internal Auditor to provide an independent assurance.
However, an external service provider with expertise in accounting and auditing and engaged by the organisation to provide regular internal audit services is not treated as an Expert for this Standard. For such appointments, the Internal Auditor shall refer to another SIA 120 “Terms of Internal Audit Engagement” to fulfil the requirements of engaging External Service Providers, such as ensuring an Engagement Letter to cover the terms and conditions of appointment.
This Standard may also be read in conjunction with broader guidance when internal audit activities are outsourced to third-party service providers. In such cases, while the third party may not qualify as an Expert under this Standard, similar principles apply with regard to ensuring professional competence, objectivity, independence, and oversight. The Internal Auditor must ensure that outsourced service providers operate under formal engagement terms, follow a consistent internal audit methodology, and are supervised adequately. The Internal Auditor retains responsibility for the conclusions and opinions expressed in any internal audit report that incorporates work performed by such service providers.
2. Effective Date
2.1 This Standard is applicable for internal audits beginning on or after a date to be notified by the Council of the Institute.
3. Objectives
3.1 The objectives of using the work of an Expert or third-party engagement are to ensure that:
a. Technical assistance and support from competent experts are obtained where the internal audit team does not possess the necessary knowledge and expertise.
b. Internal audit procedures conducted in complex and specialised areas meet expected quality standards.
c. Outcome of the internal audit work is credible and reliable.
d. Work performed is in conformance with the applicable pronouncements of the ICAI.
e. Where internal audit activities are outsourced to experts or third-party, the engagement is conducted with due regard to independence, professional competence, and adequate supervision, such that the Internal Auditor can rely on the outsourced work and integrate it meaningfully within the internal audit function.
4. Requirements
4.1 The Internal Auditor shall make an independent determination of using the work of an Expert or third-party engagement based on:
a. The technicality and complexity of the subject matter of internal audit.
b. The risk assessment, materiality and importance of the subject matter, and
c. A comparison of the expertise available within the internal audit team to conduct a quality audit with the expertise required to execute the technical procedures.
4.2 Independence and Objectivity of the Expert or Third- Party (Refer Para. A1)
The Internal Auditor shall have the authority to select, appoint and engage the Expert or third-party. Where this authority rests with management, then the Internal Auditor shall conduct procedures to validate the independence and objectivity of the Expert or third-party and share any concerns highlighted with management and those charged with governance.
4.3 Qualification and Credentials of the Expert or Third- Party (Refer Para. A2)
The Internal Auditor shall conduct an independent evaluation of the qualifications and credentials of the expert or third-party.
4.4 Defining the Scope, Approach and Work of the Expert or Third-Party (Refer Para. A3)
Where the findings of the Expert or third party will form part of the assurance report to be issued by the Internal Auditor, the Internal Auditor shall participate in defining the scope, approach and work to be conducted by the Expert or third-party including evaluation of work done by the Expert or third-party (Refer Para. A3 and para A4). Otherwise, the Internal Auditor shall not incorporate the finding of the Expert or third-party in his Internal Audit report. (Refer Para. 4.6)
4.5 Evaluating the Work of an Expert or Third- Party (Refer Para. A4)
The Internal Auditor shall perform an evaluation of the work completed by the Expert or third-party to ensure that the work completed constitutes appropriate and reliable evidence to support the overall conclusions to be reported.
4.6 The Internal Auditor shall retain ultimate responsibility for internal audit conclusions and opinions which are incorporated in his internal audit report, unless specifically mandated otherwise by the Assurance User (the recipient of the Internal Audit Report). Hence, the Internal Auditor shall not refer to the work of an Expert or third-party in his Internal Audit Report, unless required by the Assurance User.
*****
Application and Other Explanatory Material
A1. Independence and Objectivity of the Expert or Third-Party (Refer Para. 4.2): The Internal Auditor should conduct procedures to assess the ability of the Expert or Third-party to function in an independent and objective manner such as the following:
a. The Appointing and Supervisory Authority: Where the authority to appoint and supervise the Expert or third-party rests with someone other than the Internal Auditor, the outcome of the work of expert or third-party may be influenced by such authority.
b. Employee of the Company or External Service provider: An external professional would not be influenced by company management in comparison to an Expert or third-party who is an employee of the company and reporting to management.
c. Relationship of Expert: Where there is any relationship of the Expert or third-party with Company Management, especially with those who have some role in the internal audit assignment, the objectivity of the Expert or third-party may get compromised.
d. Personal Interests: Where the Expert or third-party has any personal, financial or organisational interests (such as significant portion of his income is derived from the company), it may prevent the rendering of an unbiased and impartial report.
A2. Qualifications and Credentials of the Expert or third-party (Refer Para. 4.3): The Internal Auditor shall independently validate the qualification and credentials of the Expert or third-party, with procedures, such as the following:
a. Confirmation of educational and professional qualifications and membership of professional bodies.
b. Background and reference checks of the experience and/or reputation of the Expert or third-party.
c. Details of instances and nature of similar past assignments undertaken; and
d. Self-Certification by the Expert or third-party regarding his qualifications, expertise, any conflict of interest or any pending disciplinary actions.
A3. Defining the Scope, Approach and Work of the Expert or third-party (Refer Para. 4.4): Where the Internal Auditor plans to incorporate the findings of the work of the Expert or third-party as part of his Internal Audit Report, the Internal Auditor shall participate in defining the Plan and Procedures of the Expert or third-party, as follows (indicative list):
a. Define the audit objective of the technical procedures planned.
b. Identify the Subject matter to be reviewed and evaluated, especially what is included or excluded.
c. Define any specific requirements or limitations of the work to be undertaken.
d. The information required by the Expert or third-party and the source of that information, the nature and reliability of the original data to be used.
e. Define any assumptions which need to be incorporated as part of the exercise.
f. Extent of access to required systems, locations, records and company personnel, and
g. Clarify the confidentiality of information requirements and ownership of workpapers.
A4. Evaluating the Work of an Expert or third-party (Refer Para. 4.5): During and after completion of the work by the Expert or third-party, the Internal Auditor shall conduct an evaluation of the outcome of the findings of the Expert or third-party to determine the quality of the work performed and to validate the reliability of the findings as follows:
(a) A detailed review of the report and findings.
b. Extent and thoroughness of the audit procedures completed.
c. Any scope limitations or other hurdles faced in completing the assignment, such as missing information or access limitations.
d. If appropriate, a review of certain workpapers and evidence collected to understand the basis of significant observations, and
e. The harmony and congruence of the findings of experts or third-party with the rest of the Internal Audit report.
In exceptional cases, where the findings of the Expert or third-party are not consistent with other aspects of the entity, the Internal Auditor should attempt to resolve the inconsistency through discussions with the Auditee and the Expert or third-party. In extreme situations, conducting additional procedures or engaging another Expert or third-party may be required to resolve the inconsistency.
A5. Documentation: To confirm compliance of audit procedures with this SIA, a list of the documents required is as follows:
a. Details of procedures conducted to validate the requirements of an Expert or third-party. (Refer Para. 3.1)
b. Details of procedures conducted to validate the Independence and Objectivity of the Expert or third-party. (Refer Para. A1)
c. Details of procedures conducted to verify the Qualifications and Credentials of the Expert of third-party. (Refer Para. A2)
d. Details of procedures conducted to define the Scope, approach and work plan of the Expert or third-party. (Refer Para. A3)
e. A summary of the review completed to evaluate the quality and reliability of the work completed. (Refer Para. A4)
This documentation should be retained as part of the internal audit working papers and shall be made available for quality review, peer review, or oversight by those charged with governance, as applicable.
