When should internal audit use specialists instead of handling an emerging risk alone?

It becomes a problem when the engagement objective requires conclusions the team cannot support with its own competence and evidence.

Internal audit may use specialists when technical knowledge is needed to evaluate criteria, interpret evidence, validate data, test configurations, or challenge management's explanation. Examples include cybersecurity architecture, model validation, privacy engineering, environmental metrics, complex treasury systems, or specialized regulatory processes.

The choice is not all or nothing. Internal audit can:

• use a specialist for defined procedures,
• co-source part of the engagement,
• train staff before fieldwork,
• narrow the scope to controls the team can evaluate, or
• perform advisory work now and plan assurance later.

The report should be transparent about scope and evidence. If the team tested governance and access controls but not model performance, the conclusion should not imply assurance over model accuracy.