Proficiency and Due Professional Care
This domain tests the competence standard and the care standard, and how they differ. Proficiency questions ask whether the audit team has the right skills; due care questions ask whether the work was planned and performed with the care a reasonably prudent auditor would show.
Proficiency
- Standard 1210: auditors must possess the knowledge, skills, and other competencies needed to perform their responsibilities; proficiency is judged collectively across the activity, not person by person.
- Standard 1210.A1: the CAE must obtain competent advice and assistance when the activity lacks the knowledge or skills required for part of an engagement.
- Standard 1210.A2: auditors must have sufficient knowledge to evaluate fraud risk and how it is managed, and knowledge of key information technology risks and controls.
- Standard 1230: continuing professional development is required so auditors maintain technical competence; the IIA's policy is 40 hours a year, including at least 2 hours of ethics.
- When an outside expert is used, the auditor evaluates the expert's competence, independence, and objectivity, and whether the work is adequate for the engagement's purpose.
Due professional care
- Standard 1220: due professional care means the care a reasonably prudent and competent auditor would exercise; it is not a guarantee and does not imply infallibility or zero risk.
- Due care considers the probability of significant errors, fraud, and noncompliance, and the cost of assurance relative to the benefit.
- Standard 1220.A3: auditors must be alert to significant risks that could affect objectives, including fraud, IT, and data-related risks, and address them in the work.
Worked example
An engagement on expense reimbursement uses a sample that ignores the sales team's commission-linked entertainment claims, the area management flagged as highest risk. The procedures were performed carefully, but due professional care was not exercised: the work program did not direct attention to the significant risk of overstated claims. The corrective action is planning-based - re-scope and target the high-risk population - not simply more sampling of the same low-risk items.
Traps that cost marks
- Reading due professional care as a guarantee that no error or fraud will be missed.
- Confusing individual competence with collective proficiency; one expert can cover the gap.
- Assuming auditors must be fraud or IT experts rather than sufficiently knowledgeable to evaluate the risk.
- Treating more testing as a substitute for risk-focused testing.