Proficiency and Due Professional Care
Proficiency belongs to the activity
The Standards require the internal audit activity, collectively, to possess or obtain the knowledge, skills and other competencies needed to perform its responsibilities. Individual auditors need competence suited to their assignments, and the CAE carries the additional duty of matching total resources to the audit plan. In practice that means evaluating needs for IT, data analytics, fraud and regulatory skills before accepting the plan, and obtaining specialists (external service providers, subject-matter experts) where gaps exist. Continuing professional development is part of proficiency: the IIA expects practising internal auditors to complete 40 hours of continuing education each year, including ethics hours.
Due professional care
Due professional care is the care and skill expected of a reasonably prudent and competent internal auditor, not omniscience. It means judging how much work is needed, weighing relative materiality and significance of risk, comparing cost of assurance with benefit, exercising professional skepticism, considering the potential for fraud, and supervising and reviewing engagement work. It does not guarantee detection of all fraud, error or noncompliance, and it does not require testing every transaction.
Using specialists or providers
Assess their competence and objectivity, document that assessment, and remember responsibility remains with internal audit; the auditor cannot defer blindly to an expert's conclusions.
Rule of thumb
Proficiency is measured for the team; due professional care is measured for the engagement. When a question says the auditor lacked a needed skill, prefer the answer that obtains the competence - training, a specialist or a provider - over one that abandons the engagement.
Traps
Answers promising absolute assurance, exhaustive transaction testing, or liability for every undetected irregularity are wrong.