Engaging an engineer satisfies the standard. Deferring to one does not.

The Global Internal Audit Standards took effect on 9 January 2025. Standard 3.1 requires internal auditors and the internal audit function to collectively possess or obtain the competencies needed to fulfil their responsibilities. Standard 10.2 puts the corresponding duty on the chief audit executive, who must ensure the function collectively has what the charter commits it to, or go and get it.

"Collectively" is doing the work in both. Nobody has to be an engineer. Somebody on the engagement has to be, or the function has to obtain one.

Most audit functions read that correctly and stop there, as though the requirement were a hiring instruction. It is the easy half. The obligations that decide whether the exercise was worth commissioning all sit after the engineer has been engaged.

What competence is actually needed

"Engineering" is too coarse an answer. The competence a programme audit needs is specific, and it is easiest to see against a single instrument.

Whether a variation was authorised, and under which clause, is a contractual question. Whether the agreed rates were applied to the measured quantities is an arithmetic one. Both can be settled by anyone competent at reading a contract and a valuation, and both are the questions a generalist team is well equipped to ask.

The other three cannot be settled from the paperwork the variation arrives in, however carefully that paperwork is read. Whether the change was technically required or merely preferred is an engineering judgement. Whether the programme supports the period claimed requires somebody who can distinguish float from padding, and retained logic from as-built. Whether the delay was caused by that event, rather than running concurrently with something else, is the question most claims turn on and the one least often tested.

The same pattern holds elsewhere. Assessing whether a concept estimate was being defended as a budget, read: An estimate is a measure of how well the scope is definedAn estimate is a measure of how well the scope is defined requires knowing what an estimate class declares. Assessing whether a testing regime was completed requires knowing what the specification demanded. None of that is financial testing, and none of it can be supervised by somebody who has not done it.

Obtaining it is permitted three ways

The Standards do not prescribe how the competence is acquired. It can be recruited, co-sourced from a firm, or engaged as a specialist for a single review, and all three satisfy 3.1.

One consequence is worth stating because it is often assumed the other way round. The Standards follow the work rather than the employment contract: they apply to anyone providing internal audit services, whether an organisation employs its auditors, contracts them through an external service provider, or both. Co-sourcing a programme audit therefore transfers the labour and not the obligation. The requirements still attach, and the chief audit executive still answers for them.

Evaluating the person you obtained

This is the step that gets skipped, and there is no internal audit document that sets it out in as much practical detail as the external audit standard on the same problem.

ISA 620 governs a different regime. It applies to statutory audit, not to internal audit, and citing it as authority for an internal function would be a category error. As a benchmark for what careful practice looks like, it is the most developed thing available. It defines an expert as somebody with expertise in a field other than accounting or auditing, which is exactly the case here, and it requires the auditor to evaluate that person's competence, capabilities and objectivity, to determine and communicate the scope and objectives of the work before it starts, and then to evaluate the adequacy of the findings for the auditor's own purposes.

ACCA's material on auditing specialised industries, written for its Advanced Audit and Assurance candidates, names the failure mode without softening it. There is a danger of over-reliance on the expert, and any inconsistency between the expert's findings and the auditor's own understanding of the entity has to be investigated rather than absorbed.

Two bodies with different remits, reaching the same requirement from different directions, is a reasonable indication that the requirement is not controversial. ACCA does not set internal audit standards, and nothing here suggests otherwise. What it does is teach and examine the discipline, which means the material is already familiar to a substantial share of the people staffing these engagements.

Objectivity is the hard one in this market

Of the three tests, objectivity is the one a capital programme makes genuinely difficult.

The people qualified to judge whether a variation was technically justified, or whether a delay analysis holds, are the people who have done that work on comparable schemes in the same market. That is a small population. Its members have usually worked for a designer, a contractor, a cost consultant or a certifier, and often on a package adjacent to the one under review. Some will expect to work for them again.

ISA 620 requires inquiry into the interests and relationships that could threaten an external expert's objectivity, and the IIA's own framing of competency sits alongside its requirements on objectivity rather than apart from them. A function borrowing an engineer for a fortnight rarely runs that inquiry, partly because the engineer came recommended by somebody on the programme.

The conclusion does not transfer

An engineer can establish that a temporary works design was inadequate, that a delay analysis does not support the period claimed, or that a change was avoidable.

None of those is an audit finding yet. Whether the failure represents a control that was absent or a control that was overridden, whether it was identified and reported at the time and to whom, whether it indicates something about the packages nobody has examined, and what any of it means for the assurance the board is relying on, are audit judgements. They stay with the auditor, and they are the part a technical specialist was never engaged to supply.

This is also the line that keeps the arrangement defensible. An expert who is asked to reach the audit conclusion has effectively been asked to audit, without the independence assessment, the supervision or the methodology that would make that acceptable.

Where the profession's own guidance thins out

There is a contrast in the IIA's library that is worth noticing without overstating. The Institute publishes a Global Technology Audit Guide dedicated to auditing IT projects. Comparable dedicated guidance for major physical capital programmes is considerably harder to find, and what exists sits mainly in training material rather than in the guidance series.

That material makes the argument for itself: an auditor without project management knowledge is not positioned to assess whether the relevant controls were designed correctly, let alone whether they operated. The observation is uncontested inside the profession. It has simply attracted less codification for the asset class where the sums are largest.

---

Sources. The Institute of Internal Auditors, Global Internal Audit Standards, 2024 edition, effective 9 January 2025, Standard 3.1 on competency and Standard 10.2 on the chief audit executive's resourcing duty. IAASB, International Standard on Auditing 620, Using the Work of an Auditor's Expert, cited as a benchmark for careful practice and not as authority over internal audit. ACCA, Auditing in Specialised Industries, technical article for the Advanced Audit and Assurance paper. The Institute of Internal Auditors, Global Technology Audit Guide, Auditing IT Projects, and its material on auditing project management practices. Figure 01 is original. Standards published behind a paywall are cited without a link.