—IIA 2024 · Standard 9.5
Standard 9.5: coordination and reliance.
Internal audit is rarely the only source of assurance. Standard 9.5 asks the chief audit executive to coordinate with the other providers — to cut duplication and expose gaps — and to document the basis whenever internal audit relies on their work. Reliance never moves accountability: the CAE still owns the conclusions.
—What the Standards Require
The requirements, in plain terms.
Standard 9.5
Coordinate with other providers
The CAE coordinates with internal and external assurance providers and considers relying on their work — to reduce duplication, reveal coverage gaps and add value.
Standard 9.5 · Escalation
When coordination fails
If coordination is inadequate, the CAE raises it with senior management and, where necessary, the board.
Standard 9.5 · Reliance
Document the basis
When internal audit relies on another provider's work, the CAE documents why that reliance is justified — and remains responsible for the conclusions reached.
—In Practice
What it looks like when it's done well.
Judge providers before relying on them
The Considerations suggest a methodology that looks at each provider's independence, objectivity, competency, due professional care, conflicts of interest and reporting lines. Reliance without that assessment is an assumption, not a conclusion.
Map assurance against risk
An assurance map links the significant risk categories to the sources of assurance over them, showing where coverage overlaps and where it is missing. It is the practical basis for a combined assurance plan.
Retest when reliance isn't warranted
Where another provider's work can't be relied on, internal audit retests or does the work itself. For long-term reliance, a written agreement sets out the assurance each provider will deliver.
—Evidence of Conformance
What an assessor will ask to see.
Minutes or meeting notes setting out the distinct assurance roles of each provider (9.5)
An assurance map or combined assurance plan showing who covers each risk area (9.5)
A documented reliance methodology — and evidence it was applied (9.5)
Written agreements with providers for the assurance work they deliver (9.5)
How ControlVista Supports It
VistaPlan — Planning & Scheduling
VistaPlan keeps the risk-ranked universe and the plan in one place, so gaps and overlaps in coverage show up against the risks themselves — the starting point for an assurance map and for deciding where reliance makes sense.
—Further Reading
From our resources.
—IIA 2024 Hub
More on the Standards.
—Frequently Asked
Questions audit leaders ask.
Does relying on another provider's work transfer responsibility?
No. Under Standard 9.5 the CAE must document the basis for relying on another provider's work and remains responsible for the conclusions internal audit reaches.
What is an assurance map?
A view linking significant risk categories to the internal and external sources of assurance over them, showing gaps and overlaps. The Standards' Considerations describe it as a way to coordinate assurance and support combined assurance.
Last reviewed October 2026. Standards references paraphrase The IIA's Global Internal Audit Standards (2024); they are not a substitute for the official text.
—Request a demo
See ControlVista run your audit lifecycle, end to end.
A 30-minute walkthrough with the team that built it — from the audit universe to the board-ready committee pack, in English and Arabic.
A product of Vantage Technologies.