An internal auditor is assigned to perform an audit of personal data protection practices in...

The auditor’s knowledge of data-protection law is significantly outdated, so current authoritative professional guidance should be obtained before relying on that knowledge in an engagement. Reviewing relevant IIA publications can help the auditor refresh professional knowledge, understand current privacy risks, and identify appropriate audit considerations. Simply beginning the audit based on training completed 15 years earlier would not demonstrate adequate proficiency. The audit client may possess valuable technical knowledge, but internal audit should not rely solely on the area under review as its source of professional audit guidance. More senior internal auditors are also not useful if, as the scenario states, no one else possesses relevant knowledge. Continuing professional development requires auditors to maintain and enhance competencies as requirements evolve. Therefore, seeking current relevant guidance from IIA publications is the best available option.