Statutory audit must “make more use” of internal audit expertise