A legitimate response to the prospective client under these circumstances would be to decline the engagement due to lack of specific competencies or make arrangements to obtain assistance from a competent IT auditing expert. These options ensure that the internal audit activity maintains its professional competence and integrity by only undertaking engagements where they can provide or ensure the required level of expertise.References:
IIA standards on professional competence and due care, which stipulate that internal auditors must have or obtain the necessary knowledge and skills to perform their tasks effectively, and if not, they should decline the engagement or seek expert assistance.