The primary responsibility for the internal audit activity in helping management maintain effective controls is promoting continuous monitoring. Continuous monitoring involves regularly reviewing control processes and performance to ensure they are effective and making adjustments as necessary. This proactive approach enables the internal audit activity to assist management in maintaining a robust control environment that can adapt to changes in the organization or its external environment.
The IIA ' s International Standards for the Professional Practice of Internal Auditing regarding monitoring and control.

According to the IIA Standards, the chief audit executive (CAE) must ensure that internal audit activities are performed with competence and due professional care. If the internal audit team lacks the necessary knowledge or skills to perform all or part of the work, the CAE must obtain competent advice and assistance.
Thus, the CAE's best response to defend the expenditure for an external fraud expert is to refer to the Standards, explaining that the internal audit activity must obtain competent assistance if needed to ensure the investigation is conducted effectively and professionally.
IIA Standard 1210: Proficiency

When an internal auditor has audited the same department repeatedly, familiarity threat is a significant concern. The IIA Standards emphasize maintaining objectivity and avoiding circumstances that could impair the auditor's unbiased attitude. Auditing the same department annually for several years can lead to familiarity, which can compromise the internal audit activity's independence and objectivity (Option B).
According to Standard 1130: Impairment to Independence or Objectivity, auditors must avoid auditing areas where repeated engagements might lead to a lack of objectivity due to familiarity.
IIA Standards, Standard 1130: Impairment to Independence or Objectivity IIA Practice Guide: Independence and Objectivity

Internal controls are mechanisms put in place to reduce the probability or impact of risks affecting the organization's objectives. They do not eliminate risks entirely (which would be avoidance) nor do they transfer or share the risk (as in risk sharing); rather, they mitigate risks to more acceptable levels.
Institute of Internal Auditors (IIA) - Guidance on Risk Assessment in Practice

The statement that a lack of controls is acceptable if the risk is reduced to an acceptable level in some other way is true. Risk management involves identifying, assessing, and responding to risks to achieve the objectives of the organization. If a risk can be mitigated to an acceptable level through alternative means other than traditional controls, such as risk avoidance or risk transfer, this approach can be deemed acceptable.
Risk management standards and frameworks, such as COSO and ISO 31000.