In my experience, a contractor is usually hired or an external auditor is hired for such occasions. This is standard practice if no resources are made available from within the organization.