[lylo]

I think either of your options would work. If you have in-house skills (yourself and/or another engineer), exploit them. If you have a trusted third party who can help, spend some time and money on them. If neither of those work and you feel you need to hire someone, do that (although I’d go with the other two options first). Also, as you undertake these audits, keep a solid record of documentation (questions and answers) as most due dil exercises will be made up of many of the same questions. Stock answers go a long way.