I work as an IT auditor. I am currently working on an risk assessment for PCI and testing evidence to prepare for filing the annual compliance report. A team member who I mentored in the past has asked me whether he can be assigned one of the more difficult / technically complex items to work on. Although his skills has improved during the time I have been working with him, I still do not feel they are sufficient. PCI certification report will be externally facing, so the consequence of false assurance are high and very visible.
Professional guidelines on audit supervision - state I should ensure the people who perform an attestation function have the necessary skills to do the job reliably. I am glad he is taking initiative to help the team, so I do not want to discourage his efforts in the future. As he is diligent and hard working, perhaps next year his skills will have become sufficient for me to delegate this task to him.
How do I tell that I must decline his request to take on this task this time due to inadequate experience in accordance with professional guidelines?