You probably can't simply use your own staff to do it; your contractual and insurance obligations will probably mandate that a reputable third party conduct the audit. That's not always the case, but in big cases it usually is.
Oh, absolutely. In my arena, finance, there's no way you'd use your own staff - it would go straight to external auditors who'd conduct the investigation or contract specialist firms to investigate. Of course, not always going to be the case for smaller companies and more minimal impact cases.