Statement on Auditing Standards

Scope and objectives

The auditing standards explains that the standard applies to situations where the external auditor plans to use the work of internal auditors in obtaining audit evidence, or to use internal auditors to provide direct assistance under the direction, supervision, and review of the external auditor.

The standard clarifies that if an entity does not have an internal audit function, then this standard does not apply. Similarly, the standard does not apply if the responsibilities and activities of the internal audit function are not relevant to the audit or if the external auditor does not expect to use the work of the function in obtaining audit evidence.

The standard emphasizes that the external auditor has sole responsibility for the audit opinion expressed, and that responsibility is not reduced by the use of the work of internal auditors. It defines the conditions that are necessary for the external auditor to use the work of internal auditors, and the necessary work effort to obtain sufficient appropriate evidence that the work of the internal audit function, or internal auditors providing direct assistance, is adequate for the purposes of the audit.

Furthermore, the standard explains that effective communication between the internal and external auditors creates an environment in which the external auditor can be informed of significant matters that may affect the external auditor’s work. Depending on the internal audit function’s organizational status and relevant policies and procedures, the external auditor may be able to use the work of the internal audit function in a constructive and complementary manner.

Finally, the standard provides the effective date, objectives, and requirements for external auditors when using the work of internal auditors. The objectives are to determine whether the work of the internal audit function or direct assistance from internal auditors can be used, and if so, in which areas and to what extent, and to determine whether that work is adequate for purposes of the audit.

Evaluating the Internal Audit Function

The role of the external auditor in evaluating the internal audit function of an organization and determining whether their work can be used for the purposes of the audit.

The external auditor evaluates the internal audit function’s organizational status, relevant policies, and procedures to determine whether they support the objectivity of internal auditors. Objectivity is the ability to perform tasks without bias, conflict of interest, or undue influence. Factors that affect the external auditor’s evaluation include the organizational status of the internal audit function, whether the internal audit function is free from conflicting responsibilities, whether those charged with governance oversee employment decisions related to the internal audit function, and whether there are constraints or restrictions placed on the internal audit function by management or those charged with governance.

The external auditor also evaluates the level of competence of the internal audit function to determine whether it possesses the necessary knowledge and skills required to perform assigned tasks diligently and in accordance with applicable professional standards. Factors that may affect the external auditor’s determination include whether the internal audit function is adequately and appropriately resourced, whether there are established policies for hiring, training, and assigning internal auditors, and whether the internal auditors possess the required knowledge and skills related to the entity’s financial reporting.

The external auditor also evaluates whether the internal audit function applies a systematic and disciplined approach, including quality control, to planning, performing, supervising, reviewing, and documenting its activities. This is important to ensure that the internal audit function’s activities are distinguished from other monitoring control activities that may be performed within the entity. Factors that may affect the external auditor’s determination include the existence, adequacy, and use of documented internal audit procedures or guidance covering areas such as risk assessments, work programs, documentation, and reporting.

If the external auditor determines that the internal audit function’s organizational status, relevant policies, and procedures do not support the objectivity of internal auditors, lack sufficient competence, or do not apply a systematic and disciplined approach, the external auditor cannot use the work of the internal audit function.

The Nature and Extent of Work of the Internal Audit Function

The external auditor is responsible for expressing an opinion on the financial statements of an organization. In order to do this, they may consider using the work of the internal audit function, which is a separate function within the organization that is responsible for evaluating and improving the effectiveness of the organization’s internal controls and risk management.

The external auditor must first determine whether the work of the internal audit function is relevant to their overall audit strategy and plan. If it is, they may consider using certain types of work performed by the internal audit function, such as testing of controls or compliance with regulations.

However, the external auditor must also evaluate the objectivity and competence of the internal audit function, as well as the level of judgment required in planning and performing the audit procedures. If there is a high level of judgment involved or if there are significant risks of material misstatement, the external auditor may need to perform more of the work directly rather than relying on the internal audit function

SA 610 also emphasizes that the external auditor is solely responsible for the audit opinion expressed, and therefore must make all significant judgments in the audit engagement. This includes assessing risks of material misstatement, evaluating test sufficiency, and evaluating accounting estimates and disclosures.

Finally, SA 610 notes that the external auditor must communicate their planned use of the internal audit function to those charged with governance, and ensure that they remain sufficiently involved in the audit process to fulfil their responsibilities.

Using the Work of the Internal Audit Function

The requirements and considerations related to the external auditor’s use of the work of the internal audit function in the course of the financial statement audit.

The first requirement, is that if the external auditor plans to use the work of the internal audit function, they need to discuss the planned use of that work with the internal audit function. This discussion serves as a basis for coordinating their respective activities, which can include topics such as the timing and nature of the internal audit work, the extent of coverage, materiality for the financial statements, proposed methods of item selection, documentation of work performed, and review and reporting procedures.

The specific steps of the external auditor need to take to evaluate the adequacy of the internal audit work and the objectivity with which it has been performed. These steps include reading the reports of the internal audit function, performing sufficient audit procedures on the body of work of the internal audit function as a whole, and evaluating whether the work had been properly planned, performed, supervised, reviewed, documented, and if sufficient appropriate evidence had been obtained to enable the function to draw reasonable conclusions.

The external auditor can also make inquiries of appropriate individuals within the internal audit function, observe procedures performed by the internal audit function, and review the internal audit function’s work program and working papers. The more judgment involved, the higher the assessed risk of material misstatement, the less the internal audit function’s organizational status and relevant policies and procedures adequately support the objectivity of the internal auditors, or the lower the level of competence of the internal audit function, the more audit procedures are needed to be performed by the external auditor on the overall body of work of the function.

SA 610 notes that the nature and extent of the external auditor’s audit procedures should be responsive to the amount of judgment involved, the assessed risk of material misstatement, the extent to which the internal audit function’s organizational status and relevant policies and procedures support the objectivity of the internal auditors, and the level of competence of the function. The external auditor’s audit procedures should include reperformance of some of the work.

Finally, SA 610 highlights the need for the external auditor to evaluate whether the external auditor has obtained sufficient appropriate audit evidence to support the financial statements’ presentation and disclosure, taking into account the nature and extent of the work of the internal audit function used in the audit. This evaluation should consider whether the external auditor has identified and appropriately responded to the risks of material misstatement, and whether the use of the internal audit function’s work is appropriate in the circumstances.

Determining Whether Internal Auditors Can Be Used to Provide Direct Assistance for Purposes of the Audit

The external auditors who want to use internal auditors to provide direct assistance on an audit engagement. “Direct assistance” refers to work done by internal auditors that directly contributes to the external audit engagement.

The guidelines suggest that if the external auditor is prohibited by law or regulation from using internal auditors for direct assistance, then they should not do so. If there is no prohibition, then the external auditor should evaluate the existence and significance of threats to the internal auditors’ objectivity and level of competence. Objectivity refers to the ability to perform the work without allowing bias or conflict of interest to override professional judgment.

In evaluating the objectivity of an internal auditor, the external auditor should consider factors such as the internal audit function’s organizational status and relevant policies and procedures, family and personal relationships with individuals in the entity, association with the division or department in the entity to which the work relates, and significant financial interests in the entity. Material issued by relevant professional bodies for internal auditors may also provide additional guidance.

If there are significant threats to the objectivity of the internal auditor or if the internal auditor lacks sufficient competence, then the external auditor should not use them for direct assistance.

The nature and extent of work that can be assigned to internal auditors providing direct assistance should be carefully determined by the external auditor. The amount of judgment involved, the assessed risk of material misstatement, and the external auditor’s evaluation of the existence and significance of threats to the objectivity and level of competence of the internal auditors should be considered. The external auditor should limit the work assigned to internal auditors to those areas that are appropriate to be assigned.

Examples of work that may not be appropriate to assign to internal auditors include discussion of fraud risks, determination of unannounced audit procedures, and control over external confirmation requests. The external auditor should also be careful not to excessively use internal auditors for direct assistance, as this may affect perceptions regarding the independence of the external audit engagement.

Using Internal Auditors to Provide Direct Assistance

The use of internal auditors by external auditors in the context of an audit engagement. Internal auditors are individuals who work within the organization being audited and are responsible for monitoring and assessing the effectiveness of the organization’s internal control processes. External auditors, on the other hand, are independent professionals hired by the organization to provide an objective assessment of the organization’s financial statements and internal control processes.

When external auditors use internal auditors to provide direct assistance in an audit, they must ensure that certain conditions are met. First, they must obtain written agreement from an authorized representative of the organization that the internal auditors will follow the external auditor’s instructions and that the organization will not interfere with the internal auditors’ work. Second, they must obtain written agreement from the internal auditors that they will maintain confidentiality as instructed by the external auditor and inform the external auditor of any threat to their objectivity.

The external auditor is responsible for directing, supervising, and reviewing the work performed by the internal auditors on the engagement. The nature, timing, and extent of this direction, supervision, and review must take into account that the internal auditors are not independent of the organization. The review procedures must include the external auditor checking back to the underlying audit evidence for some of the work performed by the internal auditors. The direction, supervision, and review by the external auditor must be sufficient to provide appropriate audit evidence to support the conclusions based on that work.

The external auditor may remind the internal auditors to bring accounting and auditing issues identified during the audit to the attention of the external auditor. The external auditor’s review of the work performed by the internal auditors must ensure that the evidence obtained is sufficient and appropriate in the circumstances and supports the conclusions reached. The external auditor must remain alert for indications that their evaluations are no longer appropriate when directing, supervising, and reviewing the work performed by internal auditors.

Documentation

The documentation requirements when external auditors use the work of the internal audit function in the audit. The following points are explained:

The external auditor must document the evaluation of the internal audit function’s organizational status and relevant policies and procedures, the level of competence of the function, and whether the function applies a systematic and disciplined approach, including quality control. The external auditor must also document the nature and extent of the work used and the basis for that decision, as well as the audit procedures performed to evaluate the adequacy of the work used.
If the external auditor uses internal auditors to provide direct assistance on the audit, the external auditor must include in the audit documentation the evaluation of the existence and significance of threats to the objectivity of the internal auditors and the level of competence of the internal auditors used to provide direct assistance. The external auditor must also document the basis for the decision regarding the nature and extent of the work performed by the internal auditors, who reviewed the work performed, and the date and extent of that review in accordance with SA 230. The external auditor must document the written agreements obtained from an authorized representative of the entity and the internal auditors of this SA610, as well as the working papers prepared by the internal auditors who provided direct assistance on the audit engagement.

The external auditor must document the evaluation and review of the internal audit function’s work and the internal auditors’ work to support their findings and conclusions in the audit report. The documentation must include the nature and extent of the work performed, the basis for that decision, and any agreements or evaluations related to the objectivity and competence of the internal auditors.

Quiz: Using the Work of Internal Auditors

1. Which of the following statements is true regarding the external auditor’s responsibility when using the work of internal auditors?

a. The external auditor’s responsibility is reduced.

b. The external auditor’s responsibility remains the same.

c. The external auditor’s responsibility is transferred to the internal auditors.

d. The external auditor’s responsibility is eliminated.

Answer: b.

2. In which situations does the auditing standard regarding the use of internal auditors not apply?

a. When an entity has an internal audit function.

b. When the internal audit function’s responsibilities are relevant to the audit.

c. When the external auditor expects to use the work of the internal audit function.

d. When an entity does not have an internal audit function.

Answer: d.

3. When evaluating the objectivity of internal auditors, the external auditor considers factors such as:

a. The level of competence of the internal audit function.

b. The adequacy of internal audit resources.

c. The existence of documented internal audit procedures.

d. The organizational status of the internal audit function.

Answer: d.

4. The external auditor can rely entirely on the work of the internal audit function without performing any additional procedures.

a. True

b. False

Answer: b.

5. What is the purpose of effective communication between the internal and external auditors?

a. To transfer responsibility from the external auditor to the internal auditors.

b. To ensure the objectivity of the internal audit function.

c. To inform the external auditor of significant matters that may impact their work.

d. To eliminate the need for the external auditor’s involvement in the audit process.

Answer: c.

6. When evaluating the competence of the internal audit function, the external auditor considers factors such as:

a. The organizational status of the internal audit function.

b. The external auditor’s assessment of risks of material misstatement.

c. The adequacy and appropriateness of internal audit resources.

d. The nature and extent of judgment involved in the audit procedures.

Answer: c.

7. True or False: If the internal audit function’s organizational status and relevant policies and procedures do not support objectivity, the external auditor can still use their work.

a. True

b. False

Answer: b.

8. What steps should the external auditor take to evaluate the adequacy of the internal audit work?

a. Read reports of the internal audit function.

b. Perform sufficient audit procedures on the body of work.

c. Evaluate whether the work was properly planned and performed.

d. All of the above.

Answer: d.

9. When determining the nature and extent of work that can be assigned to internal auditors providing direct assistance, the external auditor considers factors such as:

a. The level of competence of the internal auditors.

b. The assessed risk of material misstatement.

c. The existence and significance of threats to objectivity.

d. All of the above.

Answer: d.

10. What documentation requirements exist when external auditors use the work of the internal audit function?

a. Document the evaluation of the internal audit function’s organizational status and relevant policies.

b. Document the nature and extent of the work used and the basis for that decision.

c. Document the audit procedures performed to evaluate the adequacy of the work used.

d. All of the above.

Answer: d.

Additional question:

11. Which of the following statements is true regarding the external auditor’s responsibility when using the work of internal auditors?

a. The external auditor is solely responsible for the audit opinion expressed.

b. The external auditor’s responsibility is reduced when using internal auditors.

c. The external auditor’s responsibility is transferred to the internal auditors.

d. The external auditor’s responsibility is eliminated.

Answer: a.

12. Under which circumstances does the auditing standard regarding the use of internal auditors not apply?

a. If an entity has an internal audit function.

b. If the internal audit function’s responsibilities are relevant to the audit.

c. If the external auditor expects to use the work of the internal audit function.

d. If an entity does not have an internal audit function.

Answer: d.

13. What factors should the external auditor consider when evaluating the competence of the internal audit function?

a. The level of competence of the internal audit function.

b. The adequacy of internal audit resources.

c. The existence of documented internal audit procedures.

d. All of the above.

Answer: d.

14. True or False: The external auditor can solely rely on the work of the internal audit function without performing any independent procedures.

a. True

b. False

Answer: b.

15. Why is effective communication between the internal and external auditors important?

a. To transfer responsibility from the external auditor to the internal auditors.

b. To ensure the objectivity of the internal audit function.

c. To inform the external auditor of significant matters that may impact their work.

d. To eliminate the need for the external auditor’s involvement in the audit process.

Answer: c.

16. How can the external auditor evaluate the adequacy of the internal audit work?

a. By reading reports of the internal audit function.

b. By performing audit procedures on the internal audit work.

c. By evaluating the planning, performance, supervision, and review of the internal audit activities.

d. All of the above.

Answer: d.

17. True or False: The external auditor can use the work of the internal audit function even if their organizational status and relevant policies and procedures do not support objectivity.

a. True

b. False

Answer: b.

18. What steps should the external auditor take to determine the nature and extent of work that can be assigned to internal auditors providing direct assistance?

a. Consider the level of judgment involved.

b. Evaluate the assessed risk of material misstatement.

c. Assess the existence and significance of threats to objectivity and competence.

d. All of the above.

Answer: d.

19. What factors should the external auditor consider when evaluating the appropriateness of using internal auditors for direct assistance?

a. The objectivity and competence of the internal auditors.

b. The existence and significance of threats to objectivity.

c. The nature and extent of the audit procedures.

d. All of the above.

Answer: d.

20. What are the documentation requirements when external auditors use the work of the internal audit function in the audit?