Ashish Gogia
SCOPE
1.This SA deals with the external auditor’s responsibilities if using the work of internal auditors. This includes
(a) using the work of the internal audit function in obtaining audit evidence and
(b) using internal auditors to provide direct assistance under the direction, supervision and review of the external auditor.
2. This SA does not apply if the entity does not have an internal audit function.
3. In some cases, the external auditor may be prohibited, or restricted to some extent, by law or regulation from using the work of the internal audit function or using internal auditors to provide direct assistance. The SAs do not override laws or regulations that govern an audit of financial statements.
The External Auditor’s Responsibility for the Audit
ü The external auditor has sole responsibility for the audit opinion expressed, and that responsibility is not reduced by the external auditor’s use of the work of the internal audit function or internal auditors to provide direct assistance on the engagement.
ü Although they may perform audit procedures similar to those performed by the external auditor, neither the internal audit function nor the internal auditors are independent of the entity as is required of the external auditor in an audit of financial statements in accordance with SA 200
ü This SA, therefore, defines the conditions that are necessary for the external auditor to be able to use the work of internal auditors
Objectives
(a) To determine whether the work of the internal audit function or direct assistance from internal auditors can be used, and if so, in which areas and to what extent;
(b) If using the work of the internal audit function, to determine whether that work is adequate for purposes of the audit; and
(c) If using internal auditors to provide direct assistance, to appropriately direct, supervise and review their work.
Definitions
Internal audit function
A function of an entity that performs assurance & consulting activities designed to evaluate and improve the effectiveness of the entity’s governance, risk management and internal control processes.
Direct Assistance
The use of internal auditors to perform audit procedures under the direction, supervision and review of external auditor.
Requirements of SA 610 (Revised)
- Determining Whether, in Which Areas, and to What Extent the Work of the Internal Audit Function Can Be Used
- Evaluating the Internal Audit Function
The external auditor shall determine whether the work of the internal audit function can be used for purposes of the audit by evaluating the following:
(a) The extent to which the internal audit function’s organizational status and relevant policies and procedures support the objectivity of the internal auditors;
(b) The level of competence of the internal audit function; and
(c) Whether the internal audit function applies a systematic and disciplined approach, including quality control.
The external auditor shall not use the work of the internal audit function if the external auditor determines that:
(a) The function’s organizational status and relevant policies and procedures do not adequately support the objectivity of internal auditors;
(b) The function lacks sufficient competence; or
(c) The function does not apply a systematic and disciplined approach, including quality control.
Determining the Nature and Extent of Work of the Internal Audit Function that Can Be Used
- The external auditor shall consider the nature and scope of the work that has been performed, or is planned to be performed, by the internal audit function and its relevance to the external auditor’s overall audit strategy and audit plan.
- The external auditor shall make all significant judgments in the audit engagement and, to prevent undue use of the work of the internal audit function, shall plan to use less of the work of the function and perform more of the work directly.
- The external auditor shall also evaluate whether, in aggregate, using the work of the internal audit function to the extent planned would still result in the external auditor being sufficiently involved in the audit, given the external auditor’s sole responsibility for the audit opinion expressed.
- The external auditor shall, in communicating with TCWG an overview of the planned scope and timing of the audit in accordance with SA 260, communicate how the external auditor has planned to use the work of the internal audit function.
Using the Work of the Internal of the Internal Audit Function
1. If the external auditor plans to use the work of the internal audit function, the external auditor shall discuss the planned use of its work.
2. The external auditor shall read the reports of the internal audit function relating to the work of the function that the external auditor plans to use to obtain an understanding of the nature and extent of audit procedures it performed and the related findings.
3. The external auditor shall perform sufficient audit procedures on the work of the internal audit function as a whole that the external auditor plans to use to determine its adequacy for purposes of the audit, including evaluating whether:
a. The work of the function had been properly planned, performed, supervised, reviewed and documented;
b. Sufficient appropriate evidence had been obtained to enable the function to draw reasonable conclusions; and
c. Conclusions reached are appropriate in the circumstances and the reports prepared by the function are consistent with the results of the work performed.
4. The nature and extent of the external auditor’s audit procedures shall be responsive to the external auditor’s evaluation of:
a. The amount of judgment involved;
b. The assessed risk of material misstatement;
c. The extent to which the internal audit function’s organizational status and relevant policies and procedures support the objectivity of the internal auditors; and
d. The level of competence of the function;
and shall include re-performance of some of the work.
5. The external auditor shall also evaluate whether the external auditor’s conclusions regarding the internal audit function and the determination of the nature and extent of use of the work of the function for purposes of the audit remain appropriate.
Determining the Nature and Extent of Work that Can Be Assigned to Internal Auditors Providing Direct Assistance
1. In determining the nature and extent of work that may be assigned to internal auditors and the NTE of direction, supervision and review that is appropriate in the circumstances, the external auditor shall consider:
(a) The amount of judgment involved in Planning and performing relevant audit procedures; and Evaluating the audit evidence gathered;
(b) The assessed risk of material misstatement; and
(c) The external auditor’s evaluation of the existence and significance of threats to the objectivity and level of competence of the internal auditors who will be providing such assistance.
2. The external auditor shall not use internal auditors to provide direct assistance to perform procedures that:
(a) Involve making significant judgments in the audit;
(b) Relate to higher assessed risks of material misstatement;
(c) Relate to work with which the internal auditors have been involved;
or
(d) Relate to decisions the external auditor makes in accordance with this SA regarding the internal audit function and the use of its work or direct assistance.
3. Having appropriately evaluated whether and, if so, to what extent internal auditors can be used to provide direct assistance on the audit, the external auditor shall, in communicating with TCWG an overview of the planned scope and timing of the audit in accordance with SA 260, communicate the nature and extent of the planned use of internal auditors to provide direct assistance so as to reach a mutual understanding that such use is not excessive in the circumstances of the engagement.
Using Internal Auditors to Provide Direct Assistance
1. Prior to using internal auditors to provide direct assistance for purposes of the audit, the external auditor shall:
(a) Obtain written agreement from an authorized representative of the entity that the internal auditors will be allowed to follow the external auditor’s instructions, and that the entity will not intervene in the work the internal auditor performs for the external auditor; and
(b) Obtain written agreement from the internal auditors that they will keep confidential specific matters as instructed by the external auditor and inform the external auditor of any threat to their objectivity.
2. The external auditor shall direct, supervise and review the work performed by internal auditors on the engagement in accordance with SA 220.
3. The direction, supervision and review by the external auditor of the work performed by the internal auditors shall be sufficient in order for the external auditor to be satisfied that the internal auditors have obtained sufficient appropriate audit evidence to support the conclusions based on that work.
Documentation w.r.t. Use of work of Internal Audit Function by external Auditor
(a) The evaluation of:
(i) Whether the function’s organizational status and relevant policies and procedures adequately support the objectivity of the internal auditors;
(ii) The level of competence of the function; and
(iii) Whether the function applies a systematic and disciplined approach, including quality control;
(b) The nature and extent of the work used and the basis for that decision; and
(c) The audit procedures performed by the external auditor to evaluate the adequacy of the work used.
W.r.t. Direct Assistance of internal auditor used by external auditor
(a) The evaluation of the existence and significance of threats to the objectivity of the internal auditors, and the level of competence of the internal auditors used to provide direct assistance;
(b) The basis for the decision regarding the nature and extent of the work performed by the internal auditors;
(c) Who reviewed the work performed and the date and extent of that review in accordance with SA 230;
(d) The written agreements obtained from an authorized representative of the entity and the internal auditors; and
