Summary: The Standard on Auditing (SA) 610 provides guidance on the statutory auditor’s use of the internal audit function’s work in the audit process. Given the constraints of time and resources in audits, the statutory auditor may rely on the internal auditor’s work, particularly in assessing internal controls, risk identification, and understanding the entity’s environment. The external auditor’s use of internal audit work can modify the audit’s nature, timing, and extent, but the external auditor remains fully responsible for the audit opinion. While both auditors share similar objectives, internal auditors work under management’s direction, whereas external auditors are independent. The statutory auditor should assess the competence, independence, and organizational status of the internal audit function before relying on its work. Factors such as judgment, risk, and internal audit’s objectivity and competence influence the auditor’s decision. Coordination between both auditors is critical, ensuring communication about areas of reliance and timely sharing of significant findings. The external auditor must evaluate the adequacy of internal audit work, perform supplementary tests if necessary, and ensure the internal auditor’s work meets the required standards. By adhering to these practices, the statutory auditor ensures that the internal audit function’s work effectively contributes to the overall audit process.
Need and Possibility of use of work of Internal Auditor by Statutory Auditor: Like In other activities of life in audit also the main constraint is scarcity of resources, but here the most important resources are time & availability of competent persons. As the most of the work performed/techniques used/resources used by internal auditors and external (Statutory) auditors are normally same, this more specific to the matters related with assessment of internal control framework. Thus there emerges a possibility of elimination of possibility of duplicity of activities already undertaken/to be undertaken by internal Auditors.
Knowledge and experience of the internal audit function can inform the external auditor’s understanding of the entity and its environment and identification and assessment of risks of material misstatement. Effective communication between the internal and external auditors also creates an environment in which the external auditor can be informed of significant matters that may affect the external auditor’s work.
The external auditor expects to use the work of the internal audit function as part of the audit evidence obtained. Such use of the work modifies the nature timing and extent, of audit procedures to be directly by the external auditor. This is to kept in mind that – while the external auditor has sole responsibility for his report and for the determination the nature, timing and extent of the audit procedures.
Relationship and difference between Internal and External Auditor:
Particulars Internal Audit Function/ Internal Auditor External Auditor
Role and Scope To be determined by Management Statutory and defined by the applicable law and regulation
Objective / Functions Set by the management and not as same with the external auditor (In most of the cases it is review of other internal Controls) To report on the True and Fairness of Financial Statements
Independence & Responsibility Part of management as an organ or a separate entity serving under the direction of management Separate and Independent entity
Reporting Responsibility To Management To Shareholders or As specified under Statute
SA 610 not applies if :
- If entity not under Internal Audit
- If activity under internal audit is not relevant for statutory audit
- In accordance with SA 315 Statutory Auditor is not expected to use the work of the function in obtaining audit evidence – Where limited checking should not be carried out by the Statutory Auditor.
- If restricted
The external auditor shall make all significant judgments in the audit engagement and, to prevent undue use of the work of the internal audit function, shall plan to use less of the work of the function and perform more of the work directly: (Shall avoid using work of internal auditor in following ares)
(a) The more judgment is involved in: (i) Planning and performing relevant audit procedures; and (ii) Evaluating the audit evidence gathered; (Ref: Para. A18–A19)
(b) The higher the assessed risk of material misstatement at the assertion level, with special consideration given to risks identified as significant; (Ref: Para. A20–A22) (c) The less the internal audit function’s organizational status and relevant policies and procedures adequately support the objectivity of the internal auditors; and (d) The lower the level of competence of the internal audit function.
Internal Auditor’s Work can be used in following ways by the statutory Auditor:
1. Using Internal Auditors to provide direct assistance
2. Assessing the work already done by internal auditor and using that to derive assurance level while determining the nature, timing and extent of the audit procedures
Prior to using internal auditors to provide direct assistance for purposes of the audit, the external auditor shall:
(a) Obtain written agreement from an authorized representative of the entity that the internal auditors will be allowed to follow the external auditor’s instructions, and that 9 SA 260, paragraph 11. 8 the entity will not intervene in the work the internal auditor performs for the external auditor; and
(b) Obtain written agreement from the internal auditors that they will keep confidential specific matters as instructed by the external auditor and inform the external auditor of any threat to their objectivity.
The external auditor shall direct, supervise and review the work performed by internal auditors on the engagement in accordance with SA 220. In so doing:
(a) The nature, timing and extent of direction, supervision, and review shall recognize that the internal auditors are not independent of the entity and be responsive to the outcome of the evaluation of the factors in paragraph 29 of this SA; and
(b) The review procedures shall include the external auditor checking back to the underlying audit evidence for some of the work performed by the internal auditors. The direction, supervision and review by the external auditor of the work performed by the internal auditors shall be sufficient in order for the external auditor to be satisfied that the internal auditors have obtained sufficient appropriate audit evidence to support the conclusions based on that work. (Ref: SA 610)
General Evaluation of Internal Audit Function :
The external Coordination between Statutory and Internal Auditors: It is desirable that that the external auditor ascertains the internal auditor’s tentative plan for the year and discusses it with him at as early a stage as possible to determine areas where he considers that he could rely upon the internal auditor’s work. Where internal audit work is to be a factor in determining the nature, timing and extent of the external auditor’s procedures, it is desirable to plan in advance the timing of such work, the extent of audit coverage, test levels and proposed methods of sample selection, documentation of the work performed and review and reporting procedures.
Coordination with the internal auditor is usually more effective when meeting are held at appropriate interval during the year. It is desirable that the external auditor is advised of, and has access to, relevant internal audit report reports and in addition is kept informed, along with management, of any significant matter that comes to the internal auditor’s attention and which he believes may affect the work of the external auditor. Similarly, the external auditor should ordinarily inform the internal auditor of any significant matters which may affect his work.
General Evaluation of Internal Audit Function: The external auditor’s general evaluation of the internal audit function will assist him in determining the extent to which he can place reliance upon the work of the internal auditor. The external auditor should document his evaluation and conclusions in this respect. The important aspects to be considered in this context are:
a) Organizational Status: Whether internal audit is undertaken by an outside agency or by an internal audit department within the entity itself, the internal auditor report to the management. In an ideal situation he reports to the highest level of management and is free of any other operating responsibility. Any constraints or restrictions placed upon his work by management should be carefully evaluated. In particular, the internal should be free to communicate fully with the external auditor.
b) Scope of Function: the external auditor should ascertain the nature and depth of coverage of the assignment which the internal auditor discharges for management. He should also ascertain to what extent the management considers, and where appropriate, acts upon internal audit recommendations.
c) Technical Competence: The external auditor should ascertain that internal auditor should ascertain that internal audit work is performed by persons having adequate technical training and proficiency. This may be accomplished by reviewing the experience and professional qualification of the persons undertaking the internal audit work.
d) Due professional Care: The external auditor should ascertain whether internal audit work appears to be properly planned, supervised, reviewed and documented. An example of the exercise of due professional care is by the internal auditor is the existence of adequate audit manuals, audit programmes and working papers.
If the external auditor plans to use the work of the internal audit function, the external auditor shall discuss the planned use of its work with the function as a basis for coordinating their respective activities. (Ref: Para. A24–A26)
The external auditor shall read the reports of the internal audit function relating to the work of the function that the external auditor plans to use to obtain an understanding of the nature and extent of audit procedures it performed and the related findings.
The external auditor shall perform sufficient audit procedures on the body of work of the internal audit function as a whole that the external auditor plans to use to determine its adequacy for purposes of the audit, including evaluating whether:
(a) The work of the function had been properly planned, performed, supervised, reviewed and documented; 7 SA 260, Communication with Those Charged with Governance, paragraph 11. 6
(b) Sufficient appropriate evidence had been obtained to enable the function to draw reasonable conclusions; and (c) Conclusions reached are appropriate in the circumstances and the reports prepared by the function are consistent with the results of the work performed. (Ref: Para. A27–A30) 24.
The nature and extent of the external auditor’s audit procedures shall be responsive to the external auditor’s evaluation of:
(a) The amount of judgment involved;
(b) The assessed risk of material misstatement;
(c) The extent to which the internal audit function’s organizational status and relevant policies and procedures support the objectivity of the internal auditors; and
(d) The level of competence of the function
The External auditor should also test the work of the internal auditor on which he intends to rely. The nature timing and extent of the external auditor’s tests will depend upon the judgment as to the materiality of the area concerned to the financial statements taken as a whole and the results of his evaluation of the internal audit function and of the specific internal audit work. His test may include examination of items already examined by the internal auditor, examination of other similar items, and observation of the internal auditor’s procedures.
Author Bio
