Relying on the Work of Internal Auditor (SA 610) A Simple Guide

Introduction

While both internal auditors and statutory auditors employ similar techniques and resources, their roles, objectives, and responsibilities differ. This difference creates a unique relationship where external auditors can leverage the work of internal auditors to enhance audit efficiency without compromising their own independence and responsibility.

• Internal auditors are employed by the management of an entity to evaluate and improve internal controls, risk management, and governance processes. Their scope of work and objectives are set by management and may not align completely with the external auditor’s focus.
• Statutory auditors, also known as external auditors, are independent entities appointed to provide an objective assessment of an entity’s financial statements. Their role is defined by statutory laws and regulations, with their primary objective being to report on the true and fair view of the financial statements to shareholders or as specified by the statute.

The external auditor has the sole responsibility for the audit opinion and is not relieved of this responsibility even if they rely on the work of internal auditors. This reliance is guided by Standard on Auditing (SA) 610, which outlines specific conditions and requirements for using the work of internal auditors.

Utilizing the Work of Internal Auditors

The external auditor can utilize the work of internal auditors in two main ways:

1. Direct assistance: Internal auditors can provide direct assistance by performing audit procedures under the direction, supervision, and review of the external auditor.
2. Assessing existing work: The external auditor can assess the work already performed by internal auditors to gain assurance and modify the nature, timing, and extent of their own procedures.

Ensuring the Adequacy of Internal Audit Work

When utilizing the work of internal auditors, the external auditor needs to ensure its adequacy for the audit. This involves:

• Direct assistance procedures: When internal auditors provide direct assistance, the external auditor needs written agreements from both the entity and the internal auditors regarding instructions, non-intervention, confidentiality, and objectivity. The external auditor should also direct, supervise, and review the work performed by internal auditors to ensure they obtain sufficient appropriate audit evidence.
• Reviewing existing work: The external auditor should read the internal audit reports and perform sufficient procedures to determine the adequacy of their work. This includes evaluating the planning, performance, supervision, review, and documentation of the internal audit work and the appropriateness of their conclusions.
• Performing tests: The external auditor should test the work of the internal auditor by examining items already examined by them or other similar items, and observing their procedures. The extent of these tests depends on the materiality of the area and the results of the evaluation of the internal audit function and their work.

Statutory Auditor Considerations Before Using Internal Audit Work

Before using the work of an internal auditor, the statutory auditor must consider several factors related to the internal audit function:

• Objectivity: The statutory auditor should evaluate whether the internal audit function’s organizational status and relevant policies and procedures adequately support the objectivity of the internal auditors. Ideally, the internal audit function should report to the highest level of management, such as an audit committee, and be free of any operating responsibilities. The statutory auditor should also consider any constraints or restrictions placed on the internal audit function’s work by management.
• Scope of Function: The statutory auditor should understand the nature and depth of the internal audit function’s assignments. In addition, the statutory auditor should understand management’s view of the internal audit function, including the extent to which management acts upon the internal audit function’s recommendations.
• Technical Competence: The statutory auditor must evaluate whether the internal audit function has sufficient competence. The statutory auditor may assess the competence of the internal audit function by considering the experience and professional qualifications of the internal audit staff.
• Due Professional Care: The statutory auditor should evaluate whether internal audit work is properly planned, supervised, reviewed, and documented. Adequate audit manuals, audit programs, and working papers are an indication that the internal audit function exercises due professional care.
• Methodology: The statutory auditor should assess whether the internal audit function applies a systematic and disciplined approach, including quality control..

Areas of Reliance on Internal Auditors’ Work

External auditors can rely on the work of internal auditors in specific areas, provided they meet the conditions and requirements. The key is to find a balance between leveraging the internal audit function’s efforts and maintaining the external auditor’s responsibility and independence.

Here are some areas where external auditors may rely on internal auditors’ work:

Testing the Operating Effectiveness of Controls: Internal auditors often perform tests of controls as part of their work. External auditors can use these results to support their own assessment of control risk, potentially reducing the extent of their own testing. However, the external auditor must carefully evaluate the internal auditors’ work, including their objectivity, competence, and the specific procedures performed.

Example: Internal auditors might test the controls over the sales and collection cycle. If the external auditor finds the internal auditors’ work adequate, they may reduce the extent of their own testing of controls in this area.

Substantive Procedures Involving Limited Judgment: Internal auditors can perform some substantive procedures, particularly those requiring less complex judgment. External auditors can use these results to obtain audit evidence.

Example: Internal auditors might test the accuracy of the aging of accounts receivable. The external auditor could then use this work as part of their audit procedures for accounts receivable.

Observations of Inventory Counts: Internal auditors may be involved in observing physical inventory counts. External auditors can utilize their observations to gain comfort over the existence and completeness of inventory.

Example: If internal auditors participate in inventory counts at multiple locations, the external auditor might rely on their observations to reduce the number of locations they visit for their own inventory count procedures.

Tracing Transactions Through the Information System: Internal auditors can assist in tracing transactions through the information system relevant to financial reporting. This helps the external auditor understand the flow of transactions and identify potential control weaknesses.

Example: Internal auditors could trace a sample of sales transactions from their origination to their recording in the general ledger. The external auditor could then use this work to assess the effectiveness of controls over the sales process.

Testing of Compliance with Regulatory Requirements: Internal auditors frequently perform compliance audits. External auditors can utilize these results when assessing the risk of noncompliance with relevant laws and regulations, which may impact the financial statements.

Example: Internal auditors might audit compliance with environmental regulations. The external auditor could consider their findings when evaluating the potential for environmental liabilities that should be reflected in the financial statements.

Audits or Reviews of Financial Information of Subsidiaries: In specific situations, external auditors can rely on internal auditors’ work on the financial information of subsidiaries, especially when these subsidiaries are not significant components of the group. However, professional standards like SA 600 (“Using the Work of Another Auditor”) must be considered.

Example: If an internal audit team audits the financial statements of a small, wholly-owned subsidiary, the external auditor might rely on their work, provided the subsidiary is not material to the consolidated financial statements and the other requirements of SA 600 are met.

It’s crucial to remember that the external auditor remains responsible for forming their own opinion on the financial statements, even when relying on internal auditors’ work. They must exercise professional skepticism and perform sufficient procedures to ensure the adequacy of the internal auditors’ work.

Limitations on Reliance

As highlighted in our previous conversations, external auditors cannot rely on internal auditors in areas requiring significant judgment, such as:

• Assessing risks of material misstatement
• Evaluating significant accounting estimates
• Evaluating the adequacy of disclosures in the financial statements
• Determining unannounced audit procedures

Transparency and Communication with those charged with governance (e.g., the audit committee) about the planned use of internal auditors’ work are essential to maintain good governance practices. 

Transparency and communication with those charged with governance regarding the planned use of internal auditors’ work are essential elements of good governance practices. They foster a shared understanding, enhance oversight, promote trust, facilitate coordination, and strengthen governance structures within the organization.

Can Internal Auditors Provide Direct Assistance to Statutory Auditors?

Yes, internal auditors can provide direct assistance to statutory auditors, but only under specific conditions such as following –

Direct assistance is defined as using internal auditors to perform audit procedures under the direction, supervision, and review of the external auditor.

This means the external auditor retains control over the work performed and is ultimately responsible for the quality of the audit evidence obtained.

However, there are limitations and important considerations for statutory auditors when using internal auditors for direct assistance:

Limitations:

• Legal and Regulatory Prohibitions: The external auditor may be prohibited by law or regulation from obtaining direct assistance from internal auditors. In such cases, the statutory auditor cannot utilize internal auditors for direct assistance.
• Threats to Objectivity: The external auditor must evaluate the existence and significance of threats to the objectivity of internal auditors who would be providing direct assistance. Significant threats to objectivity, such as close relationships with individuals involved in the area being audited, can preclude internal auditors from providing direct assistance.
• Insufficient Competence: The internal auditors must possess sufficient competence to perform the work assigned to them. The external auditor should evaluate the internal auditor’s competence based on factors like their technical training, proficiency, and experience.
• Significant Judgments: Internal auditors should not be used for tasks involving significant judgments. This includes activities like assessing risks of material misstatement, evaluating significant accounting estimates, and determining unannounced audit procedures.
• High Assessed Risks of Material Misstatement: The external auditor should generally avoid using internal auditors for areas with high assessed risks of material misstatement, especially significant risks. In these cases, the external auditor needs to perform more procedures directly to obtain sufficient and persuasive audit evidence.

Important Considerations:

Written Agreements: The statutory auditor needs to obtain written agreements from both the entity and the internal auditors before utilizing their direct assistance.

• The agreement with the entity should confirm that internal auditors will follow the external auditor’s instructions and that the entity will not interfere with their work.
• The agreement with the internal auditors should ensure confidentiality regarding specific matters instructed by the external auditor and require them to inform the external auditor of any threats to their objectivity.

• Direction, Supervision, and Review: The external auditor must diligently direct, supervise, and review the work performed by internal auditors.
• Documentation: The statutory auditor needs to document their evaluation of the internal auditors’ objectivity and competence, the basis for the decision to use direct assistance, details about the review of the internal auditors’ work, the written agreements, and the working papers prepared by the internal auditors.

Areas Where External Auditors Should Not Use Internal Auditors’ Work

Even when the work of internal auditors is deemed usable, external auditors retain full responsibility for the audit opinion and must independently perform certain critical tasks. SA 610 (Revised)  outlines the areas where external auditors should exercise caution in relying on internal auditors or refrain from using their work altogether.

1. Areas Requiring Significant Judgment

External auditors must make all significant judgments in the audit engagement themselves. These judgments include:

• Assessing Risks of Material Misstatement: This involves identifying and evaluating the risks that the financial statements could be materially misstated. The external auditor’s understanding of the entity, its industry, and the applicable financial reporting framework is crucial in this process.
• Evaluating the Sufficiency of Tests Performed: The external auditor needs to determine whether the audit procedures performed, including those performed by internal auditors, provide sufficient appropriate audit evidence to support their conclusions.
• Evaluating the Appropriateness of Management’s Use of the Going Concern Assumption: The external auditor must assess whether management’s use of the going concern assumption is appropriate based on the available evidence. This judgment requires a thorough understanding of the entity’s financial condition and future prospects.
• Evaluating Significant Accounting Estimates: Many items in the financial statements require management to make estimates (e.g., useful lives of assets, allowance for doubtful accounts). The external auditor is responsible for evaluating the reasonableness of these estimates.
• Evaluating the Adequacy of Disclosures in the Financial Statements: The external auditor must ensure that the financial statements include all necessary disclosures, are presented fairly, and comply with the relevant financial reporting framework.

The SA emphasizes that relying solely on the work of internal auditors in these areas would not provide the external auditor with sufficient appropriate audit evidence. The external auditor must apply their professional skepticism, knowledge, and experience to make these judgments independently.

2. Areas of Higher Assessed Risk of Material Misstatement

The higher the risk of material misstatement associated with a particular assertion, the more persuasive the audit evidence needs to be. It is advised for external auditors to plan to use less of the internal audit function’s work and perform more work directly when:

The assessed risk of material misstatement at the assertion level is high, with special consideration given to risks identified as significant. This is because higher-risk areas generally require more complex and judgmental audit procedures.

The SA also specifically mentions that for significant risks, which require special audit consideration, the external auditor’s ability to use the work of the internal audit function will be limited to procedures that involve limited judgment.

3. Limitations on Using Internal Auditors for Direct Assistance

SA 610 (Revised) sets boundaries on using internal auditors to provide direct assistance under the external auditor’s direction, supervision, and review:

• Procedures Involving Significant Judgments: Internal auditors should not be used to perform procedures requiring significant audit judgments (as discussed in the previous section).
• Procedures Relating to Higher Assessed Risks: The use of internal auditors for direct assistance should be limited in areas where the risk of material misstatement is higher, and the judgment required is more than limited.
• Self-Review Threat: Internal auditors should not be involved in work that they have already performed or will report to management or those charged with governance. This is to prevent a self-review threat, where the external auditor might be inclined to accept the internal auditor’s work without sufficient skepticism because they were involved in it.
• Decisions Related to the Internal Audit Function: Internal auditors should not participate in the external auditor’s decisions about using the internal audit function or the nature and extent of their work. This ensures the external auditor’s independence in these matters.

4. Prohibitions on Providing Internal Audit Services to Audit Clients

• The prohibition against providing both external and internal audit services to the same client is a fundamental principle in auditing.
• This restriction aims to safeguard auditor independence, which is essential for maintaining the integrity and reliability of financial reporting.
• The self-review threat is a primary concern as it can significantly compromise the objectivity of the external auditor’s work.
• Professional standards and ethical guidelines clearly state this prohibition, underscoring its importance in upholding the auditing profession’s credibility.

This information helps to clarify the importance of auditor independence and the potential consequences of compromising this principle.

Procedures When Statutory Auditors Cannot Use Internal Auditors’ Work

When statutory auditors, after evaluating the internal audit function, decide they cannot utilize the work of internal auditors, several actions are necessary to ensure audit quality and compliance with professional standards. SA 610 (Revised) offers guidance on this:

1. Independent Performance of Audit Procedures

• External Auditor’s Responsibility: The statutory auditor’s sole responsibility for expressing an opinion on the financial statements. This responsibility is not reduced by using the work of internal auditors.
• No Substitution: Statutory auditors are not required to use the work of internal auditors. If the external auditor decides against using the internal audit function’s work, they will need to perform all necessary audit procedures independently.
• Nature, Timing, and Extent: The statutory auditor will determine the nature, timing, and extent of audit procedures based on their risk assessment and professional judgment, without considering any potential reliance on internal auditors’ work.

2. Communication with Those Charged with Governance

• Transparency: SA 610 (Revised) suggests that the external auditor communicates with those charged with governance (e.g., board of directors, audit committee) about their planned use of the internal audit function.
• Explaining the Decision: When the statutory auditor decides not to use the work of the internal audit function, they should communicate this decision to those charged with governance, explaining the rationale behind it. This transparency helps maintain a clear understanding between the auditor and those overseeing the financial reporting process.

3. Documentation

• Rationale for Non-Reliance: SA 610 (Revised) requires the external auditor to document their evaluation of the internal audit function. If the auditor decides not to use the work of internal auditors, they should document the reasons for their decision. This documentation might include:
  • Evaluation of the internal audit function’s objectivity, competence, and systematic and disciplined approach.
  • Identification of specific factors leading to the decision not to rely on internal auditors’ work (e.g., significant threats to objectivity, insufficient competence in a specific area).
  • Explanation of the alternative procedures performed by the external auditor to obtain sufficient appropriate audit evidence.

4. Consideration of Implications for Future Audits

• Ongoing Evaluation: The statutory auditor’s evaluation of the internal audit function is an ongoing process. Even if the auditor chooses not to use the internal audit function’s work in the current audit, they should reassess the situation for future audits.
• Potential Improvements: The statutory auditor may consider communicating their concerns about the internal audit function to management or those charged with governance to encourage improvements in the function’s objectivity, competence, or processes. This could enhance the potential for using the internal audit function’s work in subsequent audits.

Reasons for Not Using Internal Auditors’ Work

There may arise many situations where the statutory auditor would choose not to use the work of the internal audit function:

• Legal or Regulatory Prohibitions: External auditors may be legally restricted from using internal auditors’ work.
• Objectivity Concerns: If the external auditor finds significant threats to the objectivity of the internal audit function, they cannot rely on their work.
• Competence Issues: The external auditor must be confident in the competence of the internal audit function. If they assess the internal audit function as lacking sufficient competence, they will not use their work.
• Lack of a Systematic and Disciplined Approach: The external auditor needs assurance that the internal audit function operates systematically and with appropriate quality control. If this is lacking, they cannot rely on the internal auditors’ work.

Is there any legal obligation as to taking help from an internal auditor?

No Legal Obligation to Use Internal Auditors

The SA focuses on the professional standards and considerations for statutory auditors when deciding whether to use the work of internal auditors, including for direct assistance. They do not state any legal obligation to use internal auditors.

• It is the sole responsibility of the statutory auditor for the audit opinion.This responsibility is not diminished even when the external auditor utilizes the work of the internal audit function or receives direct assistance from internal auditors.
• SA 610 (Revised) provides guidance for external auditors when using the work of internal auditors. However, it emphasizes that it does not require the external auditor to use the work of the internal audit function. The decision to use internal auditors’ work, and to what extent, rests with the external auditor.

The decision to use internal auditors is a matter of professional judgment for the statutory auditor, taking into account the factors outlined in the relevant legal or regulatory constraints. 

Conclusion

SA 610 outlines the conditions and procedures for external auditors to effectively and appropriately utilize the work of internal auditors, emphasizing that the ultimate responsibility for the audit opinion always remains with the external auditor. The standard provides guidance on evaluating the internal audit function’s objectivity, competence, and systematic approach, which are crucial factors in determining the extent to which their work can be used. 

SA 610 distinguishes between using the internal audit function’s work as audit evidence and utilizing internal auditors for direct assistance under the external auditor’s supervision. It highlights the factors that may limit the external auditor’s reliance on internal audit work, such as high judgment requirements, limited objectivity, and lower competence. The standard also emphasizes the importance of coordination and communication between the internal and external auditors throughout the audit process. By adhering to the guidelines in SA 610, external auditors can leverage the work of internal auditors to enhance audit efficiency while maintaining the quality and independence of the audit.