Pipara & Co LLP

Using the Work of Internal Auditors

Introduction

Scope of this SA
  1. This Standard on Auditing (SA) deals with the external auditor’s responsibilities if using the work of internal auditors. This includes (a) using the work of the internal audit function in obtaining audit evidence and (b) using internal auditors to provide direct assistance under the direction, supervision and review of the external auditor.
  2. This SA does not apply if the entity does not have an internal audit function. (Ref: Para. A2)
  3. If the entity has an internal audit function, the requirements in this SA relating to using the work of that function do not apply if:
  1. The responsibilities and activities of the function are not relevant to the audit; or
  2. Based on the auditor’s preliminary understanding of the function obtained as a result of procedures performed under SA 315,1 the external auditor does not expect to use the work of the function in obtaining audit evidence.

Nothing in this SA requires the external auditor to use the work of the internal audit function to modify the nature or timing, or reduce the extent, of audit procedures to be performed directly by the external auditor; it remains a decision of the external auditor in establishing the overall audit strategy.

  1. Furthermore, the requirements in this SA relating to direct assistance do not apply if the external auditor does not plan to use internal auditors to provide direct assistance.
  2. In some cases, the external auditor may be prohibited, or restricted to some extent, by law or regulation from using the work of the internal audit function or using internal auditors to provide direct assistance. The SAs do not override laws or regulations that govern an audit of financial statements.2 Such prohibitions or restrictions will therefore not prevent the external auditor from complying with the SAs. (Ref: Para. A31)

1 SA 315, Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment.

2 SA 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with Standards on Auditing, paragraph A56.

Relationship between SA 315 and SA 610 (Revised)
  1. Many entities establish internal audit functions as part of their internal control and governance structures. The objectives and scope of an internal audit function, the nature of its responsibilities and its organizational status, including the function’s authority and accountability, vary widely and depend on the size and structure of the entity and the requirements of management and, where applicable, those charged with governance.
  2. SA 315 addresses how the knowledge and experience of the internal audit function can inform the external auditor’s understanding of the entity and its environment and identification and assessment of risks of material misstatement. SA 3153 also explains how effective communication between the internal and external auditors also creates an environment in which the external auditor can be informed of significant matters that may affect the external auditor’s work.
  3. Depending on whether the internal audit function’s organizational status and relevant policies and procedures adequately support the objectivity of the internal auditors, the level of competency of the internal audit function, and whether the function applies a systematic and disciplined approach, the external auditor may also be able to use the work of the internal audit function in a constructive and complementary manner. This SA addresses the external auditor’s responsibilities when, based on the external auditor’s preliminary understanding of the internal audit function obtained as a result of procedures performed under SA 315, the external auditor expects to use the work of the internal audit function as part of the audit evidence obtained.4 Such use of that work modifies the nature or timing, or reduces the extent, of audit procedures to be performed directly by the external auditor.
  4. In addition, this SA also addresses the external auditor’s responsibilities if considering using internal auditors to provide direct assistance under the direction, supervision and review of the external auditor.
  5. There may be individuals in an entity that perform procedures similar to those performed by an internal audit function. However, unless performed by an objective and competent function that applies a systematic and disciplined approach, including quality control, such procedures would be considered internal controls and obtaining evidence regarding the effectiveness of such controls would be part of the auditor’s responses to assessed risks in accordance with SA 330.5

3 SA 315, Paragraph A115.

4 See paragraphs 15–25.

5 SA 330,The Auditor’s Responses to Assessed Risks.

The External Auditor’s Responsibility for the Audit

The external auditor has sole responsibility for the audit opinion expressed, and that responsibility is not reduced by the external auditor’s use of the work of the internal audit function or internal auditors to provide direct assistance on the engagement. Although they may perform audit procedures similar to those performed by the external auditor, neither the internal audit function nor the internal auditors are independent of the entity as is required of the external auditor in an audit of financial statements in accordance with SA 200.6 This SA, therefore, defines the conditions that are necessary for the external auditor to be able to use the work of internal auditors. It also defines the necessary work effort to obtain sufficient appropriate evidence that the work of the internal audit function, or internal auditors providing direct assistance, is adequate for the purposes of the audit. The requirements are designed to provide a framework for the external auditor’s judgments regarding the use of the work of internal auditors to prevent over or undue use of such work.

Effective Date

This SA is effective for audits of financial statements for periods beginning on or after 1st April, 2016.

Objectives
  1. The objectives of the external auditor, where the entity has an internal audit function and the external auditor expects to use the work of the function to modify the nature or timing, or reduce the extent, of audit procedures to be performed directly by the external auditor, or to use internal auditors to provide direct assistance, are:
  1. To determine whether the work of the internal audit function or direct assistance from internal auditors can be used, and if so, in which areas and to what extent;

and having made that determination:

  1. If using the work of the internal audit function, to determine whether that work is adequate for purposes of the audit; and
  2. If using internal auditors to provide direct assistance, to appropriately direct, supervise and review their work.
Definitions
  1. For purposes of the SAs, the following terms have the meanings attributed below:

6 SA 200, paragraph 14.

  1. Internal audit function – A function of an entity that performs assurance and consulting activities designed to evaluate and improve the effectiveness of the entity’s governance, risk management and internal control processes. (Ref: Para. A1–A4)

Direct assistance – The use of internal auditors to perform audit procedures under the direction, supervision and review of the external auditor.

Requirements
Determining Whether, in Which Areas, and to What Extent the Work of the Internal Audit Function Can Be Used
Evaluating the Internal Audit Function
  1. The external auditor shall determine whether the work of the internal audit function can be used for purposes of the audit by evaluating the following:
  1. The extent to which the internal audit function’s organizational status and relevant policies and procedures support the objectivity of the internal auditors; (Ref: Para. A5–A9)
  2. The level of competence of the internal audit function; and (Ref: Para. A5– A9)
  3. Whether the internal audit function applies a systematic and disciplined approach, including quality control. (Ref: Para. A10–A11)
  1. The external auditor shall not use the work of the internal audit function if the external auditor determines that:
  1. The function’s organizational status and relevant policies and procedures do not adequately support the objectivity of internal auditors;
  2. The function lacks sufficient competence; or
  3. The function does not apply a systematic and disciplined approach, including quality control. (Ref: Para. A12–A14)
Determining the Nature and Extent of Work of the Internal Audit Function that Can Be Used
  1. As a basis for determining the areas and the extent to which the work of the internal audit function can be used, the external auditor shall consider the nature and scope of the work that has been performed, or is planned to be performed, by the internal audit function and its relevance to the external auditor’s overall audit strategy and audit plan. (Ref: Para. A15–A17)
  2. The external auditor shall make all significant judgments in the auditengagement and, to prevent undue use of the work of the internal audit function, shall plan to use less of the work of the function and perform more of the work directly: (Ref: Para. A15–A17)
  1. The more judgment is involved in:
    1. Planning and performing relevant audit procedures; and
    2. Evaluating the audit evidence gathered; (Ref: Para. A18–A19)
  2. The higher the assessed risk of material misstatement at the assertion level, with special consideration given to risks identified as significant; (Ref: Para. A20–A22)
  3. The less the internal audit function’s organizational status and relevant policies and procedures adequately support the objectivity of the internal auditors; and
  4. The lower the level of competence of the internal audit function.
  1. The external auditor shall also evaluate whether, in aggregate, using the work of the internal audit function to the extent planned would still result in the external auditor being sufficiently involved in the audit, given the external auditor’s sole responsibility for the audit opinion expressed. (Ref: Para. A15– A22)

The external auditor shall, in communicating with those charged with governance an overview of the planned scope and timing of the audit in accordance with SA 260(Revised),7 communicate how the external auditor has planned to use the work of the internal audit function. (Ref: Para. A23)

Read More
Please select any one region