Click to enlarge image
The external auditor should have performed the assessment of the first two factors when determining whether the internal auditors can provide direct assistance in the first instance. The less persuasive the evidence regarding the internal auditors’ objectivity and competency, the more restrictive the nature and extent of work that can be assigned.
As a starting point the external auditor should consider the amount of judgment needed in (i) planning and performing relevant audit procedures and (ii) evaluating audit evidence gathered. The greater the level of judgment required, the narrower the scope of work that can be assigned to internal auditors. The following activities are deemed to involve significant judgment and therefore are not expected to be assigned to internal auditors providing direct assistance:
- Assessing risks of material misstatements
- Evaluating the sufficiency of tests performed
- Evaluating significant accounting estimates, and
- Evaluating the adequacy of disclosures in the financial statements and other matters affecting the auditor’s report.
For any particular account balance, class of transaction or disclosure, the external auditor has to take into consideration the assessed risk of material misstatement when determining the nature and extent of work that they propose to assign to internal auditors. The higher the assessed risk, the more restricted the nature and extent of work that should be assigned to internal auditors. If the risk of material misstatement is considered to be anything other than low, the more judgment that has to be involved and the more persuasive the audit evidence required. Therefore, in these circumstances, in order to reduce audit risk to an acceptably low level it is expected that the external auditor has to perform more procedures directly and place less reliance on assistance provided by internal auditors when collecting sufficient appropriate evidence. The ISA provides some specific examples of areas where reliance should be restricted.
ISA 610 (Revised 2013) states that internal auditors cannot carry out procedures when providing direct assistance that:
- Involve making significant judgment in the audit
- Relate to higher assessed risks of material misstatements where the judgment required in performing the relevant audit procedures or evaluating the audit evidence gathering is more than limited
- Relate to decisions the external auditor makes in accordance with ISA 610 (Revised 2013) regarding the internal audit function and the use of its work or direct assistance
- Relate to work with which the internal auditors have been involved and which has already been or will be reported to management (or those charged with governance) by the internal audit function. This restriction intends to minimise self-review threats.
ISA 610 (Revised 2013) also states that the following should not be assigned to or involve internal auditors providing direct assistance:
(i) discussion of fraud risks
(ii) determination of unannounced (or unpredictable) audit procedures as addressed in ISA 240, The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements, and
(iii) maintaining control over external confirmation requests and evaluation of results of external confirmation procedures.
Responsibilities of the external auditor using internal auditors to provide direct assistance
The external auditor should note the following responsibilities at different stages of the audit when using internal auditors to provide direct assistance:
(1) After determining the use of internal auditors to provide direct assistance
The external auditor has to:
- Communicate the nature and extent of the planned use of internal auditors with those charged with governance (in accordance with ISA 260, Communication with Those Charged with Governance) so as to reach a mutual understanding that such use is not excessive in the circumstances of the engagement. This communication not only dispels any perception that the external auditor’s independence might be compromised by the use of direct assistance but also facilitates appropriate dialogue with those charged with governance.
- Evaluate whether the external auditor is still sufficiently involved in the audit.
(2) Prior to the use of internal auditors to provide direct assistance
The external auditor has to obtain written agreement from two parties:
- From an authorised representative of the entity stating that: (i) the internal auditors will be allowed to follow the external auditor’s instructions, and (ii) the entity will not intervene in the work the internal auditor performs for the external auditors.
- From internal auditors stating that they will: (i) keep confidential specific matters as instructed by the external auditor and (ii) inform the external auditor of any threat to their objectivity.
(3) During the audit
The external auditor has to:
- Direct, supervise and review the work performed by internal auditors on the engagement, bearing in mind that the internal auditors are not independent of the entity. It is therefore expected that such supervision and review will be of a different nature and more extensive than if members of the audit engagement team perform the work.
- Remind the internal auditors to bring accounting and auditing issues identified during the audit to the attention of the external auditors.
- Check back to the underlying audit evidence for some of the work performed by the internal auditors.
- Make sure the internal auditors have obtained sufficient appropriate audit evidence to support the conclusions based on that work.
(4) Documenting the audit evidence
The documentation requirements evidencing the application of the important safeguards in ISA 610 (Revised 2013) have been expanded when the external auditor uses the internal auditors to provide direct assistance. The external auditor should document the following in the working papers:
- Evaluation of the existence and significance of the threats to the objectivity of the internal auditors and the level of competence of the internal auditors used to provide direct assistance
- The basis for the decision regarding the nature and extent of the work performed by the internal auditors
- Who reviewed the work performed and the date and extent of that review in accordance with ISA 230, Audit Documentation
- The written agreements obtained from an authorised representative of the entity and the internal auditors
- The working papers prepared by the internal auditors providing direct assistance on the audit engagement.
The external auditor has to exercise professional judgment when determining whether the internal auditors, subject to law and regulation, can be used to provide direct assistance in the financial statement audit of an entity. Candidates are expected to understand (i) how the external auditor makes such evaluations and (ii) for which processes or tasks the internal auditors can provide direct assistance to the external auditor. The most important principle is, in any circumstances, the external auditor should be sufficiently involved in the audit as the external auditor has the sole responsibility for the audit opinion expressed.
Eric YW Leung, CUHK Business School, The Chinese University of Hong Kong, FCCA
ISA 610 (Revised 2013), Using the Work of Internal Auditors, together with its Basis for Conclusions