ISA 610 (Revised 2013)

Using the Work of Internal Auditors

1Objective and scope

ISA 610 (Revised 2013) deals with the external auditor's responsibilities if using the work of internal auditors, which includes using the work of the internal audit function in obtaining audit evidence and using internal auditors to provide direct assistance under the direction, supervision and review of the external auditor. It does not apply if the entity has no internal audit function; where it does, the external auditor's understanding of the function under ISA 315 comes first, and nothing in ISA 610 requires the external auditor to use internal audit's work at all. The external auditor has sole responsibility for the audit opinion, and that responsibility is not reduced by any use of internal auditors. Law or regulation may prohibit direct assistance; where it does, the second part of the standard does not apply.

The objectives, where the entity has an internal audit function and the external auditor expects to use its work or to use internal auditors for direct assistance, are to determine whether the work of the function or direct assistance can be used, and if so in which areas and to what extent; and having made that determination, to determine whether the work is adequate for the purposes of the audit, and to appropriately direct, supervise and review any direct assistance.

2Key definitions

3Requirements

Determining whether and how much internal audit work can be used

The external auditor determines whether the work of the internal audit function can be used by evaluating three things: the extent to which the function's organisational status and relevant policies and procedures support its objectivity (reporting to those charged with governance or the audit committee, freedom from conflicting responsibilities, unrestricted access, appointment and removal of the head of internal audit by the audit committee); the level of competence of the function (qualifications, training, technical knowledge, resources, whether membership of professional bodies is required); and whether the function applies a systematic and disciplined approach, including quality control. If the function lacks objectivity, or lacks competence, or does not apply a systematic and disciplined approach, its work is not used.

• Where the work can be used, determine the nature and extent of use, considering the nature and scope of the work performed or planned, its relevance to the audit strategy and plan, and the judgement involved in planning and performing the procedures and evaluating the evidence. The external auditor makes all significant judgements and does less use of internal audit's work the more judgement is involved, the higher the assessed risk of material misstatement, the less the function's objectivity is supported, and the lower its competence.
• The external auditor does not use internal audit's work for procedures that involve significant judgement, that relate to higher risks where the judgement in evaluating evidence is more than limited, that relate to work the function has already reported on to management or those charged with governance where the external auditor's own independence of view matters, or where the use would result in the external auditor being so involved with internal audit's work that the auditor's own involvement is insufficient (the external auditor must still perform enough of the work directly to support the opinion).
• Communicate the planned use of the function's work to those charged with governance as part of the planned scope and timing under ISA 260, and read the reports of the function relating to the work planned to be used.

Evaluating the work used

• Perform sufficient audit procedures on the body of work of the function as a whole that the auditor plans to use, to determine its adequacy: whether the work was properly planned, performed, supervised, reviewed and documented; whether sufficient appropriate evidence was obtained to enable reasonable conclusions; and whether the conclusions are appropriate in the circumstances and the reports are consistent with the results of the work.
• The procedures include reperformance of some of the work, and the nature and extent of the procedures respond to the judgement involved, the assessed risk, the objectivity of the function and its competence.
• Evaluate whether the conclusions on the function reached at the planning stage remain appropriate, and whether the planned nature, timing and extent of use need revising.

Direct assistance

• Where not prohibited by law or regulation, the external auditor evaluates the existence and significance of threats to the objectivity of the individual internal auditors (self-review, familiarity, undue influence from management), and their level of competence, before using them for direct assistance; an internal auditor who lacks competence or whose objectivity is threatened by significant unmitigated threats is not used.
• In determining the nature and extent of work that may be assigned, the auditor considers the amount of judgement involved, the assessed risk, the evaluation of objectivity and competence, and the requirement not to use direct assistance to the extent that the external auditor's own involvement becomes insufficient. Internal auditors are not used for procedures that involve significant judgement, relate to higher risks, relate to work they have themselves performed in the function, or relate to decisions the external auditor makes under ISA 610.
• Before using direct assistance, obtain written agreement from an authorised representative of the entity that the internal auditors will be allowed to follow the external auditor's instructions and that the entity will not intervene in their work, and written agreement from the internal auditors that they will keep confidential specific matters as instructed and inform the external auditor of any threat to their objectivity.
• Direct, supervise and review the work in accordance with ISA 220, recognising that the internal auditors are not independent of the entity; review is more detailed than for the firm's own staff, and includes checking back to the underlying evidence for some of the work performed.
• Communicate to those charged with governance the nature and extent of the planned use of direct assistance, so that they may consider whether it is acceptable.

4Documentation and reporting

If the external auditor uses the work of the internal audit function, the documentation includes the evaluation of the function's organisational status and objectivity, competence, and systematic and disciplined approach; the nature and extent of the work used and the basis for that decision; and the procedures performed by the external auditor to evaluate the adequacy of the work. If direct assistance is used, the documentation includes the evaluation of threats to objectivity and the competence of the individual internal auditors, the basis for the decision on the nature and extent of work assigned, who reviewed the work and the date and extent of review, the written agreements obtained, and the working papers prepared by the internal auditors. The auditor's report makes no reference to internal audit: the external auditor is solely responsible for the opinion, and the involvement of the internal audit function does not reduce that responsibility.

5Examinable focus