Using the Work of Others

1 Introduction to internal audit

YouTube videoLoad YouTube video

The internal audit function is an appraisal and monitoring activity established by management and directors for the review of internal control as a service to the entity.

Remember that the directors are required under corporate governance codes to review the need for internal audit. Normally to achieve an element of independence from the executive directors, you would expect internal audit to report to the audit committee, which is responsible for monitoring and reviewing the effectiveness of internal audit.

The main function of the internal audit department is to examine, evaluate and report to management and directors on the adequacy and effectiveness of internal control processes.

2 Internal audit functions

Here is the list of the typical functions of an internal audit department. There is nothing perhaps terribly surprising here, read each of the bullet points and understand them.

• Helps achievement of corporate objectives (how could a company make profits if it doesn’t safeguard its assets or properly record transactions?)
  

• Aids risk assessment and management.
  

• Improves efficiency, effectiveness and economy.
  

• Designs internal control system.
  

• Checks operation of internal controls system.
  

• Value for money audits.
  

• Tests IT controls.
  

• Liaises with external auditors/shares work.
  

It is perhaps the last three which you need to be particularly aware of. There is something called a ‘value for money audit’. This isn’t so much looking at internal control but it is looking at efficiency and economy: could something be done more cheaply, more efficiently so that the company can make better profits? Or if the organisation is not-for-profit can it achieve more for the same amount of expenditure?

Testing information technology controls is also part of internal audit responsibilities.

And finally internal audit often plays a major part in liaising with external auditors and sharing work. Typically in very large organisations the external auditors do not visit every department or every branch, every factory or every outlet. Quite a lot of that audit work is carried out by the internal audit department and the external auditors will review the working papers and findings of internal audit. Generally the external auditors will move around to different departments and branches so that over a period of few years, external auditors have visited every part of the client.

3 Using the work of internal audit

The external auditor may decide to use the work of internal audit provided that internal audit:

• Is objective and supported by organisational status (e.g. has direct access to TCWG); and
  

• Is competent – not only in terms of professional qualifications and experience but whether it has adequate resources; and
  

• Applies a systematic and disciplined approach to planning, performing and documenting its activities, including quality control.
  

All three criteria must be met (i.e. a high level of objectivity cannot compensate for a lack of competence, or vice versa). If the auditor decides to use the work of internal audit, the auditor must evaluate whether the work of internal audit is adequate for audit purposes.

4 Using the work of experts

Using the work done by internal audit is one example of where auditors rely on the work of 3rd parties. Other examples include:

• Relying on experts such as estate agents, actuaries, lawyers.
  

• Relying on the work of other external auditors (e.g. if some companies in a group have different auditors). This is not examinable in AA.
  

There are two classes of expert (i.e. expertise in a field other than accounting or auditing):

• Management’s expert – assists management in preparing the financial statements.
  

• Auditor’s expert – assists the auditor in obtaining sufficient appropriate audit evidence. May be internal or external to the audit firm.
  

If the work of management’s expert is to be used as audit evidence (ISA 500), the auditor must evaluate:

• The expert’s competence, capabilities and objectivity
  

• The appropriateness of their work to the relevant assertion(s)
  

• Whether it is sufficiently reliable for audit purposes (i.e. accurate and complete and sufficiently precise and detailed).
  

An auditor’s expert (ISA 620) may be needed:

• To evaluate the work of management’s expert
  

• If management does not have necessary expertise/a management expert.
  

This should be determined at the planning stage of the audit. The auditor must evaluate the competence, capabilities and objectivity of the auditor’s expert (as for management’s expert).

The following matters must be agreed, in writing, with the auditor's expert:

• Nature, scope and objectives of work
  

• Respective responsibilities
  

• Nature, scope and timing of communications
  

• That the expert observes confidentiality
  

The auditor must evaluate the adequacy of the expert's work including:

• Consistency with other evidence. For example, if a property valuer reported a decrease in the value of a client’s property portfolio, yet the newspapers were full of news about a property boom, the auditor should challenge the valuer’s results.
  

• Assumptions made. For example about future increases in property rentals that might affect the valuation of an investment property.
  

• Use and accuracy of source data. To value property the valuer must start with an up-to-date list of the properties the company owns.