Internal Audit
1 Introduction
The previous chapter introduced the work of others and experts in particular. This chapter considers ISA 610 Using the Work of Internal Auditors.
2 The internal audit function
Corporate governance (at least in the UK) does not insist that companies have an internal audit department, but they must keep the need for internal audit under review. More and more companies now have internal audit departments. These departments carry out work such as:
Assessment of the design and operation of the system of internal control.
Helping with inventory and cash counts.
Verifying the physical existence of non-current assets.
Assessing value for money of various activities.
Carrying out special investigations, such as investigating a fraud.
Assessing the security and operation of the IT system.
Internal auditors can be company employees but the function can also be outsourced.
Obviously the internal auditors’ work can be of assistance to external auditors, particularly in their assessment of the system of internal control, attending inventory counts and verifying the existence and condition of assets. Internal auditors will often examine these matters in much more detail, and perhaps with more insight, than the external auditors.
However, it is important to note that ISA 610 states that internal audit can be involved in substantive procedures only in areas where only limited judgement is required. All areas involving significant judgement or estimates must be handled by the external auditors.
3 Making use of internal audit work
As was mentioned earlier, external auditors are solely responsible for the audit opinion and that responsibility is not reduced by using the work of internal audit. To use the work of internal auditor the external must consider:
1. Can the work of internal audit be used?
2. If so, to what extent?.
If seeking to rely on the work of internal audit, the external auditor must:
Assess the organisational status of the internal audit department. Are the internal auditors objective? To whom do they report? (Should normally be the audit committee but they should also have access to senior directors). The size of the internal audit department can be relevant. A single internal auditor in a company can have a lonely existence, unsupported by colleagues. However, a team of 10 internal auditors can provide mutual strength. (Note that if the internal audit function is outsourced, it might be more independent and objective than when the internal auditors are employees.)
Assess the competence of the internal audit department: are the employees members of a professionals body? Are they qualified? Do they undergo regular training and updates? Do they have time and resources to carry out their work adequately?
Assess if the internal auditors carry out their work in a disciplined and systematic way. Are there quality controls? Is there standard documentation? Is the work planned and reviewed?
If any of these three qualities are absent (objectivity, competence and a systematic and disciplined approach), the work of internal audit must NOT be used.
If all three qualities are present, the external auditor may plan to use their work and co-ordinate their respective activities. The external auditor should assess if:
The internal audit work was properly planned, executed, supervised, reviewed and documented.
Sufficient appropriate evidence had been obtained to enable the internal auditors to draw reasonable conclusions.
The conclusions reached are appropriate and the reports produced are consistent with the results of the work performed.
The assessment will involve the external auditor reviewing the working papers of the internal audit function and making inquiries of appropriate individuals. It must also include some reperformance of their work.
4 Direct assistance
Some jurisdictions (not the UK or Ireland) allow the internal auditors to provide direct assistance to the external auditors. This means that the internal auditors perform audit procedures under the direction, supervision and review of the external auditor.
If internal auditors are to provide direct assistance, the external auditor must assess the existence of significant threats to objectivity ie can the internal auditors be regarded as independent? The external auditors must also assess and the level of competence of internal auditors.
Even if direct assistance is not prohibited, internal audit cannot perform procedures that:
involve significant judgments
relate to higher assessed risks
relate to internal audit's own work.