Using the work of others

1 Introduction to internal audit

The internal audit function is an appraisal and monitoring activity established by management and directors for the review of internal control as a service to the entity.

Remember that the directors are required under corporate governance codes to review the need for internal audit. Normally to achieve an element of independence from the executive directors, you would expect internal audit to report to the audit committee, which is responsible for monitoring and reviewing the effectiveness of internal audit.

The main function of internal audit is to examine, evaluate and report to management and those charged with governance on the adequacy and effectiveness of internal control. It may advise on improvements, but management is responsible for designing and operating controls. Internal audit must remain objective when assessing areas on which it has advised.

2 Internal audit functions

Here is the list of the typical functions of an internal audit department:

• Helps achievement of corporate objectives (how could a company make profits if it doesn’t safeguard its assets or properly record transactions?)
  

• Aids risk assessment and management.
  

• Improves efficiency, effectiveness and economy.
  

• Advises management on improvements to internal control without taking management responsibility.
  

• Checks the operation of the internal control system.
  

• Value for money audits.
  

• Tests IT controls.
  

• Liaises with external auditors/shares work.
  

And finally internal audit often plays a major part in liaising with external auditors and sharing work. Typically in very large organisations the external auditors do not visit every department or every branch, every factory or every outlet. Quite a lot of that audit work is carried out by the internal audit department and the external auditors will review the working papers and findings of internal audit. Generally the external auditors will move around to different departments and branches so that over a period of a few years, external auditors have visited every part of the client.

3 Using the work of internal audit

The external auditor may decide to use the work of internal audit provided that internal audit:

• Is objective and supported by organisational status (eg has direct access to those charged with governance); and
  

• Is competent – not only in terms of professional qualifications and experience but whether it has adequate resources; and
  

• Applies a systematic and disciplined approach to planning, performing and documenting its activities, including quality control.
  

All three criteria must be met (ie a high level of objectivity cannot compensate for a lack of competence, or vice versa). If the auditor decides to use the work of internal audit, the auditor must evaluate whether the work of internal audit is adequate for audit purposes.

For the specific work to be used, check that it was properly planned, performed, supervised, reviewed and documented. The evidence must be sufficient and appropriate, and the conclusions consistent with that evidence and the report. Discuss the planned use with internal audit, read its reports and perform procedures on the work, including some reperformance. The external auditor alone remains responsible for the audit opinion.

4 Using the work of experts

Using the work done by internal audit is one example of where auditors rely on the work of 3rd parties. Other examples include:

• Relying on experts such as estate agents, actuaries, lawyers.
  

• Relying on the work of other external auditors (e.g. if some companies in a group have different auditors). This is not examinable in FAU.
  

There are two classes of expert (ie expertise in a field other than accounting or auditing):

• Management’s expert – assists management in preparing the financial statements.
  

• Auditor’s expert – assists the auditor in obtaining sufficient appropriate audit evidence. May be internal or external to the audit firm.
  

If the work of management’s expert is to be used as audit evidence (ISA 500), the auditor must evaluate:

• The expert’s competence, capabilities and objectivity
  

• The appropriateness of their work to the relevant assertion(s)
  

• Whether it is sufficiently reliable for audit purposes (i.e. accurate and complete and sufficiently precise and detailed).
  

An auditor’s expert (ISA 620) may be needed:

• To evaluate the work of management’s expert
  

• If management does not have necessary expertise/a management expert.
  

This should be determined at the planning stage of the audit. The auditor must evaluate the competence, capabilities and objectivity of the auditor’s expert (as for management’s expert).

The following matters must be agreed, in writing, with the auditor's expert:

• Nature, scope and objectives of work
  

• Respective responsibilities
  

• Nature, scope and timing of communications
  

• That the expert observes confidentiality
  

The auditor must evaluate the adequacy of the expert's work including:

• Consistency with other evidence. For example, if a property valuer reported a decrease in the value of a client’s property portfolio, yet the newspapers were full of news about a property boom, the auditor should challenge the valuer’s results.
  

• Assumptions made. For example about the rate of returns that might be earned on pension funds.
  

• Use and accuracy of source data. To value property the valuer must start with an up-to-date list of the properties the company owns.