Using the work of internal auditors by external auditors
Internal
audit function
Internal audit function is a function of an
entity that performs assurance and consulting activities designed to evaluate
and improve the effectiveness of the entity’s governance, risk management and
internal control processes.
Typically, internal audit function performs the following activities:
(a) Activities relating to entity’s governance processes (assessing the governance process in its achievement of objectives on ethics and values, performance management and accountability).
(b) Activities relating to risk management (assisting the entity by identifying and evaluating significant exposures to risk and in the detection of fraud).
(c) Activities relating to internal control (evaluation of internal control, examination of financial and operating information, review of operating activities, review of compliance with laws and regulations).
Using an entity’s internal audit
function by external auditors in the audit process
Despite the objectives of an entity’s internal audit function and the external auditor differ, the function may perform audit procedures similar to those performed by the external auditor in an audit of financial statements. If so, the external auditor may make use of the function for purposes of the audit in one or more of the following ways:
(a) To obtain information that is relevant to the external auditor’s assessments of the risks of material misstatement due to error or fraud (under the condition of obtaining an understanding of the nature of the internal audit function’s responsibilities, its status within the organization, and the activities performed).
(b) Unless prohibited by law or regulation, to use work that has been performed by the internal audit function during the period in partial substitution for audit evidence to be obtained directly by the external auditor.
(c) To use internal auditors to perform audit procedures under the direction, supervision and review of the external auditor.
Using
the work of the internal audit function
It is
not required for the external auditor to use the work of the internal audit
function to modify the nature or timing, or reduce the extent, of audit
procedures to be performed directly by the external auditor. It is the external
auditor who decides whether to use the work of internal audit function in
establishing the overall audit strategy. The external auditor can use the work
of internal auditors if the external auditor evaluates the internal audit
function and considers the nature and scope of the work that has been performed
by internal auditors.
Evaluating the internal audit function
The external auditor shall evaluate the following matters relating to internal audit function:
(a) The extent to which the internal audit function’s organizational status and relevant policies and procedures.
(b) The level of competence of the internal audit function; and
(c) Whether the internal audit function applies a systematic and disciplined approach, including quality control.
Determining the nature and extent of work of
the internal audit function that can be used.
The external auditor shall consider the nature and scope of the work that has been performed, or is planned to be performed, by the internal audit function and its relevance to the external auditor’s overall audit strategy and audit plan. If the external auditor plans to use the work of the internal audit function, the external auditor shall:
· discuss the planned use of its work with the function.
· read the reports of the internal audit function relating to the work of the function that the external auditor plans to use.
· perform sufficient audit procedures on the body of work of the internal audit function as a whole that the external auditor plans to use to determine whether the work of the function had been properly planned, performed, supervised, sufficient appropriate evidence had been obtained and conclusions reached are appropriate in the circumstances.
Examples of work of the internal
audit function that can be used by the external auditor
· Testing of the operating effectiveness of controls.
· Substantive procedures involving limited judgment.
· Observations of inventory counts.
· Tracing transactions through the information system relevant to financial reporting.
· Testing compliance with regulatory requirements.
· In some circumstances, audits, or reviews of the financial information of subsidiaries that are not significant components to the group.
However, the external auditor’s determination
of the planned nature and extent of use of the work of the internal audit
function will be influenced by the external auditor’s evaluation of the extent
to which the internal audit function’s organizational status and relevant
policies and procedures adequately support the objectivity of the internal
auditors and the level of competence of the internal audit function.
If the internal audit function reports to
management, this would be considered a significant threat to the function’s
objectivity unless other factors provide sufficient safeguards to reduce the
threat to an acceptable level.
Also, a self-review threat is
created when the external auditor accepts an engagement to provide internal
audit services to an audit client, and the results of those services will be
used in conducting the audit. In this situation some safeguards should be taken
to reduce the threats to an acceptable level.
Procedures to determine the adequacy of the work
of the internal audit function
The external auditor’s audit procedures on the
body of work of the internal audit function as a whole that the external
auditor plans to use provide a basis for evaluating the overall quality of the
function’s work and the objectivity with which it has been performed.
The procedures the external auditor may perform to evaluate the quality of the work performed and the conclusions reached by the internal audit function include the following:
· Reperformance.
Reperformance involves the external auditor’s independent execution of procedures to validate the conclusions reached by the internal audit function. The external auditor is more likely to focus reperformance in those areas where more judgment was exercised by the internal audit function in planning, performing and evaluating the results of the audit procedures and in areas of higher risk of material misstatement.
· Making inquiries of appropriate individuals within the internal audit function.
· Observing procedures performed by the internal audit function.
· Reviewing the internal audit function’s work program and working papers.
An external auditor can use either the
work of the internal audit function or direct assistance from
internal auditors for the purpose of the audit. However, the external
auditor may be prohibited by law or regulation from obtaining direct assistance
from internal auditors. If the using of internal auditor’s direct assistant is
not prohibited by law or regulation, and the external auditor plans to use
internal auditors to provide direct assistance on the audit, the external
auditor shall evaluate the existence and significance of threats to
objectivity and the level of competence of the internal auditors who
will be providing such assistance.
The external auditor shall not use internal auditors to provide direct assistance to perform procedures that:
(a) Involve making significant judgments in the audit.
(b) Relate to higher assessed risks of material
misstatement where the judgment required in performing the relevant audit
procedures or evaluating the audit evidence gathered is more than limited.
c) Relate to work with which the internal
auditors have been involved and which has already been, or will be, reported to
management or those charged with governance by the internal audit function; or
(d) Relate to decisions the external auditor
makes in accordance with this ISA regarding the internal audit function and the
use of its work or direct assistance.
Prior to using internal auditors to provide direct assistance for purposes of the audit, the external auditor shall:
· Obtain written agreement from an authorized representative of the entity that the internal auditors will be allowed to follow the external auditor’s instructions.
· Obtain written agreement from the internal auditors that they will keep confidential specific matters as instructed by the external auditor and inform the external auditor of any threat to their objectivity.
The external auditor should direct, supervise and review the work performed by internal auditors on the engagement.
External audit documentation related
to the use of the work of internal auditors
If the external auditor plans to use an entity’s internal audit function in the audit process the external auditor shall include in the audit documentation following matters:
(a) The evaluation of objectivity and the level of competence of internal audit function.
(b) If the work of the internal audit function to be used:
·
The
nature and extent of the work used and the basis for that decision; and
·
The
audit procedures performed by the external auditor to evaluate the adequacy of
the work used.
If the direct assistance of
internal auditors to be used:
·
The
basis for the decision regarding the nature and extent of the work performed by
the internal auditors.
·
Who
reviewed the work performed and the date of that review.
·
The
written agreements obtained from an authorized representative of the entity and
the internal auditors.
·
The
working papers prepared by the internal auditors who provided direct assistance
on the audit engagement.
Comments
Post a Comment