Many mid-sized private companies, credit unions, nonprofits and healthcare entities have an internal audit function. It may be a department of several people or one person who reports to the audit committee. External auditors often want to use that work to reduce their own effort. US GAAS allows it, within limits set by AU-C 610, Using the Work of Internal Auditors.
The section covers two different things: using the work of the internal audit function in the external audit, and using internal auditors to provide direct assistance under the external auditor's supervision. This guide explains both and the evaluation you perform.
Start with the principle
The external auditor has sole responsibility for the audit opinion. Using internal audit does not change that, and the report does not refer to it. The section also makes clear that the external auditor decides, based on professional judgment, whether to use the work at all and how far. Internal audit's work can support your procedures, but it never replaces your risk assessment under AU-C 315 or your judgments on significant risks.
AU-C 610 applies when the entity has an internal audit function and the external auditor expects to use its work or to use internal auditors for direct assistance. If the entity has no such function, or you decide not to use it, the section does not add requirements. Even then, the work of internal audit may be relevant as part of your understanding of the entity and its internal control.
What counts as an internal audit function
Internal audit is a function of an entity that performs assurance and consulting activities designed to evaluate and improve the effectiveness of the entity's governance, risk management and internal control processes. Look at what it actually does, not what the entity calls it. A compliance team, a finance operations review group or a part-time consultant who performs recurring control testing may meet the definition. A person who performs only accounting tasks, or a function that reports solely to the controller and performs management's monitoring, may not.
Using the work of the internal audit function
Step 1: determine whether the work can be used
The auditor first determines whether the work of the function is likely to be adequate for audit purposes. That requires evaluating three things:
- Objectivity. The organizational status of the function, including to whom it reports, and the policies that protect its objectivity. A function reporting to those charged with governance, such as an audit committee, with no operating responsibilities, provides stronger support than one reporting to the CFO and routinely performing accounting tasks.
- Competence. Whether the function has adequate resources, whether staff have appropriate qualifications and training, and whether it is subject to professional standards.
- A systematic and disciplined approach. Whether it plans, supervises, reviews and documents its work, with quality control procedures.
If the evaluation shows objectivity or competence is lacking, or the approach is not disciplined, the auditor does not use the work.
Step 2: determine the planned effect
If work can be used, determine how it will affect the nature, timing or extent of your procedures. Consider:
- the nature and scope of the work performed and its relevance to your risk assessment
- the assessed risks of material misstatement for the relevant assertions, and the degree of judgment in them
- the amount of judgment involved in planning, performing and evaluating the work and in reaching conclusions
The external auditor makes all significant judgments in the audit. To avoid undue use of internal audit's work, plan to use less of it and perform more yourself as the judgment involved rises, as the assessed risk of material misstatement rises (with special attention to significant risks), and as the support for the function's objectivity or competence weakens. You also evaluate whether the planned use, in aggregate, still leaves you sufficiently involved in the audit. In practice, internal audit work is most useful for lower-risk areas and for routine procedures: inventory counts at multiple locations, confirmations of bank balances, testing of controls at remote sites, or reconciliations.
Step 3: discuss and coordinate
Read the internal audit plan, hold regular meetings and agree on timing. Ask that the function provide its reports, results and any significant findings. The external auditor should also tell internal audit about any matters that may affect its work, within the bounds of confidentiality.
Step 4: evaluate the specific work
For the work you plan to use, evaluate whether:
- the work was properly planned, performed, supervised, reviewed and documented
- sufficient appropriate evidence was obtained to support the conclusions
- the conclusions are appropriate and the reports consistent with the results
- unusual matters or exceptions were appropriately resolved
Perform your own procedures on a sample of the function's work. For example, re-perform a selection of its control tests, or re-count a subset of its inventory counts. Document the extent of your re-performance and the results, and let the risk drive the sample.
Direct assistance
Direct assistance is the use of internal auditors to perform audit procedures under the external auditor's direction, supervision and review. Examples include helping with inventory observation, assisting with confirmations, or performing tests of details at a location.
AU-C 610 sets conditions before you can use it. They include the following:
- the auditor evaluates the existence and significance of threats to the internal auditors' objectivity and their competence. If safeguards cannot reduce the threats to an acceptable level, or competence is insufficient, direct assistance is not used.
- law or regulation must not prohibit the use. Check this particularly where regulators impose specific limits on assistance in the entity's industry.
- the entity must agree in writing that the internal auditors can follow the external auditor's instructions and that the entity will not intervene in the work they perform. The internal auditors must agree in writing to keep confidential the specific matters the external auditor instructs, and to tell the external auditor about any threat to their objectivity.
- internal auditors must not perform procedures that involve making significant judgments in the audit, or those involving a higher assessed risk of material misstatement where the judgment required is more than limited.
AU-C 610 also bars direct assistance on procedures that relate to work internal audit has already been or will be involved in and reports to management or those charged with governance, and on decisions the external auditor makes about the internal audit function. Keep direct assistance to tasks with limited judgment, and take the planned use into account when you communicate the audit's scope and timing to those charged with governance. The external auditor must direct, supervise and review the work, recognizing that internal auditors are not independent of the entity, and the review includes checking back to the underlying evidence for some of the work.
Independence and other limits
Direct assistants remain employees of the client and are not independent of it, so the direction, supervision and review must reflect that. They cannot take on responsibility for audit judgments. Document who assigned the tasks, the instructions given, the review performed, and any matters raised by the internal auditors.
For SOX 404 style integrated work, or for audits of public companies, other standards apply. This guide covers nonissuer audits only.
Internal audit and the audit of internal control
When the entity has an internal audit function, its documentation of controls and testing often saves time for the control understanding you need under SAS 145. Rely on it as evidence about design and implementation only after you evaluate it. For operating effectiveness, the same evaluation is needed, and your own testing of a sample remains necessary. See substantive testing vs test of controls for how control reliance interacts with substantive procedures. Where you plan to test controls with a sample, the audit sample size calculator can help set the size.
Documentation
Under AU-C 230, include:
- your evaluation of objectivity, competence and approach, with the evidence considered
- the planned effect on the audit and the reasoning
- discussions and coordination with internal audit
- the work used and your procedures on it, including re-performance and conclusions
- for direct assistance: the agreements, instructions, assignments, and your review
Cross-reference the internal audit workpapers you used so a reviewer can trace them.
Common issues
- Relying on a function that reports to the CFO. Objectivity concerns arise and are never addressed.
- No re-performance. Internal audit's conclusion is accepted without testing any of its work.
- Using work on significant risks. The reliance exceeds what the risk level supports.
- Verbal agreements for direct assistance. No written agreement with the entity and the internal auditors.
- Poor timing. Internal audit completes its work after the external auditor needs it, so it cannot be used.
- Outsourced function treated as an external specialist. A co-sourced internal audit function is still internal audit for this purpose, and the evaluation applies.
FAQ
Do I have to use the work of internal audit?
No. The section applies if you decide to use the work or direct assistance. Whether to use it, and how much, is a judgment, and you can choose to perform all procedures yourself.
Can internal audit's work reduce my procedures on significant risks?
Only to a limited extent. The more judgment involved and the higher the assessed risk, the less the work can be used. For significant risks, you should expect to perform the procedures yourself or retain direct control over the work.
What is the difference between using internal audit's work and direct assistance?
Using the work means you evaluate what internal audit already did and use it as evidence. Direct assistance means internal auditors perform procedures under your direction, supervision and review as part of your audit.
Do I mention internal audit in the audit report?
No. The auditor has sole responsibility for the opinion, and use of internal audit does not reduce it, so the report does not refer to the work.
Does a part-time or outsourced internal audit function qualify?
It can. Evaluate it on the same factors: objectivity, competence and a systematic and disciplined approach. An outsourced provider that also does accounting work for the entity raises objectivity concerns.
Sources
- AICPA, AU-C Section 610, Using the Work of Internal Auditors (SAS No. 128, as amended)
- AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (SAS No. 145)
- AICPA, AU-C Section 230, Audit Documentation
- AICPA, AU-C Section 260, The Auditor's Communication With Those Charged With Governance
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error