Internal audit and the external auditor: using the work of others

In this lesson you will

Explain how AS 2201.16 to .19 let the auditor use the work of others
Apply the AS 2605 competence and objectivity factors to an internal audit function
Identify the judgments that must remain with the external auditor
Plan coordination under Standard 9.5 so reliance is achievable

The rules on the auditor’s side

AS 2201.16 requires the auditor to evaluate the extent to which it will use the work of others to reduce its own work, and says AS 2605 applies in an integrated audit. AS 2201.17 allows the auditor, for the ICFR audit, to use work performed by, or receive direct assistance from, internal auditors, other company personnel and third parties working under the direction of management or the audit committee.

AS 2201.18 requires the auditor to assess the competence and objectivity of the people whose work it plans to use. The higher the competence and objectivity, the greater the use. For internal auditors the auditor applies AS 2605.09 to .11; for others it applies the same principles.

AS 2201.19 adds risk: as the risk associated with a control increases, the need for the auditor to perform its own work on that control increases.

Competence factors (AS 2605.09)

The auditor obtains or updates information on:

educational level and professional experience;
professional certification and continuing education;
audit policies, programs and procedures;
practices for assigning internal auditors;
supervision and review of their work;
quality of working papers, reports and recommendations;
evaluation of internal auditors’ performance.

Objectivity factors (AS 2605.10)

The auditor considers organizational status: whether the head of internal audit reports to an officer of sufficient status, has direct access and reports regularly to the board or audit committee, and whether the board oversees employment decisions for that role. It also considers policies that keep internal auditors from auditing areas where relatives work or where they were recently assigned or are scheduled to be assigned.

These line up with the Global Internal Audit Standards. Standard 7.1 (organizational independence and the annual confirmation to the board) and Standard 2.2 (the 12-month presumption) give the auditor documented answers.

What stays with the auditor

AS 2605.19 says judgments about assessments of inherent and control risk, the materiality of misstatements, the sufficiency of tests performed, the evaluation of significant accounting estimates and other matters affecting the report must always be the auditor’s. AS 2605.20 says the need for the auditor’s own tests increases with materiality, risk of material misstatement and the subjectivity of the evidence.

AS 2201.35 requires the auditor to perform the walkthrough-type procedures in AS 2201.34 personally or supervise others providing direct assistance. Reliance is easiest on lower-risk, routine transaction controls and hardest on entity-level controls, the period-end process and judgmental areas.

Direct assistance versus using work

Using work means the auditor evaluates and tests work internal audit performed for management. Direct assistance (AS 2605.27) means the auditor asks internal auditors to perform specific procedures for the auditor; the auditor then supervises, reviews, evaluates and tests that work.

Making reliance work

Standard 9.5 requires the CAE to coordinate with internal and external assurance providers to minimize duplication and highlight gaps. In practice:

Agree before testing starts which controls the auditor plans to use, the sample sizes and the documentation standard.
Use the auditor’s or an agreed test template so reperformance is straightforward.
Share the deficiency log monthly so severity conclusions are aligned.
Expect the auditor to reperform a portion of internal audit’s tests; that is how AS 2605 evaluation of the work is done.
Keep objectivity records ready: charter, reporting lines, annual independence confirmation, staff objectivity declarations.

Worked example

Reliance plan for Westbury Instruments, Inc.

Westbury Instruments, Inc. is a large accelerated filer with 210 key controls. Internal audit (eight staff, six with professional certifications) performs management’s testing. The head of internal audit reports to the audit committee chair and administratively to the CFO. The audit committee approves the CAE’s hiring and compensation.

Auditor’s assessment: competence high (certifications, documented methodology, two-level review, prior-year working papers reperformed with no exceptions). Objectivity high (direct audit committee reporting, committee oversight of employment, a written 12-month policy).

Reliance plan by risk:

120 lower-risk transaction controls (payables, payroll, fixed assets): the auditor uses internal audit’s tests and reperforms 10% of the samples.
50 moderate-risk controls: the auditor uses internal audit’s interim testing and performs its own roll-forward.
40 higher-risk controls (revenue, reserves, period-end process, entity-level controls): the auditor tests them itself.

Judgments retained by the auditor: risk assessment, materiality, severity of every deficiency, and the conclusion on ICFR.

Direct assistance: two internal auditors help with inventory count observations under the auditor’s supervision.

Conclusion: the auditor performs full testing on 40 of 210 controls (19%), partial work on 50 and reperformance only on 120, and the file shows the AS 2605 assessment and the reperformance results that support it.

Self-check

Answer each question before you open the answer.

What two attributes of internal auditors must the external auditor assess before using their work?
Show answer
Competence and objectivity (AS 2201.18, applying AS 2605.09 to .11).
How does control risk affect the auditor’s use of others’ work?
Show answer
As the risk associated with a control increases, the need for the auditor to perform its own work on that control increases (AS 2201.19).
Name three judgments that must remain with the external auditor.
Show answer
Any three of: assessments of inherent and control risk, materiality of misstatements, sufficiency of tests performed, evaluation of significant accounting estimates, and other matters affecting the auditor’s report (AS 2605.19).
What is the difference between using internal audit’s work and direct assistance?
Show answer
Using work means evaluating and testing work internal audit did for management. Direct assistance (AS 2605.27) is work the auditor specifically requests internal auditors to perform on the auditor’s behalf, under the auditor’s supervision.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error