Involving Internal Auditor In An Independent AuditThe SAS does not require the independent auditor to use the work of internal auditors. However, SAS 55 (Section 319), Consideration of Internal Control in a Financial Statement Audit, requires the auditor to obtain a sufficient understanding of internal control to plan the audit. The internal audit function is part of internal control; it is part of the control environment.

Advertisement

 

This post describes requirements for the use of internal auditor in an independent audit process. The post isn’t proposed as a replacement of the standard. Rather it is an easier explanation for practical and application purposes. Enjoy!

 
SAS 65 provides sources of information and appropriate inquiries for the auditor to make to obtain the required understanding. The major points of SAS 65 are as follows:

  • If the entity has an internal audit function that acts as a higher level of control over the operation of control procedures, it will usually influence the independent auditor’s assessment of control risk and, as a result, may influence the scope of the audit procedures. The independent auditor should determine what work of the internal auditors is relevant to a financial statement audit and whether it is efficient to use that work.
  • Internal auditors may be used to provide direct assistance to the independent auditor by performing substantive tests or tests of controls.
  • For either use (#1. or #2.), the independent auditor should review the competence and objectivity of internal auditors and evaluate their work.
  • The only limitation on the use of internal auditors for either purpose, assuming that the independent auditor is satisfied with competence, objectivity, and work performance, is that significant audit judgments should be made by the independent auditor.
  • The work of internal auditors may affect the independent auditor’s procedures; however, the independent auditor should perform enough of his or her own procedures to obtain sufficient, competent evidential matter to support the auditor’s report.

 

In making judgments about the extent of the effect of the internal auditors’ work on the independent auditor’s procedures, the independent auditor considers the following about the financial statement amounts worked on by internal auditors:

  • The materiality of financial statement amounts; that is, account balances or classes of transactions.
  • The risk, inherent risk and control risk, of material misstatement of the assertions related to these financial statement amounts.
  • The degree of subjectivity involved in the evaluation of the audit evidence gathered in support of the assertions.

As the materiality of the financial statement amounts increases and either the risk of material misstatement or the degree of subjectivity increases, the need for the auditor to perform his or her own tests of the assertions increases. As these factors decrease, the need for the independent auditor to perform his or her own tests of the assertions decreases.

As a practical matter, the SAS permits the independent auditor to use the work of internal auditors to reduce audit costs. In effect, the SAS officially sanctions the use of internal auditors—it is permissible—but the SAS does not provide a mandate on minimum use.

Another important point to recognize is that the SAS is concerned with the internal audit function and not client personnel that simply have the title of internal auditor.

For example, personnel who reconcile bank accounts or re-compute the amount of invoices might be called auditors, but the independent auditor would not view their work any differently than that of other personnel who perform those specific procedures.

The SAS is concerned with internal auditors who act as a higher level of control—an additional layer of control to ensure that routine control procedures are operating.

 

Effect Of Use Of Internal Auditors’ Work On The Audit

The use of the internal auditors’ work affects the scope of the audit, especially when the independent auditor performs: Procedures to obtain an understanding of the entity’s internal control; procedures to assess risk; substantive procedures as explained in more detail below.
1. Obtaining an Understanding of Internal Control – The independent auditor’s understanding of the entity’s internal control should include knowledge about the design of relevant policies, procedures, and records and whether they have been placed in operation. The independent auditor, when obtaining an understanding of the internal audit function (see below), may review flowcharts prepared by the internal auditors to obtain information about the design of policies and procedures. To obtain information about whether the controls have been placed in operation, the independent auditor may consider the results of procedures performed by the internal auditors on the controls.

2. Risk Assessment – If the independent auditor plans to assess control risk below the maximum, he or she should test controls. The results of the internal auditors’ tests of controls may provide information about the effectiveness of the entity’s internal control and change the nature, timing, and extent of testing the auditor would otherwise need to perform.

3. Substantive Procedures – Internal auditors may perform substantive tests, such as the confirmation of receivables and the observation of inventories. The independent auditor, therefore, may be able to change the timing of the confirmation procedures, the number of receivables to be confirmed, or the number of locations of inventories to be observed.

 

Obtaining An Understanding Of The Internal Audit Function

As part of the independent auditor’s obtaining an understanding of internal control, he or she should obtain an understanding of the internal audit function. To obtain an understanding of the internal audit function, the independent auditor might do the following:

1. Read the entity’s manuals.

2. Review the entity’s policies and management directives concerning the internal audit function.

3. Make inquiries of management and internal audit personnel about the internal audit function, as described in Fundamental Requirements.

4. Review internal auditors’ audit documentation.

5. Consider the entity’s organization chart and organization chart of the internal audit department.

 

Inquiries – The independent auditor should make inquiries of appropriate management and internal audit personnel about the internal auditors’ work. The inquiries should answer the following questions:

  • What are the primary responsibilities of internal auditors?
  • What do internal auditors do when (a) they believe misstatements have occurred? (b) They believe the entity’s policies are not being properly executed? (c) They believe weaknesses exist in internal control?
  • What importance does management attach to the internal audit function?
  • What does management do with recommendations and reports of internal auditors?

To determine how the internal audit department functions, the independent auditor should seek answers to the following questions:

  • How are scopes of examinations determined?
  • How are audit procedures determined?
  • How are reports prepared?
  • Who receives the reports?
  • What are the follow-up procedures?

 

Review of Audit Documentation – SAS 55 (Section 319) requires the independent auditor to obtain an understanding of internal control and to determine whether relevant policies, procedures, and records have been placed in operation. A review of the internal auditors’ audit documentation, schedules, flowcharts, questionnaires, checklists, etc. will help the independent auditor determine if the relevant policies, procedures, and records have been placed in operation. It also will help the independent auditor obtain an understanding of the internal audit function.

Organization Charts – To determine the position of the internal audit department in the organization, the independent auditor might obtain an organization chart of the entity. The independent auditor would then determine the following:

  • To whom do internal auditors report?
  • To what extent do internal auditors have access to top management and to the audit committee or the full board of directors?

Ready access to top management and to the audit committee indicates that the internal audit department could act independently.

To determine the size of the internal audit department and the responsibilities of each member, the independent auditor might obtain an organization chart of the department. The responsibilities of the members indicate whether the department performs an internal audit function or an accounting control function.

 

Assessing Relevance And Efficiency

Relevance – When the independent auditor reviews the internal auditors’ audit documentation (see above, “Obtaining an Understanding of the Internal Audit Function”), he or she can determine which of the internal auditors’ work is relevant to a financial statement audit. Other procedures that may be used by the independent auditor to determine the relevancy of the internal auditors’ work include the following:

  • Consider knowledge from prior audits.
  • Review how the internal auditors allocate their resources to financial or operating areas of the entity.
  • Read internal audit reports to obtain a detailed understanding about the scope of internal audit activities.

 

Efficiency – Determining whether it is efficient to use the internal auditors’ work requires the professional judgment of the independent auditor. The independent auditor should answer the question: Is it less time-consuming and cheaper, and as effective, to use the internal auditors’ work than to do original work himself or herself?

 

Assessing Competence And Objectivity Of Internal Auditors

In assessing competence and objectivity, the auditor will consider information obtained from the following sources:

  • Previous experience with internal auditors.
  • Discussions with management.
  • Results of any recent external quality review of the internal audit function.

When assessing competence and objectivity, the independent auditor should consider using the guidance provided in professional internal auditing standards, such as those promulgated by the “Institute of Internal Auditors and the General Accounting Office.”

 

Competence – Information that the independent auditor should obtain about the competence of internal auditors is specified in Fundamental Requirements. The independent auditor should apply the following procedures to obtain that information:

  • Determine personnel policies relative to hiring, training, job assignment, promotion, supervision, and review.
  • Review personnel files.
  • Determine entity policy on training programs.
  • Scan audit documentation of internal auditors.
  • Consider adequacy of audit documentation review by supervisors in internal audit department.

 

Objectivity – The independent auditor should obtain or update information from prior years about the organizational status of the internal auditor responsible for the internal audit function and policies to maintain internal auditors’ objectivity about the areas audited. According to AU 322.10, the information about the organizational status of the internal auditor responsible for the internal audit function should include the following:

  • Whether the internal auditor reports to an officer of sufficient status to ensure broad audit coverage and adequate consideration of, and action on, the findings and recommendations of the internal auditors.
  • Whether the internal auditor has direct access and reports regularly to the board of directors, the audit committee, or the owner-manager.
  • Whether the board of directors, the audit committee, or the owner-manager oversees employment decisions related to the internal auditor.

 

Policies to maintain auditors’ objectivity about the areas audited should include the following:

  • Policies prohibiting internal auditors from auditing areas where relatives are employed in important or audit-sensitive positions.
  • Policies prohibiting internal auditors from auditing areas where they were recently assigned or are scheduled to be assigned on completion of responsibilities in the internal audit function.

 

The independent auditor also should determine the scopes of examinations of the internal auditors. He or she should ascertain that the scopes were not restricted and that they were established solely by the internal audit department.

 

Extent Of The Effect Of The Internal Auditors’ Work

Factors affecting the extent of the effect of the internal auditors’ work on the scope of the audit were described in Objectives of Section. These factors are (1) materiality, (2) risk, and (3) subjectivity.

The independent auditor may decide to use the internal auditors’ work for assertions related to material financial statement amounts where the risk of material misstatement or the degree of subjectivity involved is high. In these circumstances, the internal auditors’ work cannot alone reduce audit risk to a level that would eliminate the need for the independent auditor to apply any procedures to those assertions.

Examples of those assertions are: (1) valuation of assets and liabilities involving significant accounting estimates (for example, accounts receivable; property, plant, and equipment; product warranties), (2) existence and disclosure of related-party transactions, (3) contingencies, (4) uncertainties, and (5) subsequent events.

The independent auditor should apply some audit procedures to these assertions, in addition to considering the internal auditors’ work. The independent auditor may decide to use the internal auditors’ work for assertions related to less material financial statement amounts where the risk of material misstatement or the degree of subjectivity involved is low. In these circumstances, the internal auditors’ work may reduce audit risk to an acceptable level so that the independent auditor does not have to apply any further procedures to those assertions. Examples of those assertions are the existence of cash, prepaid assets, and fixed-asset additions.

 

Coordination Of Work

According to AU 322.23, if the internal auditors’ work will have an effect on the independent auditor’s procedures, it would be efficient for them to coordinate their work by doing the following:

  • Holding periodic meetings.
  • Scheduling audit work.
  • Providing access to internal auditors’ audit documentation.
  • Reviewing audit reports.
  • Discussing possible accounting and auditing issues.

 

 

Evaluating And Testing Effectiveness Of Internal Auditors’ Work

Evaluating – Procedures to evaluate the work of internal auditors include a review of the following:

1. Scope of work: The independent auditor should review the scope of the internal auditors’ work to determine that it was established by them and was in no way restricted.

2. Instructions to staff: To determine that the internal auditors were properly instructed, the independent auditor should read all written instructions. The independent auditor also should review audit programs to determine that they were adequate.

3. Review of audit documentation: To determine the quality of internal auditors’ work, the independent auditor should review their audit documentation to determine that:

  • Audit documentation adequately records work performed, including evidence of supervision and review.
  • There is evidence of follow-up and disposition of questions and errors.
  • Conclusions are appropriate in the circumstances.
  • Reports are consistent with the results of work performed.

 

Testing – To determine the effectiveness of the internal auditors’ work, the independent auditor should test their work by examining documentary evidence of work performed. He or she should either (1) examine some of the controls, transactions, or balances examined by the internal auditors or (2) examine similar controls, transactions, or balances not actually examined by the internal auditors. In either case, the independent auditor should compare the results of his or her tests with the results of the internal auditors’ work.

 

Using Internal Auditors To Provide Direct Assistance To The Independent Auditor

When the independent auditor uses internal auditors to provide him or her with direct assistance, he or she should apply the procedures described above.

In addition, the independent auditor should review and evaluate the internal auditors’ audit documentation to the same extent he or she would review and evaluate the audit documentation of the independent auditors’ staff.

 

 

Auditor’s Consideration Of The Internal Audit Function In An Audit Chart

To sum up, here is a good chart from the AICPA describes all the requirements need to be considered when involving internal auditors in auditing financial statements.

Auditor's Consideration Of The Internal Audit Function In An Audit