Hello! Welcome to our next lesson.
In our last session, we navigated the complexities of SA 600, focusing on how a Principal Auditor determines their level of involvement with the work of another external auditor. We established that this is a risk-based judgment call, always remembering that the Principal Auditor retains ultimate responsibility.
Today, we continue this theme of "using the work of others" but shift our focus inward, to the entity itself. We'll be exploring SA 610, which guides an external auditor on using the work of the internal audit function. While the party is different, the core principle remains the same: you can use their work to be more efficient, but you can never delegate your responsibility for the audit opinion.
This is a crucial standard, especially given your articleship experience where you may have interacted with or reviewed the work of internal audit teams. This lesson aims to structure that practical experience within the formal framework required by ICAI.
By the end of this 60-minute lesson, you will be able to: Explain the factors for evaluating the internal audit function's relevance and the extent to which their work can be used by the external auditor (SA 610).
1. The Foundation: Why and How to Use Internal Audit's Work
Before diving into the rules, let's address the fundamental question you prefer to start with: Why would an external auditor use the work of an internal auditor?
Internal auditors often have a continuous presence and a deep understanding of the entity's operations and controls. Their work, if reliable, can provide valuable evidence and increase the efficiency of the external audit. However, SA 610 makes a critical distinction between two different ways an external auditor can leverage this function. Understanding this split is key to mastering the standard.
SA 610 (English) | USING THE WORK OF INTERNAL AUDITORS | CA inter &Final | CA Mahamood
This video by CA Mahamood Shaik provides an excellent conceptual introduction. It starts by comparing the roles of internal and external auditors to establish the 'why,' and then clearly explains the two distinct types of usage with practical examples.
Please watch the following two segments: 00:03:36 to 00:10:37: Focus on the comparison between internal and external auditors. This builds the conceptual case for why their work can be relevant. 00:19:59 to 00:31:45: Pay close attention to the explanation of 'Type 1' (using the work of the IAF) and 'Type 2' (using internal auditors for direct assistance). Grasping this difference is essential for the rest of the lesson.
To summarize the two approaches:
- Using the work of the Internal Audit Function (IAF): This involves using work that the internal auditors have already completed as part of their own function (e.g., reviewing their report on inventory controls).
- Using internal auditors to provide Direct Assistance (DA): This involves using internal auditors to perform specific audit procedures under the external auditor's direction, supervision, and review (e.g., asking them to help with vouching a sample of expenses that you have selected).
Your decision to use either of these approaches is not automatic. It hinges on a rigorous evaluation of the internal audit function itself.
2. The Three Pillars of Evaluation
Before you can use any work from the IAF, you must first determine if the function is credible. SA 610 requires you to evaluate three fundamental characteristics. Think of them as the pillars that must be strong enough to support any reliance you place on them.
These pillars are:
- Objectivity: Is the IAF free from bias, conflicts of interest, and undue influence? This is often linked to their organizational status (who do they report to?) and the policies in place to ensure their independence.
- Competence: Does the IAF possess the necessary knowledge, skills, and experience to perform their work reliably? This involves looking at their qualifications, training, and technical expertise.
- Systematic and Disciplined Approach: Does the IAF plan, perform, supervise, review, and document its work in a structured and professional manner? This often includes having quality control procedures.
SA 610 Revision | CA Final Audit | CA Shubham Keswani (AIR 8)
For an exam-focused breakdown of these three pillars, let's watch a revision video from CA Shubham Keswani. He uses a helpful mnemonic to make these factors memorable.
Watch from 00:01:40 to 00:02:46. He introduces the 'DISCO' mnemonic where 'O' is Objectivity, 'C' is Competence, and 'D/S' represents a Disciplined and Systematic approach. This is the kind of technical language ICAI expects.
If the IAF is weak in any of these three areas, the standard is clear: you shall not use their work. This is a non-negotiable first step.
3. Applying the Evaluation: IAF Work vs. Direct Assistance
Once you've concluded that the IAF is generally objective, competent, and systematic, you can then consider which work to use and how. The rules differ slightly for using the IAF's existing work versus using them for direct assistance.
A. Using the Work of the IAF (Type 1)
If you plan to rely on work already performed by the IAF, you must also:
- Evaluate the adequacy of that specific work: You can't just take their report at face value. You need to assess if the work was properly planned and performed, if evidence was sufficient, and if the conclusions reached are appropriate.
- Consider the level of judgment and risk: The more judgment involved or the higher the risk of material misstatement (RoMM) in an area, the less you can rely on the IAF's work and the more you must do yourself.
B. Using Internal Auditors for Direct Assistance (Type 2)
If you plan to use internal auditors to perform new tasks for you, there are strict limitations.
The ICAI study material provides the definitive rules on what you absolutely cannot delegate. These are common exam questions. Let's read the official text.
Please read two specific parts of this document: Find the diagram under the heading '7.3 Determining Whether...Internal Auditors Can Be Used to Provide Direct Assistance'. Focus on the box that starts with 'The E.A. shall not use internal auditors to provide direct assistance...' Scroll down to the 'Hints /Answers to Theoretical Questions' and read the answer to Question 5(a). This reinforces the prohibited areas with a practical scenario.
As the material makes clear, you shall not use direct assistance for procedures that:
- Involve significant judgment in the audit. This includes:
- Assessing RoMM.
- Evaluating the sufficiency of tests performed.
- Evaluating the going concern assumption.
- Evaluating significant accounting estimates.
- Relate to areas with a higher assessed RoMM.
- Relate to work the internal auditor has already been involved with (to avoid self-review threats).
The logic is simple: the external auditor must personally handle the most critical and judgmental aspects of the audit.
4. Practical Application: A Case Study
Let's ground these rules in a practical scenario that connects the theory to what you might see in practice.
Is internal audit function relevant in a financial statement audit?
This article from the Bombay Chartered Accountant Journal provides two excellent case studies that walk through the thought process of an external auditor evaluating an internal audit function.
Please read Case Study 1 and Case Study 2 in the article. Case Study 1 will help you understand how to determine the relevance of different internal audit activities. Case Study 2 illustrates the evaluation of the function's adequacy and highlights a crucial point: you cannot simply rely on the IAF's work for high-risk areas like revenue, even if the IAF is strong.
These case studies should reinforce that even with a competent and objective IAF, the external auditor must exercise professional skepticism and cannot completely outsource their own audit procedures, especially in high-risk areas.
5. Documentation: Proving Your Judgment
Finally, as with all audit areas, what isn't documented isn't done. If you decide to use the work of the IAF or obtain direct assistance, you must document your evaluation and decisions.
The key documentation points include:
- Your evaluation of the IAF's objectivity, competence, and systematic approach.
- The basis for your decision on the nature and extent of the work used.
- Evidence of your review of the work performed.
- Written agreements from management and the internal auditors when using direct assistance.
You can find a concise list of these requirements in the ICAI material ([Resource LINK](LINK)), under section 7.4, and in the Shubham Keswani video ([Resource LINK](LINK)) from 00:07:06 to 00:08:10.
Conclusion
Today we've unpacked SA 610, establishing a clear framework for when and how an external auditor can use the work of internal auditors. This is not a matter of simply reducing your workload; it's a structured process of evaluation, judgment, and supervision to enhance audit efficiency while safeguarding the integrity of your opinion.
Key Takeaways:
- You can use internal audit work in two ways: relying on the IAF's completed work or obtaining direct assistance under your supervision.
- Before using any work, you must evaluate the IAF on three pillars: Objectivity, Competence, and a Systematic and Disciplined Approach.
- There are strict prohibitions on using direct assistance for areas involving significant judgment or high risk. The external auditor must perform these procedures.
- The ultimate responsibility for the audit opinion remains solely with the external auditor, regardless of the extent to which internal audit's work is used.
Preview of the Next Lesson
We have now covered using the work of other external auditors (SA 600) and internal auditors (SA 610). Our next lesson will address the final standard in this series: SA 620. We will explore situations where the audit requires specialized knowledge outside of accounting and auditing, such as using an actuary for valuing employee benefits or a lawyer for interpreting a complex contract. We will learn how to: Describe the process of evaluating the competence and objectivity of an auditor's expert and the adequacy of their work (SA 620).