6035 Using internal auditors to provide direct assistance

Sep-2016

In This Section

Determining whether internal auditors can be used to provide direct assistance

Determining the nature and extent of work that can be assigned to internal auditors providing direct assistance

Procedures for which use of internal auditors to provide direct assistance is not permitted

Evaluating the sufficiency of our planned involvement in the audit when planning when using internal auditors to provide direct assistance

Communication of planned use of internal auditors to provide direct assistance with those charged with governance

Directing, supervising and reviewing the work of internal auditors providing direct assistance

Documentation

Overview

This topic explains:

• Determining whether internal auditors can be used to provide direct assistance

• Determining the nature and extent of work that can be assigned to internal auditors providing direct assistance

• Procedures for which use of internal auditors to provide direct assistance is not permitted

• Evaluating the sufficiency of our planned involvement in the audit when using internal auditors to provide direct assistance

• Communication of planned use of internal auditors to provide direct assistance with those charged with governance

• Directing, supervising and reviewing the work of internal auditors providing direct assistance

• Documentation

Determining whether internal auditors can be used to provide direct assistance

CAS Guidance

In jurisdictions where the external auditor is prohibited by law or regulation from using internal auditors to provide direct assistance, it is relevant for the group auditors to consider whether the prohibition also extends to component auditors and, if so, to address this in the communication to the component auditors (CAS 610.A31)

As stated in paragraph A7 of this CAS, objectivity refers to the ability to perform the proposed work without allowing bias, conflict of interest or undue influence of others to override professional judgments. In evaluating the existence and significance of threats to the objectivity of an internal auditor, the following factors may be relevant (CAS 610.A32):

• The extent to which the internal audit function’s organizational status and relevant policies and procedures support the objectivity of the internal auditors.

• Family and personal relationships with an individual working in, or responsible for, the aspect of the entity to which the work relates.

• Association with the division or department in the entity to which the work relates.

• Significant financial interests in the entity other than remuneration on terms consistent with those applicable to other employees at a similar level of seniority.

Material issued by relevant professional bodies for internal auditors may provide additional useful guidance.

There may also be some circumstances in which the significance of the threats to the objectivity of an internal auditor is such that there are no safeguards that could reduce them to an acceptable level. For example, because the adequacy of safeguards is influenced by the significance of the work in the context of the audit, paragraph 30(a) and (b) prohibits the use of internal auditors to provide direct assistance in relation to performing procedures that involve making significant judgments in the audit or that relate to higher assessed risks of material misstatement where the judgment required in performing the relevant audit procedures or evaluating the audit evidence gathered is more than limited. This would also be the case where the work involved creates a self-review threat, which is why internal auditors are prohibited from performing procedures in the circumstances described in paragraph 30(c) and (d) (CAS 610.A33).

In evaluating the level of competence of an internal auditor, many of the factors in paragraph A8 of this CAS may also be relevant, applied in the context of individual internal auditors and the work to which they may be assigned (CAS 610.A34).

OAG Guidance

Whose work can the Office use?

As noted in CAS 610.26, laws or regulation may prohibit the audit team from obtaining direct assistance from internal auditors. Consideration needs to be given as to whether there are laws or regulations prohibiting the audit team from doing so (e.g., local independence regulations).

As explained in OAG Audit 6031, the work of individuals who are part of an internal audit or equivalent function can be used. However, the work of individuals outside of the internal audit or equivalent function would not be used in direct assistance capacity, as they would typically not possess necessary objectivity and competence and would not apply a systematic and disciplined approach to their procedures. Therefore, consideration should be given to whether the individuals the audit team plans to use in direct assistance capacity are part of the internal audit or equivalent function.

Threats to objectivity and competence

When the audit team plans to use internal auditors to provide direct assistance the relevant threats and safeguards to the objectivity of the individuals that have been identified to provide direct assistance need to be assessed and documented. In addition, the competence of those individuals needs to be assessed to determine whether their planned involvement in the work the audit team intends to allocate to them is appropriate. The audit team assesses and documents its evaluation of the competence and objectivity of the internal audit staff assigned to provide direct assistance, as described in OAG Audit 6032.

Direct assistance may not be provided by individuals that are responsible for any aspect of the process subject to the work, or by an individual that reports to anyone that is responsible for any aspect of the process subject to the work or to perform work that requires the application of significant professional judgment in performing procedures or evaluating the evidence obtained.

As part of the evaluation of the objectivity and competence of the internal auditors, the audit team inquires of them and other appropriate individuals with responsibility for oversight of the function as appropriate, regarding factors that might create a threat to their objectivity.

In addition to situations where threats to objectivity or competence result in a conclusion that it is not appropriate to use internal auditors to provide direct assistance, CAS 610 also prohibits the use of direct assistance in specific areas, even when no threats to objectivity have been identified and competence is deemed appropriate. These are described in the guidance block ‘Procedures for which use of internal auditors to provide direct assistance is not permitted’ below.

Group audits

As explained in OAG Audit 6031, any prohibition on the use of the work of an internal audit function (including in direct assistance capacity) is communicated to component auditors through the group audit instructions. Similarly, where the use of the work of an internal audit function is prohibited, the audit team needs to consider the impact on the planned scope of the component auditor’s work.

Determining the nature and extent of work that can be assigned to internal auditors providing direct assistance

CAS Guidance

Paragraphs A15-A22 of this CAS provide relevant guidance in determining the nature and extent of work that may be assigned to internal auditors (CAS 610.A35).

In determining the nature of work that may be assigned to internal auditors, the external auditor is careful to limit such work to those areas that would be appropriate to be assigned. Examples of activities and tasks that would not be appropriate to use internal auditors to provide direct assistance include the following (CAS 610.A36):

• Discussion of fraud risks. However, the external auditors may make inquiries of internal auditors about fraud risks in the organization in accordance with CAS 315.

• Determination of unannounced audit procedures as addressed in CAS 240.

Similarly, since in accordance with CAS 505 the external auditor is required to maintain control over external confirmation requests and evaluate the results of external confirmation procedures, it would not be appropriate to assign these responsibilities to internal auditors. However, internal auditors may assist in assembling information necessary for the external auditor to resolve exceptions in confirmation responses (CAS 610.A37).

The amount of judgment involved and the risk of material misstatement are also relevant in determining the work that may be assigned to internal auditors providing direct assistance. For example, in circumstances where the valuation of accounts receivable is assessed as an area of higher risk, the external auditor could assign the checking of the accuracy of the aging to an internal auditor providing direct assistance. However, because the evaluation of the adequacy of the provision based on the aging would involve more than limited judgment, it would not be appropriate to assign that latter procedure to an internal auditor providing direct assistance (CAS 610.A38).

Notwithstanding the direction, supervision and review by the external auditor, excessive use of internal auditors to provide direct assistance may affect perceptions regarding the independence of the external audit engagement (CAS 610.A39).

OAG Guidance

The audit team needs to determine the work that can assigned to internal auditors, considering the factors listed in CAS 610 and being careful to limit such work for the appropriate areas.

Refer to OAG Audit 6033 for guidance on determining the work of internal auditors that can be used, which would generally be applicable to direct assistance as well.

As explained in CAS 610.A37, the audit team would not use internal auditors to maintain control over external confirmation requests and evaluate the results of external confirmation procedures.

Consider that internal auditors may become displeased with the work environment if it is not possible to assign challenging work, but only clerical or mundane tasks. The audit team needs to make the best use of the client’s internal audit resources and to create a work environment that is mutually beneficial for both the audit team and the internal auditors.

Procedures for which use of internal auditors to provide direct assistance is not permitted

OAG Guidance

CAS 610 provides a specific list of procedures, where internal auditors cannot be used to provide direct assistance. For example, internal auditors’ would not be used for direct assistance in the areas of significant judgment. The use of internal auditors in the areas of higher risk (significant risks) would be limited to procedures where limited judgment is involved. The audit team would also need to make its own decisions regarding the use of internal auditors.

Refer to OAG Audit 6033 for guidance on determining the work of internal auditors that can be used, which would generally be applicable to direct assistance as well.

Evaluating the sufficiency of our planned involvement in the audit when using internal auditors to provide direct assistance

OAG Guidance

Refer to OAG Audit 6033 for guidance on the factors to consider when evaluating sufficiency of the planned involvement.

Communication of planned use of internal auditors to provide direct assistance with those charged with governance

OAG Guidance

When communicating planned use of the work of the internal audit function and use of internal auditors to provide direct assistance, the audit team explains the factors considered in determining when, and to what extent, it is appropriate to:

1. use the work of an internal audit function (see OAG Audit 6033); and
2. use the work of internal auditors to provide direct assistance.

Such factors are those that are described in this section, and include consideration of objectivity and competence, consideration of judgment and risk involved in the planned work (and restrictions imposed by CAS 610 thereon), and requirements related to the direction, supervision and review of internal auditors providing direct assistance.

Communicating these factors will assist in helping those charged with governance understand the planned audit strategy. In particular, such explanatory background information will be important when those charged with governance express a desire for greater use of the work of the entity’s internal audit function to be made, or request the audit team to use internal auditors to provide direct assistance, and which would not be permitted or appropriate under CAS 610.

Directing, supervising and reviewing the work of internal auditors providing direct assistance

CAS Guidance

As individuals in the internal audit function are not independent of the entity as is required of the external auditor when expressing an opinion on financial statements, the external auditor’s direction, supervision and review of the work performed by internal auditors providing direct assistance will generally be of a different nature and more extensive than if members of the engagement team perform the work (CAS 315.A40).

In directing the internal auditors, the external auditor may, for example, remind the internal auditors to bring accounting and auditing issues identified during the audit to the attention of the external auditor. In reviewing the work performed by the internal auditors, the external auditor’s considerations include whether the evidence obtained is sufficient and appropriate in the circumstances, and that it supports the conclusions reached (CAS 315.A41).

OAG Guidance

Written agreements to be obtained prior to provision of direct assistance

Prior to using internal auditors to obtain direct assistance, the audit team obtains the agreement of an authorized individual within the entity that the internal auditors used will be allowed to follow the audit team’s instructions, and that the entity will not intervene in the work the internal auditor performs.

The audit team also obtains agreement from the relevant individuals who will be providing the direct assistance that they will keep confidential matters identified to them as being confidential, as well as notifying the audit team of any matter the may represent a threat to their objectivity.

It is important to obtain necessary written agreements on a timely basis (before the work of internal auditors is planned to be used). The audit team may consider including related agreements into the letter of engagement signed by the entity. If this is not practicable, separate agreements may be signed.

Direction and supervision

The audit team controls all phases of internal auditors’ work, including supervision, review, evaluation and testing the work performed to the extent appropriate in the circumstances. Audit programs are provide only to internal auditors providing direct assistance.

The audit team needs to inform internal auditors of their responsibilities, the objectives of the procedures they are to perform, and matters that may affect the nature, timing, and extent of audit procedures, such as possible accounting and auditing issues. The audit team also instructs them that all significant accounting and auditing issues identified during the audit need to be brought to the audit team’s attention.

Review

The extent of review procedures needs to recognize that internal auditors are not independent of the entity and also needs to reflect the audit team’s evaluation of the risk the procedures are designed to address and the judgment involved in performing the procedures, as well as the objectivity and competence of the internal auditors.

CAS 610 requires the audit team to check back to the underlying audit evidence for some of the work performed by the internal auditors. Thus, the team’s review of internal auditors’ work would normally be more extensive than review procedures performed over the work done by engagement team members.

When reviewing the work of internal auditors providing direct assistance, if any evidence is identified that calls into question the objectivity or competence of that individual, the audit team reconsiders the original assessments of objectivity and competence and determines whether it is appropriate to continue to use the work of that individual to provide direct assistance.

Documentation

OAG Guidance

The audit file needs to demonstrate the team’s consideration of the matters outlined in the requirement above.

Matters to be documented:

• Evaluation of internal auditors’ objectivity and competence, including significant threats.
• The basis for the decision regarding the nature and extent of the work performed by the internal auditors.
• The written agreements obtained from an authorized representative of the entity and the internal auditors.
• The working papers prepared by the internal auditors who provided direct assistance.

Related Sections

OAG Audit 6031 The role of the internal audit function
OAG Audit 6032 Evaluate ability to use the work of an internal audit function
OAG Audit 6033 Determining the nature and extent of work of the internal audit function that the Office finds appropriate to use
OAG Audit 6034 Evaluating the work of the internal audit function