Close
Close

Statement on Auditing Standards 128: Impact on CAEs of using internal auditors’ work

RFP
Statement on Auditing Standards (SAS) 128 addresses the external auditor's responsibilities if using the work of the internal audit function in obtaining audit evidence or in providing direct assistance under the direction, supervision and review of the external auditor. This is the final standard in the Clarity Project undertaken by the Auditing Standards Board1. Chief audit executives need to understand how SAS 128 affects internal audit’s relationship with external auditors, as well as the impact it may have on the external auditor’s ability to use or rely on internal audit’s work.

How can the external auditor use internal audit?
The standard states two broad areas of usage of the internal auditor/internal audit function by the external auditor: obtaining audit evidence and direct assistance. A comparison of these areas is below.
Obtain audit evidence Direct assistance
Evaluation criteria Prior to deciding on using the work of the internal auditor for obtaining audit evidence, the external auditor should evaluate and document the following:
  1. The extent to which the internal audit function's organizational status and relevant policies and procedures support the objectivity of the internal auditors
  2. The level of competence of the internal audit function
  3. The application of a systematic and disciplined approach, including quality control by the internal audit function.
Prior to deciding on using the work of the internal auditor for direct assistance, the external auditor should evaluate and document the following:
  1. The existence and significance of threats to the objectivity of the internal auditors who will be providing direct assistance, as well as any safeguards applied to reduce or eliminate the threats
  2. The level of competence of the internal auditors who will be providing such assistance


What does this mean? The results of the work performed by the internal audit function is used
as audit evidence by the external auditor.
Internal auditors carry out audit procedures that otherwise would be performed directly by the external auditors themselves. In such circumstances, the internal auditors are under the direction, supervision and review of the external auditor.
Examples of work involvement The external auditor may obtain evidence for the audit through the procedures performed by the internal auditor in areas such as the following:
  1. Test of controls
  2. Substantive procedures
  3. Financial information of group components
  4. Tracing transactions through information systems relevant to financial reporting
  5. Test of compliance with regulatory requirements
Direct assistance by internal auditors includes the following:
  1. Identifying and physically verifying the existence of fixed asset additions, transfers and/or disposals
  2. Attribute testing of certain transaction cycles to determine if the design of internal controls and operating effectiveness of controls is functioning

What is the effect on the external auditor-internal auditor relationship?
SAS 128 included amendments to SAS 122, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, which includes the following key points of the external auditor considerations related to the entity and its internal audit function:

External auditor obtains an understanding of the entity and its internal auditor/internal audit function through:

—Conducting inquiries

—Reading internal audit reports
Considering nature of management responses to internal audit findings
—Reading strategy and planning documents

—Understanding the role internal audit plays in monitoring internal control over financial reporting

—Considering any information on actual, suspected or alleged fraud in external auditor identification of misstatements due to fraud risk


External auditor considers using the work of the internal audit function:

—If external auditor determines that the internal audit function is adequate and appropriate relative to the size of the entity and nature of its operations and reports directly to the ones charged with the governance
—If the activities of the internal audit function are distinct from the other monitoring controls relevant to financial reporting, such as management review of accounting information
—To modify the nature or timing and reduce the extent of external audit procedures 

External auditor communicates with internal audit function:
—Early in the engagement and maintained throughout to facilitate effective information-sharing

Communication and documentation on use of internal audit function
In communicating an overview of the planned scope and timing of the audit with those charged with governance, the external auditor should communicate and obtain agreement from those charged with governance how they plan to use the internal audit function to obtain audit evidence or direct assistance.

If the external auditor uses the work of the internal audit function/internal auditor, the external auditor should include in the audit documentation the external auditor's evaluation on whether using the work of the internal audit function/internal auditor resulted in the external auditor still being sufficiently involved in the audit, given the external auditor's sole responsibility for the audit opinion expressed. This is particularly necessary to document that in areas of higher risk, the external auditor did most of the work, including evaluation of the controls and risks of misstatement of the financial statement accounts and disclosures.


Implications for chief audit executives
  1. Increased use of internal audit work by external audit due to potential reduction in the extent of external audit procedures through use of internal audit function, and potential savings on external audit cost.
  2. Improved communication between internal audit function and external auditor provides for a platform for a more structured approach to identify and assess material misstatements due to fraud risk.
  3. Need for a strong internal audit function arises, i.e., the internal audit function can demonstrate that it is objective and applies a systematic and disciplined approach, thereby creating the opportunity for the external audit to use its work. For example, does the internal audit function adhere to the Institute of Internal Auditors International Professional Practices Framework and can this be demonstrated? The International Professional Practices Framework is the conceptual framework that organizes authoritative guidance promulgated by The Institute of Internal Auditors. 
  4. Effective coordination between the external and internal auditors can contribute positively to the external audit.



1 Further reading on ASB Clarity Project: See www.aicpa.org/InterestAreas/FRC/AuditAttest/Pages/ImprovingClarityASBStandards.aspx for details.