- Get link
- X
- Other Apps
International Standard on Auditing (ISA) 610 (Revised)—titled "Using the Work of Internal Auditors"—establishes the professional standards external auditors must follow when determining whether, to what extent, and in which areas they can use the work of an organization's internal audit function or obtain direct assistance from internal auditors.
The standard ensures that external auditors maintain full responsibility for their audit opinion while preventing redundant effort when a capable, independent internal audit team already exists.
Key Evaluation Criteria: The Three-Pillar Assessment
Before using internal audit work to obtain audit evidence, the external auditor must systematically evaluate the internal audit function across three core criteria:
| Evaluation Pillar | Focus & Key Indicators | ISA 610 Threshold |
|---|---|---|
| 1. Objectivity | Organizational Status & Bias • Does internal audit report functionally to the Board/Audit Committee rather than operational managers? • Are internal auditors free from conflicting operational duties? • Is there any commercial or management pressure restricting their scope? | High: If objectivity is lacking, the external auditor cannot use the work of internal audit. |
| 2. Competence | Technical Skills & Qualification • Do team members hold professional certifications (e.g., CIA, CPA, ACCA)? • Do they possess adequate technical training and proficiency in auditing standard frameworks? • Are policies for staffing, hiring, and continuing education robust? | High: The internal audit function must possess the skills necessary for the specific complexity of the audited area. |
| 3. Systematic & Disciplined Approach | Quality Control & Methodology • Is the work planned, supervised, reviewed, and documented systematically? • Are standard audit manuals, working papers, and quality assurance programs in place? | High: The function must apply structured audit methodologies comparable to professional standards. |
Areas Where Internal Audit Work CANNOT Be Used
Even if the internal audit function meets all three criteria, ISA 610 strictly prohibits external auditors from relying on their work in high-risk areas. The external auditor must perform the work directly when:
- High Risk of Material Misstatement: Significant risks identified under ISA 315 (e.g., fraud risk, complex valuation estimates, revenue recognition anomalies).
- High Degree of Judgment Required: Areas demanding substantial subjective judgment, such as management estimates, going concern assessments, or complex litigation reserves.
- Low Objectivity/Competence in Specific Tasks: Any specialized area where the specific internal auditors involved lack expertise or independence.
Step-by-Step Evaluation Process
- Initial Screening of the IA Function
Evaluate Objectivity, Competence, and Discipline
Assess the organizational status of internal audit. Verify that IA reports to the Audit Committee/Governing Body and adheres to international professional standards (e.g., IPPF). If IA lacks independence or adequate competence, stop—do not rely on their work. - Determine Scope & Specific Work Items
Match Work to Risk Profiles
Identify specific areas where IA work can be used (e.g., routine testing of internal financial controls, inventory count observations, IT general controls). Exclude high-judgment or high-risk areas. - Evaluate the Specific Internal Audit Work
Review Working Papers and Evidence
Re-examine the actual documentation. Verify whether:- The work was performed by auditors with adequate training.
- Sufficient, appropriate audit evidence was obtained.
- Conclusions reached are consistent with testing results.
- Any exceptions or unusual matters were properly resolved.
- Perform Re-Performance Testing
Direct External Validation
Re-perform a sample of the internal auditor's procedures on the specific items (e.g., re-test a sample of internal control walkthroughs or recalculate inventory sample valuations) to verify the accuracy and reliability of their work.
Direct Assistance vs. Using Existing Work
ISA 610 distinguishes between two scenarios:
- Using Existing Work: The external auditor relies on audit evidence, tests, or reports that internal audit completed independently as part of their internal plan.
- Direct Assistance: External auditors engage internal auditors to work directly under the external auditor’s direction, supervision, and review.
- Requirement: Requires written agreement from the entity (that internal auditors can follow external auditor instructions) and written confirmation from internal auditors that they will keep matters confidential.
Comments