Implementation Guide to Standard on Auditing
(SA) 610(Revised)
Using the Work of Internal Auditors
The Institute of Chartered Accountants of India
(Set up by an Act of Parliament)
New Delhi
© The Institute of Chartered Accountants of India.
All rights reserved. No part of this publication may be reproduced, stored in a retrieval
system, or transmitted, in any form, or by any means, electronic, mechanical,
photocopying, recording, or otherwise, without prior permission, in writing, from the
publisher.
Edition : August 2018
Committee/ : Auditing and Assurance Standards Board
Department
Email : aasb@icai.in
Website : www.icai.org
Price : Rs. 50/-
Published by : The Publication Department on behalf of the Institute of
Chartered Accountants of India, ICAI Bhawan, Post Box
No. 7100, Indraprastha Marg, New Delhi 110 002.
Printed by : Sahitya Bhawan Publications, Hospital Road, Agra 282 003
Foreword
Standards on Auditing issued by the Institute of Chartered Accountants of India (ICAI)
are critical in ensuring and enhancing audit quality. It is essential that auditors
implement these Standards in letter and spirit in their audit engagements. The
Implementation Guides to Standards on Auditing are important resource for auditors to
understand the requirements of these Standards and also help them in their appropriate
implementation. These Guides also provide solutions to various practical problems
faced by auditors in implementing Standards on Auditing in real life audit situations.
The Auditing and Assurance Standards Board of ICAI has been issuing a number of
Implementation Guides to various Standards on Auditing for the benefit of auditors. I am
happy that the Board has brought out this Implementation Guide to Standard on
Auditing (SA) 610 (Revised), "Using the work of Internal Auditors". The Implementation
Guide has been written in an easy to understand language in the form of frequently
asked questions (FAQs) on this Standard and responses to those FAQs.
I wish to compliment CA. Shyam Lal Agarwal, Chairman, CA. Sanjay Vasudeva, Vice-
Chairman and all the members of the Auditing and Assurance Standards Board for
bringing out this Implementation Guide for the benefit of members.
I am sure that the members and other interested readers would find this Implementation
Guide useful in discharge of their professional responsibilities.
August 23, 2018 CA. Naveen N.D. Gupta
New Delhi President, ICAI
Preface
Standards on Auditing issued by the Institute of Chartered Accountants of India lay
down the fundamental principles of relevant aspects of audit to be followed by auditors
in their audit engagements. It is essential that auditors understand and implement these
Standards appropriately in their audit engagements to meet the objectives of these
standards. Implementation Guides to Standards on Auditing are issued by the Auditing
and Assurance Standards Board (AASB) of ICAI to assist auditors in practical
implementation of these Standards in real life audit situations. Till date, AASB has
brought out a number of Implementation Guides.
It gives me immense pleasure to place in hands of the members, this Implementation
Guide to SA 610(Revised)," Using the work of Internal Auditors" brought out by AASB.
The Implementation Guide has been written in simple and easy to understand language
and contains detailed guidance on various issues involved in this Standard. For ease of
usage and understanding of the readers, the Implementation Guide has been written in
a "Question Answer" format containing frequently asked questions (FAQs) on this
Standard and the responses to those FAQs.
I am extremely grateful to CA. Bhavani Balasubramanian, Chennai and her team for
sparing time out of their professional and personal preoccupations to write this
Implementation Guide.
I wish to express my sincere thanks to CA. Naveen N.D. Gupta, Honourable President,
ICAI and CA. Prafulla Premsukh Chhajed, Honourable Vice-President, ICAI for their
guidance and support to the activities of the Board.
I wish to also place on record, the appreciation of CA. Sanjay Vasudeva, Vice Chairman
of the Board, all Members of the Board and the Council for their suggestions, support
and guidance in finalising this Implementation Guide as well as other pronouncements
of the Board. I also wish to thank CA. Megha Saxena, Secretary, other officers and staff
of the Board for their continued co-operation.
I am confident that the Implementation Guide would be well received by the members
and other interested readers.
August 23, 2018 CA. Shyam Lal Agarwal
Jaipur Chairman,
Auditing and Assurance Standards Board
Contents
Page No.
Chapter 1 Introduction and Overview 1-3
Chapter 2 Implementation Guidance 4-20
Chapter 3 Illustrative Checklist 21-29
Chapter 1
Introduction and Overview
1.1 The purpose of this Implementation Guide is to provide practical guidance on
implementation of the principles laid down in Standard on Auditing (SA) 610(Revised),
"Using the Work of Internal Auditors" (hereinafter referred as "the Standard"), issued by
the Institute of Chartered Accountants of India. The Standard is effective for audits of
financial statements for period beginning on or after April 1, 2016. It replaces SA 610,
`Using the Work of Internal Auditors' issued by ICAI in 2009.
1.2 The most significant change made by the Standard is that it specifically deals with
aspects regarding external auditors using internal auditors to provide them direct
assistance in carrying out audit procedures. The Standard provides a number of
conditions and safeguards for the external auditor in this regard. SA 610 issued in 2009
specifically provided that it does not deal with the instances where individual internal
auditors provide direct assistance to the external auditor in carrying out audit
procedures.
1.3 Applicability of the Standard
This Standard does not apply if the entity does not have an internal audit function.
If the entity has an internal audit function, the requirements in this Standard relating
to using the work of that function do not apply if the responsibilities and activities of
the internal audit function are not relevant to the audit; or based on the auditor's
preliminary understanding of the internal audit function obtained as a result of
procedures performed under SA 315, "Identifying and Assessing the Risks of
Material Misstatement Through Understanding the Entity and Its Environment", the
external auditor does not expect to use the work of the internal audit function in
obtaining audit evidence.
The requirements in this Standard relating to direct assistance do not apply if the
external auditor does not plan to use internal auditors to provide direct assistance.
In some cases, the external auditor may be prohibited, or restricted to some extent,
by law or regulation from using the work of the internal audit function or using
internal auditors to provide direct assistance.
1.4 External Auditor's Responsibility for the Audit
Paragraph 11 of the Standard provides that the external auditor has sole responsibility
for the audit opinion expressed, and that responsibility is not reduced by the external
auditor's use of the work of the internal audit function or internal auditors to provide
direct assistance on the engagement. This aspect is further highlighted in the Standard
at various places e.g.
Paragraph 18: The external auditor shall make all significant judgments in the audit
engagement and, to prevent undue use of the work of the internal audit function, shall
plan to use less of the work of the internal audit function and perform more of the work
directly.
Paragraph 19: The external auditor shall also evaluate whether, in aggregate, using the
work of the internal audit function to the extent planned would still result in the external
auditor being sufficiently involved in the audit, given the external auditor's sole
responsibility for the audit opinion expressed.
Paragraph 32: The external auditor shall evaluate whether, in aggregate, using internal
auditors to provide direct assistance to the extent planned, together with the planned
use of the work of the internal audit function, would still result in the external auditor
being sufficiently involved in the audit, given the external auditor's sole responsibility for
the audit opinion expressed.
1.5 Structure of the Standard
The Standard can be broadly divided into two separate parts as under:
Part 1: Using the Work of Internal Audit Function. (Paragraphs 15 to 25 and 36)
Part 2: Using Internal Auditors to provide Direct Assistance. (Paragraphs 26 to 35 and
37)
1.6 Part 1: Using the Work of Internal Audit Function
This part covers paragraphs 15 to 25 and 36 of this Standard along with the
corresponding application guidance. This part provides the framework for the external
auditor to use the work of internal audit function. The framework in broader terms is as
under:
First step: The external auditor needs to determine whether the external auditor
can use the work of internal audit function or not. For this purpose, the external
auditor needs to evaluate the internal audit function w.r.t. its 1. objectivity 2.
competence and 3. systematic and disciplined approach followed. (This aspect is
covered by paragraphs 15-16 of this Standard)
Second Step: After deciding to use work of internal audit function, the external
auditor needs to determine the nature and extent of work that can be used by
external auditor. (This aspect is covered by paragraphs 17-20 of this Standard)
Third step: After deciding to use work of internal audit function and also deciding
nature and extent of use of that work, the external auditor needs to follow specific
procedures for using the work of internal audit function which include evaluating
adequacy of that work for purposes of the audit. (This aspect is covered by
paragraphs 21-25 of this Standard)
Paragraph 36 provides documentation requirements if the external auditor uses the
work of internal audit function.
2
1.7 Part 2: Using Internal Auditors to provide Direct Assistance
This part covers paragraphs 26 to 35 and 37 of this Standard along with the
corresponding application guidance. This part provides the framework for external
auditor to use internal auditors to provide direct assistance. The framework in broader
terms is as under:
First step: External auditor needs to determine whether internal auditors can be
used to provide direct assistance in audit. For this purpose, the external auditor
needs to evaluate the internal auditors w.r.t. 1. threats to their objectivity and 2. their
level of competence. (This aspect is covered by paragraphs 26-28 of this Standard)
Second Step: After deciding to use internal auditors for providing direct assistance,
the external auditor needs to determine the nature and extent of work that can be
assigned to internal auditors for providing direct assistance (This aspect is covered
by paragraphs 29-32 of this Standard)
Third step: After deciding to use internal auditor for providing direct assistance and
also deciding the nature and extent of work to be assigned, the external auditor
needs to obtain written representations from the entity and the internal auditors in
this regard. The external auditor also needs to direct, supervise and review the work
of internal auditors. (This aspect is covered by paragraphs 33-35 of this Standard)
Paragraph 37 provides documentation requirements if the external auditor uses internal
auditor to provide direct assistance.
3
Chapter 2
Implementation Guidance
For clear understanding of readers, this Chapter is divided into 3
Parts
Part I- General Section.
Part II- Using the work of the internal audit function.
Part III- Using the internal auditor for providing direct assistance.
Part I: General Section
Question 1: What is the applicability date of the Standard?
Response: The Standard is applicable for audits of financial statements for periods
beginning on or after 1st April 2016.
Question 2: What are the different methods by which work of an internal audit function
can be used by the external auditor as per the Standard?
Response: The Standard provides two methods.
1. External auditor can use the work of the internal audit function or
2. External auditor can use internal auditor to provide direct assistance to external
auditor.
The figure given below shows broad features of these two methods:
4
The Standard sets out different sets of requirements for the external auditor in using the
work of internal auditor in both methods.
Question 3: Do services of internal audit rendered by a third party service
providers in an entity, can also be included in the definition of internal audit
function as per this Standard?
Response: Activities similar to those performed by an internal audit function may be
conducted by functions with other titles within an entity like concurrent auditors. Some
or all of the activities of an internal audit function may also be outsourced to a third-party
service provider. Neither the title of the internal audit function, nor whether it is
performed by the entity or a third-party service provider, are sole determinants of
whether or not the external auditor can use the work of the internal audit function.
Rather, it is the nature of the activities; the extent to which the internal audit function's
organizational status and relevant policies and procedures support the objectivity of the
internal auditors; competence; and systematic and disciplined approach of the internal
audit function that are relevant. References in this Standard to the work of the internal
audit function include relevant activities of other functions or third-party service
providers that have these characteristics.
Question 4: What are the responsibility of external auditor in using the work of
internal audit function?
Response: The external auditor has sole responsibility for the audit opinion expressed,
and that responsibility is not reduced by the external auditor's use of the work of the
internal audit function or internal auditors to provide direct assistance on the
engagement. Although they may perform audit procedures similar to those performed by
the external auditor, neither the internal audit function nor the internal auditors are
independent of the entity as is required of the external auditor in an audit of financial
statements in accordance with SA 200, "Overall Objectives of the Independent Auditor
and the Conduct of an Audit in Accordance with Standards on Auditing". This Standard,
therefore, defines the conditions that are necessary for the external auditor to be able to
use the work of internal auditors. It also defines the necessary work effort to obtain
sufficient appropriate evidence that the work of the internal audit function, or internal
auditors providing direct assistance, is adequate for the purposes of the audit. The
requirements are designed to provide a framework for the external auditor's judgments
regarding the use of the work of internal auditors to prevent over or undue use of such
work.
Question 5: Mention the circumstances where this Standard will not apply.
Response: This Standard will not apply in the below cited circumstances:
i. If the entity does not have an internal audit function.
ii. If the entity has an internal audit function, the requirements in this Standard relating
to using the work of that function do not apply if:
a. The responsibilities and activities of the internal audit function are not relevant
5
to the audit; or
b. Based on the auditor's preliminary understanding of the internal audit function
obtained as a result of procedures performed under SA 315, the external
auditor does not expect to use the work of the internal audit function in
obtaining audit evidence.
iii. If the external auditor does not plan to use internal auditors to provide direct
assistance.
iv. Instances where the external auditor may be prohibited, or restricted to some
extent, by law or regulation from using the work of the internal audit function or
using internal auditors to provide direct assistance.
Question 6: What are the objectives of external auditor under this Standard?
Response: The objectives of the external auditor, where the entity has an internal audit
function and the external auditor expects to use the work of the internal audit function to
modify the nature or timing, or reduce the extent, of audit procedures to be performed
directly by the external auditor, or to use internal auditors to provide direct assistance,
are as under:
i. To determine whether the work of the internal audit function or direct assistance
from internal auditors can be used, and if so, in which areas and to what extent;
and having made that determination:
ii. If using the work of the internal audit function, to determine whether that work is
adequate for purposes of the audit; and
iii. If using internal auditors to provide direct assistance, to appropriately direct,
supervise and review their work.
Part II: Using the Work of the Internal Audit Function
2.1 Internal auditor as part of discharging his duties as per scope of his appointment
would have performed audit procedures. The Standard allows external auditor to use
such work performed by internal auditors. The external auditor shall exercise
professional judgement in determining whether the work of the internal auditor can be
used for the purposes of audit and the nature and extent of work that can be used.
2.2 Examples of work of the internal audit function that can be used by the external
auditor include the following:
Testing of operative effectiveness of controls.
Physical verification of inventory, fixed assets, spares etc.
Substantive procedures involving limited judgement. Example: test of details,
invoice/ agreement/MOU/prospectus documentation etc.
6
Tracing transactions through the information system relevant to financial reporting.
Testing of compliance with regulatory requirements.
2.3 In the following cases, external auditor shall plan to use work of internal auditor to
a lesser extent and perform more work directly:
a) Areas that involve more judgement.
b) Areas that have been assessed higher risk of material misstatement at assertion
level.
c) The less the internal audit function's organizational status and relevant policies and
procedures adequately support the objectivity of the internal audit function. (Refer
paragraph 2.5)
d) Lower the level of competence of the internal audit function. (Refer paragraph 2.6)
2.4 External auditor shall evaluate whether the work of internal audit function can be
used. Following factors shall be evaluated by external auditor for this purpose:
a) The extent to which the internal audit function's organizational status and relevant
policies and procedures support the objectivity of the internal auditors; (Refer
paragraph 2.5)
b) The level of competence of the internal audit function; and (Refer paragraph 2.6)
c) Whether the internal audit function applies a systematic and disciplined approach,
including quality control. (Refer paragraph 2.7)
On evaluation of above factors, external auditor shall determine whether the work of
internal audit function can be used or not. All the above factors which are explained in
the paragraphs below shall be considered individually and in aggregate to conclude on
whether to use the work of internal auditor or not.
2.5 Objectivity refers to the ability to perform those tasks without allowing bias,
conflict of interest or undue influence of others to override professional judgments
(Refer paragraphs A5-A7 of the Standard)
External auditor shall obtain the appointment letter for internal audit function and find
the scope, reporting authority, appointing authority and any constrains placed on their
scope. It is recommended that those charged with governance shall oversee the
appointment and internal auditor reports directly to those charged with governance. If
the internal auditor reports to management, this would be considered a significant threat
to the internal audit function's objectivity unless other factors such as those described in
paragraphs A5 to A7 of the Standard collectively provide sufficient safeguards to reduce
the threat to an acceptable level.
External auditor shall also review whether any members of the engagement team of
internal audit function is employed by the entity in book keeping process thereby exist
conflicting responsibility.
7
As per the appointment of internal auditors, if there exist any constrain or restrictions on
the internal auditor, external auditor shall not rely on work of internal auditor on such
areas on which restriction applies. External auditor shall also search for any conflicting
responsibilities of internal audit function in the entity. One of such example is
preparation and audit of financial statements of the entity.
It is recommended to perform an independent background check of the internal audit
function and analyze the organizational status of the internal audit function.
2.6 Competence of the internal audit function refers to the attainment and
maintenance of knowledge and skills of the internal audit function as a whole at the
level required to enable assigned tasks to be performed diligently and in accordance
with applicable professional Standards. (Refer paragraph A8 of the Standard)
External auditor has to evaluate the competency of internal audit function before
deciding to rely on the work of internal audit function. External auditor shall review the
academic qualification and experience of internal audit function in the field of accounts
and audit.
External auditor can take comfort in the competency of internal auditors, if they have
complied with the relevant professional standards, and if they possess adequate
technical training and proficiency in auditing.
External auditor has to evaluate whether the internal audit function is adequately and
appropriately resourced relative to the size of the entity and nature of its operations.
2.7 Application of a systematic and disciplined approach to planning, performing,
supervising, reviewing and documenting its activities distinguishes the activities of the
internal audit function from other monitoring control activities that may be performed
within the entity. Factors affecting the systematic and disciplined approach are as
follows:
The existence, adequacy and use of documented internal audit procedures or
guidance covering such areas as risk assessments, work programs, documentation
and reporting, the nature and extent of which is commensurate with the size and
circumstances of an entity.
Whether the internal audit function has appropriate quality control policies and
procedures.
2.8 The more the internal audit function's organizational status and relevant policies
and procedures adequately support the objectivity of the internal auditors and the higher
the level of competence of the internal audit function, the more likely the external auditor
may make use of the work of the internal audit function and in more areas.
2.9 The external auditor's determination of the planned nature and extent of use of the
work of the internal audit function will be influenced by the external auditor's evaluation
of the extent to which the internal audit function's organizational status and relevant
policies and procedures adequately support the objectivity of the internal auditors and
the level of competence of the internal audit function.
8
2.10 Greater the judgment needed to be exercised in planning and performing the audit
procedures and evaluating the audit evidence, the external auditor will need to perform
more procedures directly. These include assessing the risk of material misstatement,
classification of risks identified, type of audit procedures to be applied, adequacy of
samples tested, items that are contingent and has significant impact on financials,
estimates etc.
2.11 For a particular account balance, class of transaction or disclosure, the higher an
assessed risk of material misstatement at the assertion level, the more judgment is
often involved in planning and performing the audit procedures and evaluating the
results thereof. In such circumstances, the external auditor will need to perform more
procedures directly and use work of internal audit function to a lesser extent.
2.12 External auditor shall have proper co-ordination with internal auditor when external
auditor plans to use the work of internal auditor. External auditor shall ensure that
discussions, meeting or interactions take place at appropriate intervals and significant
matters/observations are communicated to external auditor by internal auditor.
2.13 External auditor is advised to discuss with the internal auditor the materiality for the
financial statements as set by external auditor, nature and timing of audit procedures,
method of selecting samples and sample size and documentation.
2.14 External auditor shall evaluate whether in aggregate, using the work of internal
audit function to the extent planned still result in external auditor being sufficiently
involved in the audit as external auditor has sole responsibility for the audit opinion
expressed.
2.15 The external auditor is required to communicate with those charged with
governance an overview of the planned scope and timing of the audit. The planned use
of the work of the internal audit function is an integral part of the external auditor's
overall audit strategy and is therefore relevant to those charged with governance for
their understanding of the proposed audit approach.
2.16 External auditor shall document the following if work of internal audit function is
used:
a) The evaluation of:
(i) Whether the internal audit function's organizational status and relevant policies
and procedures adequately support the objectivity of the internal auditors;
(ii) The level of competence of the internal audit function; and
(iii) Whether the internal audit function applies a systematic and disciplined
approach, including quality control.
b) The nature and extent of the work used and the basis for that decision; and
c) The audit procedures performed by the external auditor to evaluate the adequacy of
the work used.
9
Given below are the responses on key issues of SA 610(Revised) in a
Question Answer format.
Question 7: What it means to use the work performed by internal auditor?
Response: External auditor may use the work already performed by internal auditors as
part of discharging his duties as per the terms of appointment of internal auditor.
External auditor may review, inspect the work performed by the internal auditor if found
necessary for having comfort. Whereas ultimate liability of the opinion on the financial
statements lies with the external auditor.
Example: If internal auditor has performed 100% test of details of sales and purchases
invoices as part of discharging the duties, external auditor may use the same as audit
evidence. Whereas it is recommended that external auditor may use additional
procedures for testing of sales as it has an inherent significant risk in the account
balance.
Question 8: What are the factors to be considered by external auditor for
determining whether the work of an internal auditor can be used?
Response: The external auditor shall evaluate the following factors for determining
whether to use the work of internal auditor:
(a) The extent to which the internal audit function's organizational status and relevant
policies and procedures support the objectivity of the internal auditors;
(b) The level of competence of the internal audit function; and
(c) Whether the internal audit function applies a systematic and disciplined approach,
including quality control.
Question 9: What does objectivity of internal audit function mean?
Response: Objectivity refers to the ability to perform those tasks without allowing bias,
conflict of interest or undue influence of others to override professional judgments.
Question 10: What are the factors that can affect the objectivity of the internal
audit function in using the work of internal auditors?
Response: Factors that can affect the objectivity of the internal auditor are as follows:
Whether the organizational status of the internal audit function, including the internal
audit function's authority and accountability, supports the ability of the internal audit
function to be free from bias, conflict of interest or undue influence of others to
override professional judgments. For example, whether the internal audit function
reports to those charged with governance or an officer with appropriate authority, or
if the internal audit function reports to management, whether it has direct access to
those charged with governance.
Whether the internal audit function is free of any conflicting responsibilities, for
example, having managerial or operational duties or responsibilities that are outside
10
of the internal audit function.
Whether those charged with governance oversee employment decisions related to
the internal audit function, for example, determining the appropriate remuneration
policy.
Whether there are any constraints or restrictions placed on the internal audit
function by management or those charged with governance, for example, in
communicating the internal audit function's findings to the external auditor.
Whether the internal auditors have complied with relevant professional standards
relating to objectivity, or whether their internal policies achieve the same objectives.
Question 11: What factors should an external auditor consider while evaluating
the competence of the internal audit function?
Response: Competence of the internal audit function refers to the attainment and
maintenance of knowledge and skills of the internal audit function as a whole at the
level required to enable assigned tasks to be performed diligently and in accordance
with applicable professional standards. Factors that may affect the external auditor's
determination include the following:
Whether the internal audit function is adequately and appropriately resourced
relative to the size of the entity and the nature of its operations.
Whether there are established policies for hiring, training and assigning internal
auditors to internal audit engagements.
Whether the internal auditors have adequate technical training and proficiency in
auditing. Relevant criteria that may be considered by the external auditor in making
the assessment may include, for example, the internal auditors' possession of a
relevant professional designation and experience.
Whether the internal auditors possess the required knowledge relating to the entity's
financial reporting and the applicable financial reporting framework and whether the
internal audit function possesses the necessary skills (for example, industry-specific
knowledge) to perform work related to the entity's financial statements for example,
by review of quality of internal audit reports.
Whether the internal auditors have complied with the relevant professional
standards including continuing professional development requirements.
Question 12: What are the factors to be considered for evaluating whether the
internal audit function applies a systematic and disciplined approach?
Response: Factors that may affect the external auditor's determination of whether the
internal audit function applies a systematic and disciplined approach include the
following:
The existence, adequacy and use of documented internal audit procedures or
11
guidance covering such areas as risk assessments, work programs, documentation
and reporting, the nature and extent of which is commensurate with the size and
circumstances of an entity.
Whether the internal audit function has appropriate quality control policies and
procedures, for example, such as those policies and procedures in SQC 1, "Quality
Control for Firms that Perform Audits and Reviews of Historical Financial
Information, and Other Assurance and Related Services Engagements" that would
be applicable to an internal audit function (like leadership, human resources and
engagement performance) or quality control requirements in Standards.
Question 13: Under what circumstances, the work of an internal audit function
cannot be used?
Response: The external auditor shall not use the work of the internal audit function if the
external auditor determines that:
(a) The internal audit function's organizational status and relevant policies and
procedures do not adequately support the objectivity of internal auditors;
(b) The internal audit function lacks sufficient competence; or
(c) The internal audit function does not apply a systematic and disciplined approach,
including quality control.
The external auditor's evaluation of whether the internal audit function's organizational
status and relevant policies and procedures adequately support the objectivity of the
internal auditors, the level of competence of the internal audit function, and whether it
applies a systematic and disciplined approach may indicate that the risks to the quality
of the work of the internal audit function are too significant and therefore it is not
appropriate to use any of the work of the internal audit function as audit evidence.
The above mentioned factors, i.e.; Objectivity, Competence and Systematic &
Disciplined Approach which are explained in paragraphs A5-A11 of the Standard need
to be considered individually and in aggregate because an individual factor is often not
sufficient to conclude that the work of the internal audit function cannot be used for
purposes of the audit.
Carrying out procedures in accordance with this Standard may cause the external
auditor to re-evaluate the external auditor's assessment of the risks of material
misstatement. Consequently, this may affect the external auditor's determination of
whether to use the work of the internal audit function and whether further application of
this Standard is necessary.
Question 14: What are the examples of work of the internal audit function that can
be used?
Response: Examples of work of the internal audit function that can be used by the
external auditor include the following:
12
Testing of the operating effectiveness of controls.
Substantive procedures involving limited judgment.
Observations of inventory counts.
Tracing transactions through the information system relevant to financial reporting.
Testing of compliance with regulatory requirements.
Question 15: Is there any communication required for using the work of internal
audit function?
Response: The external auditor while communicating with those charged with
governance an overview of the planned scope and timing of the audit in accordance
with SA 260(Revised), "Communication with Those Charged with Governance" is
required to communicate how the external auditor has planned to use the work of the
internal audit function.
Question 16: Can work of Internal Audit Function be used by External Auditor in
making significant judgements?
Response: The external auditor shall make all significant judgments in the audit
engagement and, to prevent undue use of the work of the internal audit function, shall
plan to use work of the internal audit function to a lesser extent and perform more work
directly.
Question 17: What are the documentations to be maintained by the external
auditor for using the work of the internal audit function?
Response: If the external auditor uses the work of the internal audit function, the external
auditor shall include in the audit documentation:
i. The evaluation of:
a. Whether the internal audit function's organizational status and relevant policies
and procedures adequately support the objectivity of the internal auditors;
b. The level of competence of the internal audit function; and
c. Whether the internal audit function applies a systematic and disciplined
approach, including quality control.
ii. The nature and extent of the work used and the basis for that decision; and
iii. The audit procedures performed by the external auditor to evaluate the adequacy of
the work used.
Part III: Using the Internal Auditors for providing Direct Assistance
2.17 External auditor shall use the internal auditor to provide direct assistance only if it
is not prohibited by law or regulation.
13
2.18 Purpose of using the internal audit function to provide direct assistance is to
reduce the overall time required for audit. Internal audit function would be in better
knowledge of concerned persons for requiring data, can liaison well with employees of
the entity as their scope of work is detailed and not just limiting to financial aspects.
Internal audit function will be in knowledge of all schedules, packs etc. (information
provided by client) for each account balance as maintained by the client and hence
would be easy to decipher and obtain adequate audit evidence in an efficient manner.
2.19 For deciding whether to use the internal auditor to provide direct assistance,
external auditor shall evaluate the existence and significance of threats to objectivity
and level of competence of the internal auditor.
2.20 Objectivity refers to the ability to perform the proposed work without allowing bias,
conflict of interest or undue influence of others to override professional judgements.
External auditor shall evaluate the following factors in evaluating the significant threats
to objectivity:
a) The extent to which the internal audit function's organizational status and relevant
policies and procedures support the objectivity of the internal auditors. (Please refer
FAQ 10)
b) Family and personal relationships with an individual working in, or responsible for,
the aspect of the entity to which the work relates.
c) Association with the division or department in the entity to which the work relates.
d) Significant financial interests in the entity other than remuneration on terms
consistent with those applicable to other employees at a similar level of seniority.
2.21 Competence of the internal auditor shall be evaluated as stated in FAQ 11. The
same shall apply while using the internal auditors to provide direct assistance.
2.22 Nature and extent of work that may be assigned to internal auditors shall be limited
to areas of minimal judgement, least assumptions made, no significant estimates
involved.
2.23 External auditor shall obtain prior written agreement from the authorised
representative of the entity that the internal auditors will be allowed to follow the external
auditor's instructions, and that the entity will not intervene in the work that the internal
auditor performs for the external auditor.
2.24 External auditor shall obtain prior written agreement from the internal auditors that
they will keep confidential specific matters as instructed by the external auditor and
inform the external auditor of any threat to their objectivity.
2.25 The external auditor shall direct, supervise and review the work performed by
internal auditors in accordance with SA 220, "Quality Control for an Audit of Financial
Statements". External auditor shall recognize that the internal auditors are not
independent of the entity while directing, supervising and reviewing the work assigned
to internal auditors. The review procedures shall include the external auditor checking
14
back to the underlying audit evidence for some of the work performed by the internal
auditors.
2.26 The direction, supervision and review by the external auditor of the work performed
by the internal auditors shall be sufficient in order for the external auditor to be satisfied
that the internal auditors have obtained sufficient appropriate audit evidence to support
the conclusions based on that work.
2.27 External auditor shall document the following if the internal auditors are used to
provide direct assistance:
a) The evaluation of the existence and significance of threats to the objectivity of the
internal auditors, and the level of competence of the internal auditors used to
provide direct assistance.
b) The basis for the decision regarding the nature and extent of the work performed by
the internal auditors.
c) Who reviewed the work performed and the date and extent of that review in
accordance with SA 230, "Audit Documentation".
d) The written agreements obtained from an authorized representative of the entity
and the internal auditors mentioned under paragraphs 2.23 and 2.24.
e) The working papers relating to planning and procedures followed in audit prepared
by the internal auditors who provided direct assistance on the audit engagement.
2.28 External auditor shall obtain and document the working papers relating to planning
and procedures followed in audit prepared by the internal audit function as external
auditor is solely responsible for the audit opinion expressed. It is hence required by the
external auditor to maintain such working papers to prove to the court of law or any
such authorities that the external auditor has performed adequate audit procedures in
arriving at the audit opinion. If the internal auditor is a Chartered Accountant, the
internal auditor will be governed by the Chartered Accountants Act 1949, and there may
be restrictions in sharing such working papers without prior consent of client. (Clause 1
of Part I of Second Schedule to the Chartered Accountants Act 1949.) Hence prior
approval from those charged with governance shall be obtained to share internal
auditor's aforesaid working papers if the internal auditor is restricted by any such law.
2.29 Examples of audit areas where internal audit function can be used to provide direct
assistance are as follows:
a) Verification and documentation of samples selected for test of controls and test of
details for substantive testing.
b) Verification and documentation of statutory remittance challans, returns, matching
with ledger etc.
c) Perform substantive analytical testing and ensuring that the differences are within
the threshold as set by external auditor.
15
d) Perform process understanding with the client for respective processes and
document the same.
e) Perform walkthrough for the process.
f) Test and document the design factors of controls identified as specified by the
Guidance Note on Audit of Internal Financial Controls over Financial Reporting.
2.30 Examples of audit areas where internal audit function cannot be used to provide
direct assistance are as follows:
a) Areas involving significant judgements including impairment of goodwill,
determination of a subsidiary by virtue of control, provisions, expected credit loss
etc.
b) Areas involving significant estimates including specific useful life for class of assets,
cash flow projections etc.
c) Obtaining external confirmation.
d) Perform discussions on fraud risks in accordance with SA 315.
e) Assessing and classification of risks identified in the entity and tailoring of
appropriate audit procedures.
Given below are the responses on key issues of SA 610(Revised) in a
Question Answer format.
Question 18: What it means to use the internal auditor for providing direct
assistance?
Response: External auditor with the permission of the entity can use the internal auditor
to provide direct assistance for purposes of the audit. External auditor may use the
internal auditor to perform assigned tasks under the direction, supervision and review of
external auditor. This does not reduce the liability of external auditor for his opinion on
the financial statements. Internal auditor shall work as per the instructions of external
auditor.
Question 19: What are the factors to be considered by external auditor for
determining whether internal auditor can be used to provide direct assistance?
Response: The external auditor shall evaluate the following factors for determining
whether internal auditor can be used to provide direct assistance:
(a) Existence and significance of threats to objectivity of internal auditors.
(b) The level of competence of the internal auditors.
Question 20: What are the factors to evaluate existence and significance of
threats to objectivity of internal auditors providing direct assistance?
Response: The factors to evaluate existence and significance of threats to objectivity of
internal auditors providing direct assistance are as follows:
16
The extent to which the internal audit function's organizational status and relevant
policies and procedures support the objectivity of the internal auditors. (Please refer
FAQ 10).
Family and personal relationships with an individual working in, or responsible for,
the aspect of the entity to which the work relates.
Association with the division or department in the entity to which the work relates.
Significant financial interests in the entity other than remuneration on terms
consistent with those applicable to other employees at a similar level of seniority.
Question 21: What factors should an external auditor consider while evaluating
the level of competence of the internal auditor for using direct assistance?
Response: In evaluating the level of competence of an internal auditor for using direct
assistance, many of the factors given in FAQ 11 may also be relevant, applied in the
context of individual internal auditors and the work to which they may be assigned.
Question 22: When shall external auditor not use internal auditor to provide direct
assistance?
Response: The external auditor shall not use internal auditor to provide direct
assistance in following instances:
Prohibition of law or regulation exists to use the internal auditor to provide direct
assistance.
There are significant threats to the objectivity of the internal auditor.
Internal auditor lacks sufficient competence to perform the proposed work.
Further, the external auditor shall not use the internal auditor to provide direct
assistance to perform procedures that:
Involve making significant judgements in the audit.
Relate to higher assessed risks of material misstatement where the judgment
required in performing the relevant audit procedures or evaluating the audit
evidence gathered is more than limited.
Relate to work with which the internal auditors have been involved and which has
already been, or will be, reported to management or those charged with governance
by the internal audit function.
Relate to decisions the external auditor makes in accordance with this Standard
regarding the internal audit function and the use of its work or direct assistance.
Question 23: What is the nature and extent of work that can be assigned to
internal auditor for providing direct assistance?
Response: External auditor shall evaluate the following factors in determining the nature
and extent of work to be assigned to internal auditors:
The amount of judgement involved in planning and performing relevant audit
17
procedures and evaluating the audit evidence gathered.
The assessed risk of material misstatement.
The external auditor's evaluation of the existence and significance of threats to the
objectivity and level of competence of the internal auditors who will be providing
such assistance.
In determining the nature of work that may be assigned to internal auditors, the external
auditor should be cautious to limit such work to those areas that would be appropriate to
be assigned. Examples of activities and tasks that would not be appropriate to use
internal auditors to provide direct assistance include the following:
Discussion of fraud risks. However, the external auditors may make inquiries of
internal auditors about fraud risks in the organization in accordance with SA 315.
Determination of unannounced audit procedures as addressed in SA 240, "The
Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements".
In accordance with SA 505, "External Confirmations", the external auditor is
required to maintain control over external confirmation requests and evaluate the
results of external confirmation procedures, accordingly, it would not be appropriate
to assign these responsibilities to internal auditors. However, internal auditors may
assist in assembling information necessary for the external auditor to resolve
exceptions in confirmation responses.
The amount of judgment involved and the risk of material misstatement are also
relevant in determining the work that may be assigned to internal auditors providing
direct assistance. For example, in circumstances where the valuation of accounts
receivable is assessed as an area of higher risk, the external auditor could assign
the checking of the accuracy of the aging to an internal auditor providing direct
assistance. However, because the evaluation of the adequacy of the provision
based on the aging would involve more than limited judgment, it would not be
appropriate to assign that latter procedure to an internal auditor providing direct
assistance.
Question 24: What is the suggested approach for an external auditor for areas
involving significant judgements?
Response: The greater the judgment needed to be exercised in planning and
performing the audit procedures and evaluating the audit evidence, the external auditor
will need to perform more procedures directly because using the work of the internal
audit function alone will not provide the external auditor with sufficient appropriate audit
evidence. Since the external auditor has sole responsibility for the audit opinion
expressed on the financial statements, the external auditor needs to make the
significant judgments in the audit engagement. Significant judgments include the
following:
Assessing the risks of material misstatement;
Evaluating the sufficiency of tests performed;
18
Evaluating the appropriateness of management's use of the going concern
assumption;
Evaluating significant accounting estimates; and
Evaluating the adequacy of disclosures in the financial statements, and other
matters affecting the auditor's report.
For a particular account balance, class of transaction or disclosure, the higher an
assessed risk of material misstatement at the assertion level, the more judgment is
often involved in planning and performing the audit procedures and evaluating the
results thereof. In such circumstances, the external auditor will need to perform more
procedures directly and accordingly, make less use of the work of the internal audit
function in obtaining sufficient appropriate audit evidence. Furthermore, as explained in
SA 200, the higher the assessed risks of material misstatement, the more persuasive
the audit evidence required by the external auditor will need to be, and, therefore, the
external auditor will need to perform more work directly.
Question 25: Is there any reporting or communication required to use the internal
auditors for providing direct assistance?
Response: External auditor shall communicate to those charged with governance about
the nature and extent of planned use of internal auditors to provide direct assistance so
as to reach mutual understanding that such use is not excessive in the circumstances of
the engagement.
Question 26: Is there any written agreement/permission required before using
internal auditors for direct assistance?
Response: Prior to using internal auditors for providing direct assistance, the external
auditor should obtain following two written agreements:
Written agreement from the authorised representative of the entity that internal
auditors will be allowed to follow the instructions of external auditor and entity will
not intervene in the work of internal audit function when providing direct assistance
to external auditor.
Written agreement from the internal auditor that they will keep confidential specific
matters as instructed by the external auditor and inform the external auditor of any
threat to their objectivity.
Question 27: Can external auditor use internal audit function to perform major
part of testing?
Response: External auditor cannot use internal audit function to perform major part of
testing.
Question 28: What are the documentations to be maintained by the external
auditor for using internal auditor to provide direct assistance?
Response: If the external auditor uses internal auditors to provide direct assistance, the
external auditor is required to include in the audit documentation the following:
19
1 The evaluation of the existence and significance of threats to the objectivity of the
internal auditors, and the level of competence of the internal auditors used to
provide direct assistance.
2 The basis for the decision regarding the nature and extent of the work performed by
internal auditor.
3 Who reviewed the work performed and the date and extent of that review in
accordance with SA 230.
4 The written agreements obtained from an authorized representative of the entity
and the internal auditors as stated in FAQ 26 above.
5 The working papers relating to planning and procedures followed in audit prepared
by the internal auditors who provided direct assistance on the audit engagement.
Question 29: What are the practical examples of areas involving significant
judgements where internal audit function cannot be used to provide direct
assistance?
Response: Some of examples of areas involving significant judgements are as follows:
a) Goodwill impairment testing/ Business valuation testing: This involves significant
amount of estimates in arriving at future cashflows, future earnings etc. There exists
significant judgement in arriving at the weighted average cost of capital (WACC),
growth rate in earning and perpetual growth rate. These factors significantly
influence the net present value of the discounted cash flow which is tested against
goodwill.
b) Management's note on different useful life as compared to Companies Act 2013 for
certain class of assets.
c) Change in accounting policy or accounting estimate.
d) Setting an overall scope of audit, procedures and adequacy of testing performed.
e) Adequacy of disclosures made in the financial statements: There exist high level of
judgements in determining whether further disclosures are to be made in financial
statements so as to give readers better understanding of financial statements.
f) In determination of a subsidiary by virtue of control by analysing the underlying facts
and circumstances.
Question 30: Whether external auditor need to or can pay any remuneration to
internal auditors for providing direct assistance?
Response: No. External auditor cannot pay any remuneration to internal auditors for
providing direct assistance because appointment of internal auditor is made by the
management of the entity and the direction to provide direct assistance to external
auditor is also provided by the management. So the question of payment of
remuneration does not arise.
20
Question 31: Whether direct assistance can be used in areas which are part of
scope of work of internal auditor?
Response: No. Direct assistance cannot be used in areas which are part of scope of
work of internal auditor as per paragraph 30(c) of the Standard.
21
Chapter 3
Illustrative Checklist
External auditor may use a checklist to analyze the work of internal audit function and in
determining the areas and the extent to which the work of the internal audit function can
be used. An Illustrative checklist has been provided below. This checklist is not an
exhaustive list. External auditor shall assess various other factors including evaluating
the audit evidence, audit procedures performed by internal auditor, considerations given
to risk identified as significant etc. while determining the extent of use of work of internal
audit function.
The external auditor has the sole responsibility for the audit opinion expressed and that
responsibility is not reduced by external auditor's use of the work of internal audit
function. Hence, the external auditor shall exercise professional judgement while
evaluating and answering the checklist given below and deciding whether to rely or not
on the work of internal audit function. It is recommended to not to rely on the work of
internal audit function if any of the checklist given below throws negative answer to the
main points.
S.No Particulars Yes/No Remarks
1. Whether Entity has an Internal audit function
If Yes:
2 Whether external auditor plans to use the work of internal
auditors?
If Yes: Move to Question 5
3. Whether external auditor plans to use the internal audit
function for providing direct assistance?
4. If Yes: move to question 36
Internal Auditor's organizational status
5. Whether internal audit function has appropriate authority to
question the employees / management?
6. Whether internal audit function is accountable to those
charged with governance?
7. Whether internal audit function is free from bias, free from
undue influence of others to override professional
judgments? Following scenario may be analyzed before
answering:
22
Whether any member of internal audit function or their
immediate family member has subscribed to company's
paid up capital?
Whether any member of internal audit function or their
immediate family member has any business transaction
with the company
Whether any member of internal audit function or their
immediate family member has taken any loan from or
granted any loan to company.
Whether any member of internal audit function or their
immediate family member has outstanding dues payable or
receivable from the company other than audit fees dues.
Whether internal audit function has unrestricted access to
books of accounts, records, vouchers etc. that are
necessary to discharge their duties.
Whether internal audit function has unrestricted access to
those charged with governance.
8. Whether organizational status of Internal audit function
support the ability of internal audit function to be free from
bias, conflict of interest or undue influence of others to
override professional judgments.
Following scenarios can be taken into consideration.
Whether organization that conducts internal audit function
is a reputed organization?
Whether any past adverse media comments, public
comments, any criminal proceedings or any action taken by
professional bodies are reported against the organization
or any managerial personal of the organization.
9. Whether the internal audit function is free of any conflicting
responsibilities in the organisation.
Whether internal audit function conducts any operational
duties or responsibilities that are outside the internal audit
function.
Whether any immediate family member of internal audit
function is employed by the company
10. Whether those charged with governance oversee
employment details related to internal audit function and
review their observations on periodic basis.
23
Whether those charged with governance is involved in
appointing internal audit function?
Whether internal audit function's scope and responsibility is
defined by those charged with governance?
If no, whether there are laid down procedures and
guidelines in selecting internal audit function which are
approved by those charged with governance.
Whether findings and observations of internal audit function
are shared with those charged with governance?
Whether any constrains or restrictions have been set by the
management or those charged with governance on internal
audit function.
Level of Competence of Internal audit function
11. Whether internal audit function possess adequate
qualifications, knowledge and skills as a whole at the level
required to enable assigned tasks.
12. Whether the internal auditors have adequate technical
training and proficiency in auditing.
13. Whether there are established policies for hiring, training
and assigning internal auditors to internal audit
engagements.
Quality of Internal audit function
14. Whether internal auditor has adequate internal audit
procedures?
15. Whether such procedures cover areas of risk assessment,
audit planning and execution, planned audit procedures,
documentation and reporting process?
16. From the view point of external auditor, whether these
procedures are adequate for the size, business and
complexity of the organization?
17. Whether planned nature and scope of work of the internal
audit function has been performed?
18. Whether the work of internal audit function is relevant to
overall audit strategy and audit plan that the external
auditor has established in accordance with SA 300,
"Planning an Audit of Financial Statements"?
24
Application of a systematic and disciplined approach
19. Whether internal auditor has in existence documented
internal audit procedures or guidance covering such areas
as risk assessments, work programs, documentation and
reporting, the nature and extent of which is commensurate
with the size and circumstances of an entity?
20. Whether the internal audit function has appropriate quality
control policies and procedures
Whether the working papers relating to planning and
procedures followed in audit are reviewed at appropriate
managerial level?
Whether internal auditor have documented set of Standard
Operating Procedures for ensuring quality
Whether history of the internal auditor prove quality
deliverables?
21. Whether internal auditor is free from any constrains set by
the management in communicating to the external auditor?
22. Whether internal audit function is cooperative in sharing
their working papers relating to planning and procedures
followed in audit, procedures performed and findings if any
23. Whether internal audit function is communicating their
significant observations during the course of their work to
external auditor directly.
24. Whether external auditor has provided direction and
thereafter supervising the work of internal audit function, if
the same is been used as substitute for obtaining audit
evidence by the external auditor
25. Whether external auditor reviewed the work done by
internal audit function, if the same is been used as
substitute for obtaining audit evidence by the external
auditor.
26. Did external auditor in writing communicate to those
charged with governance, the planned use of work of
internal audit function, scope and its timing?
27. Did external auditor perform more/ additional procedures
for areas identified as other than low risk of material
misstatements?
25
28. For areas identified as significant risks, whether external
auditor has relied on work of internal audit function only to
the extent it involves limited judgement.
29. For account balance, transaction or disclosures that has
assessed higher risk, whether external auditor has
performed significant audit procedures directly and has
involved substantially in testing the same?
30. Did external auditor hold meetings with internal auditor and
communicate to internal auditor to address the following
Areas in which the work of internal audit function will be
used
Nature and timings of procedures to be performed
Materiality and Performance materiality
Sample size and sample selection methods
Documentation of work performed
Review and reporting procedures
31. Whether discussions between internal auditor and external
auditor take place at appropriate intervals throughout the
period?
32. Whether internal auditor informs the significant matters that
can affect the internal audit function.
33. Documentation
Whether external auditor has documented the following:
The evaluation of:
(i) Whether the internal audit function's organizational
status and relevant policies and procedures adequately
support the objectivity of the internal auditors;
(ii) The level of competence of the internal audit function;
(iii) Whether the internal audit function applies a systematic
and disciplined approach, including quality control.
The nature and extent of the work used and the basis for
that decision.
The audit procedures performed by the external auditor to
evaluate the adequacy of the work used.
26
34 Whether external auditor has communicated to those
charged with governance how the external auditor has
planned to use the work of the internal audit function?
35. Whether in aggregate, using the internal auditors to provide
direct assistance to the extent planned, together with the
planned use of the work of the internal audit function, would
still result in the external auditor being sufficiently involved
in the audit?
Direct assistance from internal auditor
36 Whether it is allowable as per the laws and regulations for
external auditor to take direct assistance from internal
auditor.
37. Whether internal auditor is competent to perform the
proposed task?
38. Whether the objectivity of internal audit function is
sustained? Consider the following questionnaire to answer
the same:
Whether internal auditor has any financial interest in the
organization?
Whether there exist any family or personal relationship with
any individual working in the organization with internal
auditor.
Whether there is a restriction imposed by the management
in the scope of internal auditor.
Level of Competence of Internal audit function
39. Whether internal audit function possess adequate
qualifications, knowledge and skills as a whole at the level
required to enable assigned tasks.
40. Whether the internal auditors have adequate technical
training and proficiency in auditing.
41. Whether there are established policies for hiring, training
and assigning internal auditors to internal audit
engagements.
Nature and Extent of work
42. Whether work assigned to Internal auditors include any
significant professional judgement?
27
Whether the planning, identification and classification of
risk of material misstatement was performed by external
auditor.
Whether any matter of interpretation of law was ultimately
decided by external auditor.
Whether areas involving significant accounting estimate
were allocated to internal auditor.
43. Whether external auditor has provided adequate directions,
instructions as to the work to be performed by the internal
auditors?
44. Whether external auditor reviews the work done by the
internal auditor?
External auditor shall assume the internal auditor as not
independent and review the work along with the
appropriate documentation/audit evidence.
External auditor shall interact frequently with the internal
auditor.
External auditor shall review and consider whether audit
evidence obtained is sufficient and appropriate in the
circumstances and it supports the conclusions reached
45. Whether in aggregate, using the internal auditors to provide
direct assistance to the extent planned, together with the
planned use of the work of the internal audit function, would
still result in the external auditor being sufficiently involved
in the audit?
46. Whether a written agreement from an authorized
representative of the entity is obtained that internal auditor
will be allowed to follow the instructions set by external
auditors and entity will not intervene in the work internal
auditor performs for external auditor.
47. Whether a written agreement from the internal auditors is
obtained that they will keep confidential matters as
instructed by external auditor and inform external auditor
any threat to their objectivity.
48. Whether external auditor has directed, supervised and
reviewed the work performed by internal auditors on
engagement?
28
Documentation
49. In case the external auditor uses internal audit function to
provide direct assistance, whether external auditor's
documentation contains following:
The evaluation of the existence and significance of threats
to the objectivity of the internal auditors, and the level of
competence of the internal auditors.
The basis for the decision regarding the nature and extent
of the work performed by the internal auditor.
Who reviewed the work performed and the date and extent
of that review in accordance with SA 230.
The written agreements obtained from an authorized
representative of the entity and the internal auditors under
paragraph 33 of this Standard.
Working papers relating to planning and procedures
followed in audit prepared by the internal auditor
Conclusion / Final Comments on the above Checklist
...........................................................................
29
|