Need Tally
for Clients?

Contact Us! Here

  Tally Auditor

License (Renewal)
  Tally Gold

License Renewal

  Tally Silver

License Renewal
  Tally Silver

New Licence
  Tally Gold

New Licence
 
Open DEMAT Account with in 24 Hrs and start investing now!
« Professional Updates »
Open DEMAT Account in 24 hrs
  Auditing and Assurance Standards Board - Online Panel of Experts for addressing Bank Branch Audit related queries
 Board of Internal Audit and Management Accounting of ICAI is organizing Webinar on "Identifying Red Flags and Report Writing by Internal Auditors" - March 27,
 Revised Applicability of Peer Review Mandate (Phase II & III)
 Important Announcement - Reschedulement of Chartered Accountant Examinations, May 2024
  IMPORTANT ANNOUNCEMENT
 Extension of Last Date for Online Empanelment of Members to act as Observers for May/June 2024 Examinations up to 15th March 2024
 Empanelment of Members to act as Observers at the Examination Centres for the Chartered Accountants Examinations May/June 2024
 Guidance Note on Audit of Banks (2024 Edition)
 Issuance of SA 800 (Revised), SA 805 (Revised), SA 810 (Revised)
 Implementation Guide on Reporting on Audit Trail under Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 (Revised 2024 Edition) - (12-02-2024)
 Important Announcement for May-June 2024 CA Examinations

Implementation Guide to SA 610(Revised) issued by the Auditing and Assurance Standards Board
August, 28th 2018
Implementation Guide to Standard on Auditing
             (SA) 610(Revised)
     Using the Work of Internal Auditors




      The Institute of Chartered Accountants of India
               (Set up by an Act of Parliament)
                         New Delhi
© The Institute of Chartered Accountants of India.

All rights reserved. No part of this publication may be reproduced, stored in a retrieval
system, or transmitted, in any form, or by any means, electronic, mechanical,
photocopying, recording, or otherwise, without prior permission, in writing, from the
publisher.




Edition                    :   August 2018



Committee/                 :   Auditing and Assurance Standards Board
Department


Email                      :   aasb@icai.in


Website                    :   www.icai.org


Price                      :   Rs. 50/-




Published by               :   The Publication Department on behalf of the Institute of
                               Chartered Accountants of India, ICAI Bhawan, Post Box
                               No. 7100, Indraprastha Marg, New Delhi ­ 110 002.


Printed by                 :   Sahitya Bhawan Publications, Hospital Road, Agra 282 003
                                                                     Foreword

Standards on Auditing issued by the Institute of Chartered Accountants of India (ICAI)
are critical in ensuring and enhancing audit quality. It is essential that auditors
implement these Standards in letter and spirit in their audit engagements. The
Implementation Guides to Standards on Auditing are important resource for auditors to
understand the requirements of these Standards and also help them in their appropriate
implementation. These Guides also provide solutions to various practical problems
faced by auditors in implementing Standards on Auditing in real life audit situations.

The Auditing and Assurance Standards Board of ICAI has been issuing a number of
Implementation Guides to various Standards on Auditing for the benefit of auditors. I am
happy that the Board has brought out this Implementation Guide to Standard on
Auditing (SA) 610 (Revised), "Using the work of Internal Auditors". The Implementation
Guide has been written in an easy to understand language in the form of frequently
asked questions (FAQs) on this Standard and responses to those FAQs.

I wish to compliment CA. Shyam Lal Agarwal, Chairman, CA. Sanjay Vasudeva, Vice-
Chairman and all the members of the Auditing and Assurance Standards Board for
bringing out this Implementation Guide for the benefit of members.

I am sure that the members and other interested readers would find this Implementation
Guide useful in discharge of their professional responsibilities.




August 23, 2018                                            CA. Naveen N.D. Gupta
New Delhi                                                          President, ICAI
                                                                         Preface
Standards on Auditing issued by the Institute of Chartered Accountants of India lay
down the fundamental principles of relevant aspects of audit to be followed by auditors
in their audit engagements. It is essential that auditors understand and implement these
Standards appropriately in their audit engagements to meet the objectives of these
standards. Implementation Guides to Standards on Auditing are issued by the Auditing
and Assurance Standards Board (AASB) of ICAI to assist auditors in practical
implementation of these Standards in real life audit situations. Till date, AASB has
brought out a number of Implementation Guides.

It gives me immense pleasure to place in hands of the members, this Implementation
Guide to SA 610(Revised)," Using the work of Internal Auditors" brought out by AASB.
The Implementation Guide has been written in simple and easy to understand language
and contains detailed guidance on various issues involved in this Standard. For ease of
usage and understanding of the readers, the Implementation Guide has been written in
a "Question ­ Answer" format containing frequently asked questions (FAQs) on this
Standard and the responses to those FAQs.

I am extremely grateful to CA. Bhavani Balasubramanian, Chennai and her team for
sparing time out of their professional and personal preoccupations to write this
Implementation Guide.

I wish to express my sincere thanks to CA. Naveen N.D. Gupta, Honourable President,
ICAI and CA. Prafulla Premsukh Chhajed, Honourable Vice-President, ICAI for their
guidance and support to the activities of the Board.

I wish to also place on record, the appreciation of CA. Sanjay Vasudeva, Vice Chairman
of the Board, all Members of the Board and the Council for their suggestions, support
and guidance in finalising this Implementation Guide as well as other pronouncements
of the Board. I also wish to thank CA. Megha Saxena, Secretary, other officers and staff
of the Board for their continued co-operation.
I am confident that the Implementation Guide would be well received by the members
and other interested readers.
August 23, 2018                                              CA. Shyam Lal Agarwal
Jaipur                                                                     Chairman,
                                              Auditing and Assurance Standards Board
                                        Contents


                                          Page No.

Chapter 1   Introduction and Overview            1-3

Chapter 2   Implementation Guidance             4-20

Chapter 3   Illustrative Checklist            21-29
                                                     Chapter 1
                                     Introduction and Overview
1.1 The purpose of this Implementation Guide is to provide practical guidance on
implementation of the principles laid down in Standard on Auditing (SA) 610(Revised),
"Using the Work of Internal Auditors" (hereinafter referred as "the Standard"), issued by
the Institute of Chartered Accountants of India. The Standard is effective for audits of
financial statements for period beginning on or after April 1, 2016. It replaces SA 610,
`Using the Work of Internal Auditors' issued by ICAI in 2009.
1.2 The most significant change made by the Standard is that it specifically deals with
aspects regarding external auditors using internal auditors to provide them direct
assistance in carrying out audit procedures. The Standard provides a number of
conditions and safeguards for the external auditor in this regard. SA 610 issued in 2009
specifically provided that it does not deal with the instances where individual internal
auditors provide direct assistance to the external auditor in carrying out audit
procedures.
1.3 Applicability of the Standard This Standard does not apply if the entity does not have an internal audit function. If the entity has an internal audit function, the requirements in this Standard relating to using the work of that function do not apply if the responsibilities and activities of the internal audit function are not relevant to the audit; or based on the auditor's preliminary understanding of the internal audit function obtained as a result of procedures performed under SA 315, "Identifying and Assessing the Risks of Material Misstatement Through Understanding the Entity and Its Environment", the external auditor does not expect to use the work of the internal audit function in obtaining audit evidence. The requirements in this Standard relating to direct assistance do not apply if the external auditor does not plan to use internal auditors to provide direct assistance. In some cases, the external auditor may be prohibited, or restricted to some extent, by law or regulation from using the work of the internal audit function or using internal auditors to provide direct assistance. 1.4 External Auditor's Responsibility for the Audit Paragraph 11 of the Standard provides that the external auditor has sole responsibility for the audit opinion expressed, and that responsibility is not reduced by the external auditor's use of the work of the internal audit function or internal auditors to provide direct assistance on the engagement. This aspect is further highlighted in the Standard at various places e.g. Paragraph 18: The external auditor shall make all significant judgments in the audit engagement and, to prevent undue use of the work of the internal audit function, shall plan to use less of the work of the internal audit function and perform more of the work directly. Paragraph 19: The external auditor shall also evaluate whether, in aggregate, using the work of the internal audit function to the extent planned would still result in the external auditor being sufficiently involved in the audit, given the external auditor's sole responsibility for the audit opinion expressed. Paragraph 32: The external auditor shall evaluate whether, in aggregate, using internal auditors to provide direct assistance to the extent planned, together with the planned use of the work of the internal audit function, would still result in the external auditor being sufficiently involved in the audit, given the external auditor's sole responsibility for the audit opinion expressed. 1.5 Structure of the Standard The Standard can be broadly divided into two separate parts as under: Part 1: Using the Work of Internal Audit Function. (Paragraphs 15 to 25 and 36) Part 2: Using Internal Auditors to provide Direct Assistance. (Paragraphs 26 to 35 and 37) 1.6 Part 1: Using the Work of Internal Audit Function This part covers paragraphs 15 to 25 and 36 of this Standard along with the corresponding application guidance. This part provides the framework for the external auditor to use the work of internal audit function. The framework in broader terms is as under: First step: The external auditor needs to determine whether the external auditor can use the work of internal audit function or not. For this purpose, the external auditor needs to evaluate the internal audit function w.r.t. its 1. objectivity 2. competence and 3. systematic and disciplined approach followed. (This aspect is covered by paragraphs 15-16 of this Standard) Second Step: After deciding to use work of internal audit function, the external auditor needs to determine the nature and extent of work that can be used by external auditor. (This aspect is covered by paragraphs 17-20 of this Standard) Third step: After deciding to use work of internal audit function and also deciding nature and extent of use of that work, the external auditor needs to follow specific procedures for using the work of internal audit function which include evaluating adequacy of that work for purposes of the audit. (This aspect is covered by paragraphs 21-25 of this Standard) Paragraph 36 provides documentation requirements if the external auditor uses the work of internal audit function. 2 1.7 Part 2: Using Internal Auditors to provide Direct Assistance This part covers paragraphs 26 to 35 and 37 of this Standard along with the corresponding application guidance. This part provides the framework for external auditor to use internal auditors to provide direct assistance. The framework in broader terms is as under: First step: External auditor needs to determine whether internal auditors can be used to provide direct assistance in audit. For this purpose, the external auditor needs to evaluate the internal auditors w.r.t. 1. threats to their objectivity and 2. their level of competence. (This aspect is covered by paragraphs 26-28 of this Standard) Second Step: After deciding to use internal auditors for providing direct assistance, the external auditor needs to determine the nature and extent of work that can be assigned to internal auditors for providing direct assistance (This aspect is covered by paragraphs 29-32 of this Standard) Third step: After deciding to use internal auditor for providing direct assistance and also deciding the nature and extent of work to be assigned, the external auditor needs to obtain written representations from the entity and the internal auditors in this regard. The external auditor also needs to direct, supervise and review the work of internal auditors. (This aspect is covered by paragraphs 33-35 of this Standard) Paragraph 37 provides documentation requirements if the external auditor uses internal auditor to provide direct assistance. 3 Chapter 2 Implementation Guidance For clear understanding of readers, this Chapter is divided into 3 Parts Part I- General Section. Part II- Using the work of the internal audit function. Part III- Using the internal auditor for providing direct assistance. Part I: General Section Question 1: What is the applicability date of the Standard? Response: The Standard is applicable for audits of financial statements for periods beginning on or after 1st April 2016. Question 2: What are the different methods by which work of an internal audit function can be used by the external auditor as per the Standard? Response: The Standard provides two methods. 1. External auditor can use the work of the internal audit function or 2. External auditor can use internal auditor to provide direct assistance to external auditor. The figure given below shows broad features of these two methods: 4 The Standard sets out different sets of requirements for the external auditor in using the work of internal auditor in both methods. Question 3: Do services of internal audit rendered by a third party service providers in an entity, can also be included in the definition of internal audit function as per this Standard? Response: Activities similar to those performed by an internal audit function may be conducted by functions with other titles within an entity like concurrent auditors. Some or all of the activities of an internal audit function may also be outsourced to a third-party service provider. Neither the title of the internal audit function, nor whether it is performed by the entity or a third-party service provider, are sole determinants of whether or not the external auditor can use the work of the internal audit function. Rather, it is the nature of the activities; the extent to which the internal audit function's organizational status and relevant policies and procedures support the objectivity of the internal auditors; competence; and systematic and disciplined approach of the internal audit function that are relevant. References in this Standard to the work of the internal audit function include relevant activities of other functions or third-party service providers that have these characteristics. Question 4: What are the responsibility of external auditor in using the work of internal audit function? Response: The external auditor has sole responsibility for the audit opinion expressed, and that responsibility is not reduced by the external auditor's use of the work of the internal audit function or internal auditors to provide direct assistance on the engagement. Although they may perform audit procedures similar to those performed by the external auditor, neither the internal audit function nor the internal auditors are independent of the entity as is required of the external auditor in an audit of financial statements in accordance with SA 200, "Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with Standards on Auditing". This Standard, therefore, defines the conditions that are necessary for the external auditor to be able to use the work of internal auditors. It also defines the necessary work effort to obtain sufficient appropriate evidence that the work of the internal audit function, or internal auditors providing direct assistance, is adequate for the purposes of the audit. The requirements are designed to provide a framework for the external auditor's judgments regarding the use of the work of internal auditors to prevent over or undue use of such work. Question 5: Mention the circumstances where this Standard will not apply. Response: This Standard will not apply in the below cited circumstances: i. If the entity does not have an internal audit function. ii. If the entity has an internal audit function, the requirements in this Standard relating to using the work of that function do not apply if: a. The responsibilities and activities of the internal audit function are not relevant 5 to the audit; or b. Based on the auditor's preliminary understanding of the internal audit function obtained as a result of procedures performed under SA 315, the external auditor does not expect to use the work of the internal audit function in obtaining audit evidence. iii. If the external auditor does not plan to use internal auditors to provide direct assistance. iv. Instances where the external auditor may be prohibited, or restricted to some extent, by law or regulation from using the work of the internal audit function or using internal auditors to provide direct assistance. Question 6: What are the objectives of external auditor under this Standard? Response: The objectives of the external auditor, where the entity has an internal audit function and the external auditor expects to use the work of the internal audit function to modify the nature or timing, or reduce the extent, of audit procedures to be performed directly by the external auditor, or to use internal auditors to provide direct assistance, are as under: i. To determine whether the work of the internal audit function or direct assistance from internal auditors can be used, and if so, in which areas and to what extent; and having made that determination: ii. If using the work of the internal audit function, to determine whether that work is adequate for purposes of the audit; and iii. If using internal auditors to provide direct assistance, to appropriately direct, supervise and review their work. Part II: Using the Work of the Internal Audit Function 2.1 Internal auditor as part of discharging his duties as per scope of his appointment would have performed audit procedures. The Standard allows external auditor to use such work performed by internal auditors. The external auditor shall exercise professional judgement in determining whether the work of the internal auditor can be used for the purposes of audit and the nature and extent of work that can be used. 2.2 Examples of work of the internal audit function that can be used by the external auditor include the following: Testing of operative effectiveness of controls. Physical verification of inventory, fixed assets, spares etc. Substantive procedures involving limited judgement. Example: test of details, invoice/ agreement/MOU/prospectus documentation etc. 6 Tracing transactions through the information system relevant to financial reporting. Testing of compliance with regulatory requirements. 2.3 In the following cases, external auditor shall plan to use work of internal auditor to a lesser extent and perform more work directly: a) Areas that involve more judgement. b) Areas that have been assessed higher risk of material misstatement at assertion level. c) The less the internal audit function's organizational status and relevant policies and procedures adequately support the objectivity of the internal audit function. (Refer paragraph 2.5) d) Lower the level of competence of the internal audit function. (Refer paragraph 2.6) 2.4 External auditor shall evaluate whether the work of internal audit function can be used. Following factors shall be evaluated by external auditor for this purpose: a) The extent to which the internal audit function's organizational status and relevant policies and procedures support the objectivity of the internal auditors; (Refer paragraph 2.5) b) The level of competence of the internal audit function; and (Refer paragraph 2.6) c) Whether the internal audit function applies a systematic and disciplined approach, including quality control. (Refer paragraph 2.7) On evaluation of above factors, external auditor shall determine whether the work of internal audit function can be used or not. All the above factors which are explained in the paragraphs below shall be considered individually and in aggregate to conclude on whether to use the work of internal auditor or not. 2.5 Objectivity refers to the ability to perform those tasks without allowing bias, conflict of interest or undue influence of others to override professional judgments (Refer paragraphs A5-A7 of the Standard) External auditor shall obtain the appointment letter for internal audit function and find the scope, reporting authority, appointing authority and any constrains placed on their scope. It is recommended that those charged with governance shall oversee the appointment and internal auditor reports directly to those charged with governance. If the internal auditor reports to management, this would be considered a significant threat to the internal audit function's objectivity unless other factors such as those described in paragraphs A5 to A7 of the Standard collectively provide sufficient safeguards to reduce the threat to an acceptable level. External auditor shall also review whether any members of the engagement team of internal audit function is employed by the entity in book keeping process thereby exist conflicting responsibility. 7 As per the appointment of internal auditors, if there exist any constrain or restrictions on the internal auditor, external auditor shall not rely on work of internal auditor on such areas on which restriction applies. External auditor shall also search for any conflicting responsibilities of internal audit function in the entity. One of such example is preparation and audit of financial statements of the entity. It is recommended to perform an independent background check of the internal audit function and analyze the organizational status of the internal audit function. 2.6 Competence of the internal audit function refers to the attainment and maintenance of knowledge and skills of the internal audit function as a whole at the level required to enable assigned tasks to be performed diligently and in accordance with applicable professional Standards. (Refer paragraph A8 of the Standard) External auditor has to evaluate the competency of internal audit function before deciding to rely on the work of internal audit function. External auditor shall review the academic qualification and experience of internal audit function in the field of accounts and audit. External auditor can take comfort in the competency of internal auditors, if they have complied with the relevant professional standards, and if they possess adequate technical training and proficiency in auditing. External auditor has to evaluate whether the internal audit function is adequately and appropriately resourced relative to the size of the entity and nature of its operations. 2.7 Application of a systematic and disciplined approach to planning, performing, supervising, reviewing and documenting its activities distinguishes the activities of the internal audit function from other monitoring control activities that may be performed within the entity. Factors affecting the systematic and disciplined approach are as follows: The existence, adequacy and use of documented internal audit procedures or guidance covering such areas as risk assessments, work programs, documentation and reporting, the nature and extent of which is commensurate with the size and circumstances of an entity. Whether the internal audit function has appropriate quality control policies and procedures. 2.8 The more the internal audit function's organizational status and relevant policies and procedures adequately support the objectivity of the internal auditors and the higher the level of competence of the internal audit function, the more likely the external auditor may make use of the work of the internal audit function and in more areas. 2.9 The external auditor's determination of the planned nature and extent of use of the work of the internal audit function will be influenced by the external auditor's evaluation of the extent to which the internal audit function's organizational status and relevant policies and procedures adequately support the objectivity of the internal auditors and the level of competence of the internal audit function. 8 2.10 Greater the judgment needed to be exercised in planning and performing the audit procedures and evaluating the audit evidence, the external auditor will need to perform more procedures directly. These include assessing the risk of material misstatement, classification of risks identified, type of audit procedures to be applied, adequacy of samples tested, items that are contingent and has significant impact on financials, estimates etc. 2.11 For a particular account balance, class of transaction or disclosure, the higher an assessed risk of material misstatement at the assertion level, the more judgment is often involved in planning and performing the audit procedures and evaluating the results thereof. In such circumstances, the external auditor will need to perform more procedures directly and use work of internal audit function to a lesser extent. 2.12 External auditor shall have proper co-ordination with internal auditor when external auditor plans to use the work of internal auditor. External auditor shall ensure that discussions, meeting or interactions take place at appropriate intervals and significant matters/observations are communicated to external auditor by internal auditor. 2.13 External auditor is advised to discuss with the internal auditor the materiality for the financial statements as set by external auditor, nature and timing of audit procedures, method of selecting samples and sample size and documentation. 2.14 External auditor shall evaluate whether in aggregate, using the work of internal audit function to the extent planned still result in external auditor being sufficiently involved in the audit as external auditor has sole responsibility for the audit opinion expressed. 2.15 The external auditor is required to communicate with those charged with governance an overview of the planned scope and timing of the audit. The planned use of the work of the internal audit function is an integral part of the external auditor's overall audit strategy and is therefore relevant to those charged with governance for their understanding of the proposed audit approach. 2.16 External auditor shall document the following if work of internal audit function is used: a) The evaluation of: (i) Whether the internal audit function's organizational status and relevant policies and procedures adequately support the objectivity of the internal auditors; (ii) The level of competence of the internal audit function; and (iii) Whether the internal audit function applies a systematic and disciplined approach, including quality control. b) The nature and extent of the work used and the basis for that decision; and c) The audit procedures performed by the external auditor to evaluate the adequacy of the work used. 9 Given below are the responses on key issues of SA 610(Revised) in a Question ­ Answer format. Question 7: What it means to use the work performed by internal auditor? Response: External auditor may use the work already performed by internal auditors as part of discharging his duties as per the terms of appointment of internal auditor. External auditor may review, inspect the work performed by the internal auditor if found necessary for having comfort. Whereas ultimate liability of the opinion on the financial statements lies with the external auditor. Example: If internal auditor has performed 100% test of details of sales and purchases invoices as part of discharging the duties, external auditor may use the same as audit evidence. Whereas it is recommended that external auditor may use additional procedures for testing of sales as it has an inherent significant risk in the account balance. Question 8: What are the factors to be considered by external auditor for determining whether the work of an internal auditor can be used? Response: The external auditor shall evaluate the following factors for determining whether to use the work of internal auditor: (a) The extent to which the internal audit function's organizational status and relevant policies and procedures support the objectivity of the internal auditors; (b) The level of competence of the internal audit function; and (c) Whether the internal audit function applies a systematic and disciplined approach, including quality control. Question 9: What does objectivity of internal audit function mean? Response: Objectivity refers to the ability to perform those tasks without allowing bias, conflict of interest or undue influence of others to override professional judgments. Question 10: What are the factors that can affect the objectivity of the internal audit function in using the work of internal auditors? Response: Factors that can affect the objectivity of the internal auditor are as follows: Whether the organizational status of the internal audit function, including the internal audit function's authority and accountability, supports the ability of the internal audit function to be free from bias, conflict of interest or undue influence of others to override professional judgments. For example, whether the internal audit function reports to those charged with governance or an officer with appropriate authority, or if the internal audit function reports to management, whether it has direct access to those charged with governance. Whether the internal audit function is free of any conflicting responsibilities, for example, having managerial or operational duties or responsibilities that are outside 10 of the internal audit function. Whether those charged with governance oversee employment decisions related to the internal audit function, for example, determining the appropriate remuneration policy. Whether there are any constraints or restrictions placed on the internal audit function by management or those charged with governance, for example, in communicating the internal audit function's findings to the external auditor. Whether the internal auditors have complied with relevant professional standards relating to objectivity, or whether their internal policies achieve the same objectives. Question 11: What factors should an external auditor consider while evaluating the competence of the internal audit function? Response: Competence of the internal audit function refers to the attainment and maintenance of knowledge and skills of the internal audit function as a whole at the level required to enable assigned tasks to be performed diligently and in accordance with applicable professional standards. Factors that may affect the external auditor's determination include the following: Whether the internal audit function is adequately and appropriately resourced relative to the size of the entity and the nature of its operations. Whether there are established policies for hiring, training and assigning internal auditors to internal audit engagements. Whether the internal auditors have adequate technical training and proficiency in auditing. Relevant criteria that may be considered by the external auditor in making the assessment may include, for example, the internal auditors' possession of a relevant professional designation and experience. Whether the internal auditors possess the required knowledge relating to the entity's financial reporting and the applicable financial reporting framework and whether the internal audit function possesses the necessary skills (for example, industry-specific knowledge) to perform work related to the entity's financial statements for example, by review of quality of internal audit reports. Whether the internal auditors have complied with the relevant professional standards including continuing professional development requirements. Question 12: What are the factors to be considered for evaluating whether the internal audit function applies a systematic and disciplined approach? Response: Factors that may affect the external auditor's determination of whether the internal audit function applies a systematic and disciplined approach include the following: The existence, adequacy and use of documented internal audit procedures or 11 guidance covering such areas as risk assessments, work programs, documentation and reporting, the nature and extent of which is commensurate with the size and circumstances of an entity. Whether the internal audit function has appropriate quality control policies and procedures, for example, such as those policies and procedures in SQC 1, "Quality Control for Firms that Perform Audits and Reviews of Historical Financial Information, and Other Assurance and Related Services Engagements" that would be applicable to an internal audit function (like leadership, human resources and engagement performance) or quality control requirements in Standards. Question 13: Under what circumstances, the work of an internal audit function cannot be used? Response: The external auditor shall not use the work of the internal audit function if the external auditor determines that: (a) The internal audit function's organizational status and relevant policies and procedures do not adequately support the objectivity of internal auditors; (b) The internal audit function lacks sufficient competence; or (c) The internal audit function does not apply a systematic and disciplined approach, including quality control. The external auditor's evaluation of whether the internal audit function's organizational status and relevant policies and procedures adequately support the objectivity of the internal auditors, the level of competence of the internal audit function, and whether it applies a systematic and disciplined approach may indicate that the risks to the quality of the work of the internal audit function are too significant and therefore it is not appropriate to use any of the work of the internal audit function as audit evidence. The above mentioned factors, i.e.; Objectivity, Competence and Systematic & Disciplined Approach which are explained in paragraphs A5-A11 of the Standard need to be considered individually and in aggregate because an individual factor is often not sufficient to conclude that the work of the internal audit function cannot be used for purposes of the audit. Carrying out procedures in accordance with this Standard may cause the external auditor to re-evaluate the external auditor's assessment of the risks of material misstatement. Consequently, this may affect the external auditor's determination of whether to use the work of the internal audit function and whether further application of this Standard is necessary. Question 14: What are the examples of work of the internal audit function that can be used? Response: Examples of work of the internal audit function that can be used by the external auditor include the following: 12 Testing of the operating effectiveness of controls. Substantive procedures involving limited judgment. Observations of inventory counts. Tracing transactions through the information system relevant to financial reporting. Testing of compliance with regulatory requirements. Question 15: Is there any communication required for using the work of internal audit function? Response: The external auditor while communicating with those charged with governance an overview of the planned scope and timing of the audit in accordance with SA 260(Revised), "Communication with Those Charged with Governance" is required to communicate how the external auditor has planned to use the work of the internal audit function. Question 16: Can work of Internal Audit Function be used by External Auditor in making significant judgements? Response: The external auditor shall make all significant judgments in the audit engagement and, to prevent undue use of the work of the internal audit function, shall plan to use work of the internal audit function to a lesser extent and perform more work directly. Question 17: What are the documentations to be maintained by the external auditor for using the work of the internal audit function? Response: If the external auditor uses the work of the internal audit function, the external auditor shall include in the audit documentation: i. The evaluation of: a. Whether the internal audit function's organizational status and relevant policies and procedures adequately support the objectivity of the internal auditors; b. The level of competence of the internal audit function; and c. Whether the internal audit function applies a systematic and disciplined approach, including quality control. ii. The nature and extent of the work used and the basis for that decision; and iii. The audit procedures performed by the external auditor to evaluate the adequacy of the work used. Part III: Using the Internal Auditors for providing Direct Assistance 2.17 External auditor shall use the internal auditor to provide direct assistance only if it is not prohibited by law or regulation. 13 2.18 Purpose of using the internal audit function to provide direct assistance is to reduce the overall time required for audit. Internal audit function would be in better knowledge of concerned persons for requiring data, can liaison well with employees of the entity as their scope of work is detailed and not just limiting to financial aspects. Internal audit function will be in knowledge of all schedules, packs etc. (information provided by client) for each account balance as maintained by the client and hence would be easy to decipher and obtain adequate audit evidence in an efficient manner. 2.19 For deciding whether to use the internal auditor to provide direct assistance, external auditor shall evaluate the existence and significance of threats to objectivity and level of competence of the internal auditor. 2.20 Objectivity refers to the ability to perform the proposed work without allowing bias, conflict of interest or undue influence of others to override professional judgements. External auditor shall evaluate the following factors in evaluating the significant threats to objectivity: a) The extent to which the internal audit function's organizational status and relevant policies and procedures support the objectivity of the internal auditors. (Please refer FAQ 10) b) Family and personal relationships with an individual working in, or responsible for, the aspect of the entity to which the work relates. c) Association with the division or department in the entity to which the work relates. d) Significant financial interests in the entity other than remuneration on terms consistent with those applicable to other employees at a similar level of seniority. 2.21 Competence of the internal auditor shall be evaluated as stated in FAQ 11. The same shall apply while using the internal auditors to provide direct assistance. 2.22 Nature and extent of work that may be assigned to internal auditors shall be limited to areas of minimal judgement, least assumptions made, no significant estimates involved. 2.23 External auditor shall obtain prior written agreement from the authorised representative of the entity that the internal auditors will be allowed to follow the external auditor's instructions, and that the entity will not intervene in the work that the internal auditor performs for the external auditor. 2.24 External auditor shall obtain prior written agreement from the internal auditors that they will keep confidential specific matters as instructed by the external auditor and inform the external auditor of any threat to their objectivity. 2.25 The external auditor shall direct, supervise and review the work performed by internal auditors in accordance with SA 220, "Quality Control for an Audit of Financial Statements". External auditor shall recognize that the internal auditors are not independent of the entity while directing, supervising and reviewing the work assigned to internal auditors. The review procedures shall include the external auditor checking 14 back to the underlying audit evidence for some of the work performed by the internal auditors. 2.26 The direction, supervision and review by the external auditor of the work performed by the internal auditors shall be sufficient in order for the external auditor to be satisfied that the internal auditors have obtained sufficient appropriate audit evidence to support the conclusions based on that work. 2.27 External auditor shall document the following if the internal auditors are used to provide direct assistance: a) The evaluation of the existence and significance of threats to the objectivity of the internal auditors, and the level of competence of the internal auditors used to provide direct assistance. b) The basis for the decision regarding the nature and extent of the work performed by the internal auditors. c) Who reviewed the work performed and the date and extent of that review in accordance with SA 230, "Audit Documentation". d) The written agreements obtained from an authorized representative of the entity and the internal auditors mentioned under paragraphs 2.23 and 2.24. e) The working papers relating to planning and procedures followed in audit prepared by the internal auditors who provided direct assistance on the audit engagement. 2.28 External auditor shall obtain and document the working papers relating to planning and procedures followed in audit prepared by the internal audit function as external auditor is solely responsible for the audit opinion expressed. It is hence required by the external auditor to maintain such working papers to prove to the court of law or any such authorities that the external auditor has performed adequate audit procedures in arriving at the audit opinion. If the internal auditor is a Chartered Accountant, the internal auditor will be governed by the Chartered Accountants Act 1949, and there may be restrictions in sharing such working papers without prior consent of client. (Clause 1 of Part I of Second Schedule to the Chartered Accountants Act 1949.) Hence prior approval from those charged with governance shall be obtained to share internal auditor's aforesaid working papers if the internal auditor is restricted by any such law. 2.29 Examples of audit areas where internal audit function can be used to provide direct assistance are as follows: a) Verification and documentation of samples selected for test of controls and test of details for substantive testing. b) Verification and documentation of statutory remittance challans, returns, matching with ledger etc. c) Perform substantive analytical testing and ensuring that the differences are within the threshold as set by external auditor. 15 d) Perform process understanding with the client for respective processes and document the same. e) Perform walkthrough for the process. f) Test and document the design factors of controls identified as specified by the Guidance Note on Audit of Internal Financial Controls over Financial Reporting. 2.30 Examples of audit areas where internal audit function cannot be used to provide direct assistance are as follows: a) Areas involving significant judgements including impairment of goodwill, determination of a subsidiary by virtue of control, provisions, expected credit loss etc. b) Areas involving significant estimates including specific useful life for class of assets, cash flow projections etc. c) Obtaining external confirmation. d) Perform discussions on fraud risks in accordance with SA 315. e) Assessing and classification of risks identified in the entity and tailoring of appropriate audit procedures. Given below are the responses on key issues of SA 610(Revised) in a Question ­ Answer format. Question 18: What it means to use the internal auditor for providing direct assistance? Response: External auditor with the permission of the entity can use the internal auditor to provide direct assistance for purposes of the audit. External auditor may use the internal auditor to perform assigned tasks under the direction, supervision and review of external auditor. This does not reduce the liability of external auditor for his opinion on the financial statements. Internal auditor shall work as per the instructions of external auditor. Question 19: What are the factors to be considered by external auditor for determining whether internal auditor can be used to provide direct assistance? Response: The external auditor shall evaluate the following factors for determining whether internal auditor can be used to provide direct assistance: (a) Existence and significance of threats to objectivity of internal auditors. (b) The level of competence of the internal auditors. Question 20: What are the factors to evaluate existence and significance of threats to objectivity of internal auditors providing direct assistance? Response: The factors to evaluate existence and significance of threats to objectivity of internal auditors providing direct assistance are as follows: 16 The extent to which the internal audit function's organizational status and relevant policies and procedures support the objectivity of the internal auditors. (Please refer FAQ 10). Family and personal relationships with an individual working in, or responsible for, the aspect of the entity to which the work relates. Association with the division or department in the entity to which the work relates. Significant financial interests in the entity other than remuneration on terms consistent with those applicable to other employees at a similar level of seniority. Question 21: What factors should an external auditor consider while evaluating the level of competence of the internal auditor for using direct assistance? Response: In evaluating the level of competence of an internal auditor for using direct assistance, many of the factors given in FAQ 11 may also be relevant, applied in the context of individual internal auditors and the work to which they may be assigned. Question 22: When shall external auditor not use internal auditor to provide direct assistance? Response: The external auditor shall not use internal auditor to provide direct assistance in following instances: Prohibition of law or regulation exists to use the internal auditor to provide direct assistance. There are significant threats to the objectivity of the internal auditor. Internal auditor lacks sufficient competence to perform the proposed work. Further, the external auditor shall not use the internal auditor to provide direct assistance to perform procedures that: Involve making significant judgements in the audit. Relate to higher assessed risks of material misstatement where the judgment required in performing the relevant audit procedures or evaluating the audit evidence gathered is more than limited. Relate to work with which the internal auditors have been involved and which has already been, or will be, reported to management or those charged with governance by the internal audit function. Relate to decisions the external auditor makes in accordance with this Standard regarding the internal audit function and the use of its work or direct assistance. Question 23: What is the nature and extent of work that can be assigned to internal auditor for providing direct assistance? Response: External auditor shall evaluate the following factors in determining the nature and extent of work to be assigned to internal auditors: The amount of judgement involved in planning and performing relevant audit 17 procedures and evaluating the audit evidence gathered. The assessed risk of material misstatement. The external auditor's evaluation of the existence and significance of threats to the objectivity and level of competence of the internal auditors who will be providing such assistance. In determining the nature of work that may be assigned to internal auditors, the external auditor should be cautious to limit such work to those areas that would be appropriate to be assigned. Examples of activities and tasks that would not be appropriate to use internal auditors to provide direct assistance include the following: Discussion of fraud risks. However, the external auditors may make inquiries of internal auditors about fraud risks in the organization in accordance with SA 315. Determination of unannounced audit procedures as addressed in SA 240, "The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements". In accordance with SA 505, "External Confirmations", the external auditor is required to maintain control over external confirmation requests and evaluate the results of external confirmation procedures, accordingly, it would not be appropriate to assign these responsibilities to internal auditors. However, internal auditors may assist in assembling information necessary for the external auditor to resolve exceptions in confirmation responses. The amount of judgment involved and the risk of material misstatement are also relevant in determining the work that may be assigned to internal auditors providing direct assistance. For example, in circumstances where the valuation of accounts receivable is assessed as an area of higher risk, the external auditor could assign the checking of the accuracy of the aging to an internal auditor providing direct assistance. However, because the evaluation of the adequacy of the provision based on the aging would involve more than limited judgment, it would not be appropriate to assign that latter procedure to an internal auditor providing direct assistance. Question 24: What is the suggested approach for an external auditor for areas involving significant judgements? Response: The greater the judgment needed to be exercised in planning and performing the audit procedures and evaluating the audit evidence, the external auditor will need to perform more procedures directly because using the work of the internal audit function alone will not provide the external auditor with sufficient appropriate audit evidence. Since the external auditor has sole responsibility for the audit opinion expressed on the financial statements, the external auditor needs to make the significant judgments in the audit engagement. Significant judgments include the following: Assessing the risks of material misstatement; Evaluating the sufficiency of tests performed; 18 Evaluating the appropriateness of management's use of the going concern assumption; Evaluating significant accounting estimates; and Evaluating the adequacy of disclosures in the financial statements, and other matters affecting the auditor's report. For a particular account balance, class of transaction or disclosure, the higher an assessed risk of material misstatement at the assertion level, the more judgment is often involved in planning and performing the audit procedures and evaluating the results thereof. In such circumstances, the external auditor will need to perform more procedures directly and accordingly, make less use of the work of the internal audit function in obtaining sufficient appropriate audit evidence. Furthermore, as explained in SA 200, the higher the assessed risks of material misstatement, the more persuasive the audit evidence required by the external auditor will need to be, and, therefore, the external auditor will need to perform more work directly. Question 25: Is there any reporting or communication required to use the internal auditors for providing direct assistance? Response: External auditor shall communicate to those charged with governance about the nature and extent of planned use of internal auditors to provide direct assistance so as to reach mutual understanding that such use is not excessive in the circumstances of the engagement. Question 26: Is there any written agreement/permission required before using internal auditors for direct assistance? Response: Prior to using internal auditors for providing direct assistance, the external auditor should obtain following two written agreements: Written agreement from the authorised representative of the entity that internal auditors will be allowed to follow the instructions of external auditor and entity will not intervene in the work of internal audit function when providing direct assistance to external auditor. Written agreement from the internal auditor that they will keep confidential specific matters as instructed by the external auditor and inform the external auditor of any threat to their objectivity. Question 27: Can external auditor use internal audit function to perform major part of testing? Response: External auditor cannot use internal audit function to perform major part of testing. Question 28: What are the documentations to be maintained by the external auditor for using internal auditor to provide direct assistance? Response: If the external auditor uses internal auditors to provide direct assistance, the external auditor is required to include in the audit documentation the following: 19 1 The evaluation of the existence and significance of threats to the objectivity of the internal auditors, and the level of competence of the internal auditors used to provide direct assistance. 2 The basis for the decision regarding the nature and extent of the work performed by internal auditor. 3 Who reviewed the work performed and the date and extent of that review in accordance with SA 230. 4 The written agreements obtained from an authorized representative of the entity and the internal auditors as stated in FAQ 26 above. 5 The working papers relating to planning and procedures followed in audit prepared by the internal auditors who provided direct assistance on the audit engagement. Question 29: What are the practical examples of areas involving significant judgements where internal audit function cannot be used to provide direct assistance? Response: Some of examples of areas involving significant judgements are as follows: a) Goodwill impairment testing/ Business valuation testing: This involves significant amount of estimates in arriving at future cashflows, future earnings etc. There exists significant judgement in arriving at the weighted average cost of capital (WACC), growth rate in earning and perpetual growth rate. These factors significantly influence the net present value of the discounted cash flow which is tested against goodwill. b) Management's note on different useful life as compared to Companies Act 2013 for certain class of assets. c) Change in accounting policy or accounting estimate. d) Setting an overall scope of audit, procedures and adequacy of testing performed. e) Adequacy of disclosures made in the financial statements: There exist high level of judgements in determining whether further disclosures are to be made in financial statements so as to give readers better understanding of financial statements. f) In determination of a subsidiary by virtue of control by analysing the underlying facts and circumstances. Question 30: Whether external auditor need to or can pay any remuneration to internal auditors for providing direct assistance? Response: No. External auditor cannot pay any remuneration to internal auditors for providing direct assistance because appointment of internal auditor is made by the management of the entity and the direction to provide direct assistance to external auditor is also provided by the management. So the question of payment of remuneration does not arise. 20 Question 31: Whether direct assistance can be used in areas which are part of scope of work of internal auditor? Response: No. Direct assistance cannot be used in areas which are part of scope of work of internal auditor as per paragraph 30(c) of the Standard. 21 Chapter 3 Illustrative Checklist External auditor may use a checklist to analyze the work of internal audit function and in determining the areas and the extent to which the work of the internal audit function can be used. An Illustrative checklist has been provided below. This checklist is not an exhaustive list. External auditor shall assess various other factors including evaluating the audit evidence, audit procedures performed by internal auditor, considerations given to risk identified as significant etc. while determining the extent of use of work of internal audit function. The external auditor has the sole responsibility for the audit opinion expressed and that responsibility is not reduced by external auditor's use of the work of internal audit function. Hence, the external auditor shall exercise professional judgement while evaluating and answering the checklist given below and deciding whether to rely or not on the work of internal audit function. It is recommended to not to rely on the work of internal audit function if any of the checklist given below throws negative answer to the main points. S.No Particulars Yes/No Remarks 1. Whether Entity has an Internal audit function If Yes: 2 Whether external auditor plans to use the work of internal auditors? If Yes: Move to Question 5 3. Whether external auditor plans to use the internal audit function for providing direct assistance? 4. If Yes: move to question 36 Internal Auditor's organizational status 5. Whether internal audit function has appropriate authority to question the employees / management? 6. Whether internal audit function is accountable to those charged with governance? 7. Whether internal audit function is free from bias, free from undue influence of others to override professional judgments? Following scenario may be analyzed before answering: 22 Whether any member of internal audit function or their immediate family member has subscribed to company's paid up capital? Whether any member of internal audit function or their immediate family member has any business transaction with the company Whether any member of internal audit function or their immediate family member has taken any loan from or granted any loan to company. Whether any member of internal audit function or their immediate family member has outstanding dues payable or receivable from the company other than audit fees dues. Whether internal audit function has unrestricted access to books of accounts, records, vouchers etc. that are necessary to discharge their duties. Whether internal audit function has unrestricted access to those charged with governance. 8. Whether organizational status of Internal audit function support the ability of internal audit function to be free from bias, conflict of interest or undue influence of others to override professional judgments. Following scenarios can be taken into consideration. Whether organization that conducts internal audit function is a reputed organization? Whether any past adverse media comments, public comments, any criminal proceedings or any action taken by professional bodies are reported against the organization or any managerial personal of the organization. 9. Whether the internal audit function is free of any conflicting responsibilities in the organisation. Whether internal audit function conducts any operational duties or responsibilities that are outside the internal audit function. Whether any immediate family member of internal audit function is employed by the company 10. Whether those charged with governance oversee employment details related to internal audit function and review their observations on periodic basis. 23 Whether those charged with governance is involved in appointing internal audit function? Whether internal audit function's scope and responsibility is defined by those charged with governance? If no, whether there are laid down procedures and guidelines in selecting internal audit function which are approved by those charged with governance. Whether findings and observations of internal audit function are shared with those charged with governance? Whether any constrains or restrictions have been set by the management or those charged with governance on internal audit function. Level of Competence of Internal audit function 11. Whether internal audit function possess adequate qualifications, knowledge and skills as a whole at the level required to enable assigned tasks. 12. Whether the internal auditors have adequate technical training and proficiency in auditing. 13. Whether there are established policies for hiring, training and assigning internal auditors to internal audit engagements. Quality of Internal audit function 14. Whether internal auditor has adequate internal audit procedures? 15. Whether such procedures cover areas of risk assessment, audit planning and execution, planned audit procedures, documentation and reporting process? 16. From the view point of external auditor, whether these procedures are adequate for the size, business and complexity of the organization? 17. Whether planned nature and scope of work of the internal audit function has been performed? 18. Whether the work of internal audit function is relevant to overall audit strategy and audit plan that the external auditor has established in accordance with SA 300, "Planning an Audit of Financial Statements"? 24 Application of a systematic and disciplined approach 19. Whether internal auditor has in existence documented internal audit procedures or guidance covering such areas as risk assessments, work programs, documentation and reporting, the nature and extent of which is commensurate with the size and circumstances of an entity? 20. Whether the internal audit function has appropriate quality control policies and procedures Whether the working papers relating to planning and procedures followed in audit are reviewed at appropriate managerial level? Whether internal auditor have documented set of Standard Operating Procedures for ensuring quality Whether history of the internal auditor prove quality deliverables? 21. Whether internal auditor is free from any constrains set by the management in communicating to the external auditor? 22. Whether internal audit function is cooperative in sharing their working papers relating to planning and procedures followed in audit, procedures performed and findings if any 23. Whether internal audit function is communicating their significant observations during the course of their work to external auditor directly. 24. Whether external auditor has provided direction and thereafter supervising the work of internal audit function, if the same is been used as substitute for obtaining audit evidence by the external auditor 25. Whether external auditor reviewed the work done by internal audit function, if the same is been used as substitute for obtaining audit evidence by the external auditor. 26. Did external auditor in writing communicate to those charged with governance, the planned use of work of internal audit function, scope and its timing? 27. Did external auditor perform more/ additional procedures for areas identified as other than low risk of material misstatements? 25 28. For areas identified as significant risks, whether external auditor has relied on work of internal audit function only to the extent it involves limited judgement. 29. For account balance, transaction or disclosures that has assessed higher risk, whether external auditor has performed significant audit procedures directly and has involved substantially in testing the same? 30. Did external auditor hold meetings with internal auditor and communicate to internal auditor to address the following Areas in which the work of internal audit function will be used Nature and timings of procedures to be performed Materiality and Performance materiality Sample size and sample selection methods Documentation of work performed Review and reporting procedures 31. Whether discussions between internal auditor and external auditor take place at appropriate intervals throughout the period? 32. Whether internal auditor informs the significant matters that can affect the internal audit function. 33. Documentation Whether external auditor has documented the following: The evaluation of: (i) Whether the internal audit function's organizational status and relevant policies and procedures adequately support the objectivity of the internal auditors; (ii) The level of competence of the internal audit function; (iii) Whether the internal audit function applies a systematic and disciplined approach, including quality control. The nature and extent of the work used and the basis for that decision. The audit procedures performed by the external auditor to evaluate the adequacy of the work used. 26 34 Whether external auditor has communicated to those charged with governance how the external auditor has planned to use the work of the internal audit function? 35. Whether in aggregate, using the internal auditors to provide direct assistance to the extent planned, together with the planned use of the work of the internal audit function, would still result in the external auditor being sufficiently involved in the audit? Direct assistance from internal auditor 36 Whether it is allowable as per the laws and regulations for external auditor to take direct assistance from internal auditor. 37. Whether internal auditor is competent to perform the proposed task? 38. Whether the objectivity of internal audit function is sustained? Consider the following questionnaire to answer the same: Whether internal auditor has any financial interest in the organization? Whether there exist any family or personal relationship with any individual working in the organization with internal auditor. Whether there is a restriction imposed by the management in the scope of internal auditor. Level of Competence of Internal audit function 39. Whether internal audit function possess adequate qualifications, knowledge and skills as a whole at the level required to enable assigned tasks. 40. Whether the internal auditors have adequate technical training and proficiency in auditing. 41. Whether there are established policies for hiring, training and assigning internal auditors to internal audit engagements. Nature and Extent of work 42. Whether work assigned to Internal auditors include any significant professional judgement? 27 Whether the planning, identification and classification of risk of material misstatement was performed by external auditor. Whether any matter of interpretation of law was ultimately decided by external auditor. Whether areas involving significant accounting estimate were allocated to internal auditor. 43. Whether external auditor has provided adequate directions, instructions as to the work to be performed by the internal auditors? 44. Whether external auditor reviews the work done by the internal auditor? External auditor shall assume the internal auditor as not independent and review the work along with the appropriate documentation/audit evidence. External auditor shall interact frequently with the internal auditor. External auditor shall review and consider whether audit evidence obtained is sufficient and appropriate in the circumstances and it supports the conclusions reached 45. Whether in aggregate, using the internal auditors to provide direct assistance to the extent planned, together with the planned use of the work of the internal audit function, would still result in the external auditor being sufficiently involved in the audit? 46. Whether a written agreement from an authorized representative of the entity is obtained that internal auditor will be allowed to follow the instructions set by external auditors and entity will not intervene in the work internal auditor performs for external auditor. 47. Whether a written agreement from the internal auditors is obtained that they will keep confidential matters as instructed by external auditor and inform external auditor any threat to their objectivity. 48. Whether external auditor has directed, supervised and reviewed the work performed by internal auditors on engagement? 28 Documentation 49. In case the external auditor uses internal audit function to provide direct assistance, whether external auditor's documentation contains following: The evaluation of the existence and significance of threats to the objectivity of the internal auditors, and the level of competence of the internal auditors. The basis for the decision regarding the nature and extent of the work performed by the internal auditor. Who reviewed the work performed and the date and extent of that review in accordance with SA 230. The written agreements obtained from an authorized representative of the entity and the internal auditors under paragraph 33 of this Standard. Working papers relating to planning and procedures followed in audit prepared by the internal auditor Conclusion / Final Comments on the above Checklist ........................................................................... 29
Home | About Us | Terms and Conditions | Contact Us
Copyright 2024 CAinINDIA All Right Reserved.
Designed and Developed by Ritz Consulting