1. ISA 610: Considering the work of internal auditing
The background to this ISA is particularly interesting, as it is coloured by the different ways in which internal audit is perceived.
It is becoming increasingly commonplace for entities to regard internal audit as a multi-disciplined function with an identity of its own, rather than as a branch of accountancy of the finance function. They see the scope of their work as extremely wide, and are keen to do other things besides those normally associated with external audit activities. Internal audit tends to be concerned with compliance with policies and procedures, particularly those that have been identified as important from a risk-procedures, particularly those that have been identified as important from a risk-management point of view.
External auditors regard the role and the resourcing of internal auditors as an important measure of the control environment within the entity. A strong, proactive internal audit department whose reports are taken seriously by the board suggests that the company is likely to be well managed in other ways. The extent to which the external auditor can depend directly on the work done by internal audit depends on its relevance to the external audit function as well as its quality.
2. Mutual cooperation in the work of the internal and external auditors
Modern practice acts as a bridge between these different attitudes:
·A number of the objectives of internal audit may be similar to those of external audit, and procedures similar to those carried out during an external audit may therefore be followed.
·The scope and objectives of internal audit vary widely and are dependent on the responsibilities assigned to the department by management, the size and structure of the enterprise and the skills and experience of the internal auditors.
·Where reliance is placed on the work of internal audit, the external auditors will need to take into account the internal audit’s program of work and amend the extent of their own audit work accordingly.
·The auditors may agree with management that internal audit may render them direct assistance, by performing certain procedures necessary to accomplish the objectives of the external audit, under the control of the chief internal auditor.
·A decision to provide direct assistance by substituting the work of internal audit could affect the internal audit’s own work program, and should include an assessment of the relative costs of using internal and external audit.
3. Assessment of internal audit
ISA 610 requires that the external auditors must obtain a sufficient understanding of the internal audit function to assist in the planning and development of an internal audit work. This assessment will in any case have an effect on the auditor’s assessment of control environment and audit risk. The Chartered Institute of Management Accountants in the UK have published a book on internal auditing on behalf of the accounting organizations in the UK, which is a useful detailed guide to assessing the effectiveness of internal audit. The IIA also has a professional issues bulletin which sets out the issues to be considered in deciding whether the internal audit department is leading edge, which is guide to best practice. Factors to be considered include the following:
·be free of any operating responsibility
·be able to communicate fully with the external auditor
·have an audit charter that clearly sets out their role, responsibilities and rights of access.
The scope of the internal audit function
The CIMA guidance states that internal audit should include examining and evaluating the whole system of internal controls not just the financial control. Therefore the scope should include the following:
·Corporate—business planning and corporate governance
·Financial—e.g.payroll and accounts payable
·support—such as IT and Human Resources management
·other operations, which could include marketing and research and development.
Due professional care
A judgement should be made as to whether the work of internal audit generally appears to be properly planned, controlled, recorded and reviewed as evidenced by adequate audit manuals and work programs and papers. The internal audit department should measure their value and produce reports on their performance.
The technical competence of the internal auditors
The internal audit department should be appropriately staffed in terms of numbers, grades, qualifications and experience to achieve responsibilities and objectives, The department should have the right people with the right core competencies. The external auditors should document their general assessment and conclusions, and should update their assessment year by year. In addition, they should let management know in writing of significant weaknesses in the internal audit function which come to their attention.
The relationships of the internal auditors
The internal auditor should demonstrate constructive working relationships and mutual understanding with management, with external auditors, the audit committee and other review agencies.
4. Evaluating and testing the work of internal audit
The following are recommended in respect of the situation where the external auditor decides that reliance can be placed on internal audit:
·Consideration of:
—the materiality of the areas of items to be tested, and also of the information that can be obtained from internal audit
—the level of audit risk inherent in the areas of items to be tested, or in the information to be obtained
—the level of judgement required
—the sufficiency of complementary audit evidence
—specialist skills possessed by internal audit staff
·Setting out the extent of planned reliance on internal audit, together with reasons for deciding on that extent, in a planning memorandum.
·Evaluation and testing of internal audit work by ensuring that:
—the work has been performed by those with adequate technical training and proficiency, any that assistants are properly supervised
—sufficient appropriate evidence is obtained to support the conclusions reached
—conclusions reached are appropriate and that reports are consistent with conclusions
—exceptions or unusual matters are resolved.
Some observance of internal audit procedures may be necessary as well as re-performance of internal audit procedures.
The extent of reliance by external audit should be fully documented.
The background to this ISA is particularly interesting, as it is coloured by the different ways in which internal audit is perceived.
It is becoming increasingly commonplace for entities to regard internal audit as a multi-disciplined function with an identity of its own, rather than as a branch of accountancy of the finance function. They see the scope of their work as extremely wide, and are keen to do other things besides those normally associated with external audit activities. Internal audit tends to be concerned with compliance with policies and procedures, particularly those that have been identified as important from a risk-procedures, particularly those that have been identified as important from a risk-management point of view.
External auditors regard the role and the resourcing of internal auditors as an important measure of the control environment within the entity. A strong, proactive internal audit department whose reports are taken seriously by the board suggests that the company is likely to be well managed in other ways. The extent to which the external auditor can depend directly on the work done by internal audit depends on its relevance to the external audit function as well as its quality.
2. Mutual cooperation in the work of the internal and external auditors
Modern practice acts as a bridge between these different attitudes:
·A number of the objectives of internal audit may be similar to those of external audit, and procedures similar to those carried out during an external audit may therefore be followed.
·The scope and objectives of internal audit vary widely and are dependent on the responsibilities assigned to the department by management, the size and structure of the enterprise and the skills and experience of the internal auditors.
·Where reliance is placed on the work of internal audit, the external auditors will need to take into account the internal audit’s program of work and amend the extent of their own audit work accordingly.
·The auditors may agree with management that internal audit may render them direct assistance, by performing certain procedures necessary to accomplish the objectives of the external audit, under the control of the chief internal auditor.
·A decision to provide direct assistance by substituting the work of internal audit could affect the internal audit’s own work program, and should include an assessment of the relative costs of using internal and external audit.
3. Assessment of internal audit
ISA 610 requires that the external auditors must obtain a sufficient understanding of the internal audit function to assist in the planning and development of an internal audit work. This assessment will in any case have an effect on the auditor’s assessment of control environment and audit risk. The Chartered Institute of Management Accountants in the UK have published a book on internal auditing on behalf of the accounting organizations in the UK, which is a useful detailed guide to assessing the effectiveness of internal audit. The IIA also has a professional issues bulletin which sets out the issues to be considered in deciding whether the internal audit department is leading edge, which is guide to best practice. Factors to be considered include the following:
·be free of any operating responsibility
·be able to communicate fully with the external auditor
·have an audit charter that clearly sets out their role, responsibilities and rights of access.
The scope of the internal audit function
The CIMA guidance states that internal audit should include examining and evaluating the whole system of internal controls not just the financial control. Therefore the scope should include the following:
·Corporate—business planning and corporate governance
·Financial—e.g.payroll and accounts payable
·support—such as IT and Human Resources management
·other operations, which could include marketing and research and development.
Due professional care
A judgement should be made as to whether the work of internal audit generally appears to be properly planned, controlled, recorded and reviewed as evidenced by adequate audit manuals and work programs and papers. The internal audit department should measure their value and produce reports on their performance.
The technical competence of the internal auditors
The internal audit department should be appropriately staffed in terms of numbers, grades, qualifications and experience to achieve responsibilities and objectives, The department should have the right people with the right core competencies. The external auditors should document their general assessment and conclusions, and should update their assessment year by year. In addition, they should let management know in writing of significant weaknesses in the internal audit function which come to their attention.
The relationships of the internal auditors
The internal auditor should demonstrate constructive working relationships and mutual understanding with management, with external auditors, the audit committee and other review agencies.
4. Evaluating and testing the work of internal audit
The following are recommended in respect of the situation where the external auditor decides that reliance can be placed on internal audit:
·Consideration of:
—the materiality of the areas of items to be tested, and also of the information that can be obtained from internal audit
—the level of audit risk inherent in the areas of items to be tested, or in the information to be obtained
—the level of judgement required
—the sufficiency of complementary audit evidence
—specialist skills possessed by internal audit staff
·Setting out the extent of planned reliance on internal audit, together with reasons for deciding on that extent, in a planning memorandum.
·Evaluation and testing of internal audit work by ensuring that:
—the work has been performed by those with adequate technical training and proficiency, any that assistants are properly supervised
—sufficient appropriate evidence is obtained to support the conclusions reached
—conclusions reached are appropriate and that reports are consistent with conclusions
—exceptions or unusual matters are resolved.
Some observance of internal audit procedures may be necessary as well as re-performance of internal audit procedures.
The extent of reliance by external audit should be fully documented.
