Evaluating the Internal Audit Function

The external auditor shall determine whether the work of the internal audit function can be used for purposes of the audit by evaluating the following:

1. The extent to which the internal audit function’s organisational status and relevant policies and procedures support the objectivity of the internal auditors; (Ref: Para. A5-A9)
2. The level of competence of the internal audit function; and (Ref: Para. A5-A9)
3. Whether the internal audit function applies a systematic and disciplined approach, including quality control. (Ref: Para. A10–A11)

The external auditor shall not use the work of the internal audit function if the external auditor determines that:

1. The function’s organisational status and relevant policies and procedures do not adequately support the objectivity of internal auditors;
2. The function lacks sufficient competence; or
3. The function does not apply a systematic and disciplined approach, including quality control. (Ref: Para. A12–A14)

Determining the Nature and Extent of Work of the Internal Audit Function that Can Be Used

As a basis for determining the areas and the extent to which the work of the internal audit function can be used, the external auditor shall consider the nature and scope of the work that has been performed, or is planned to be performed, by the internal audit function and its relevance to the external auditor’s overall audit strategy and audit plan.  (Ref: Para. A15–A17)

The external auditor shall make all significant judgements in the audit engagement and, to prevent undue use of the work of the internal audit function, shall plan to use less of the work of the function and perform more of the work directly: (Ref: Para. A15–A17)

1. The more judgement is involved in:
   1. Planning and performing relevant audit procedures; and
   2. Evaluating the audit evidence gathered; (Ref: Para. A18–A19)
2. The higher the assessed risk of material misstatement at the assertion level, with special consideration given to risks identified as significant; (Ref: Para. A20–A22)
3. The less the internal audit function’s organisational status and relevant policies and procedures adequately support the objectivity of the internal auditors; and
4. The lower the level of competence of the internal audit function.

The external auditor shall also evaluate whether, in aggregate, using the work of the internal audit function to the extent planned would still result in the external auditor being sufficiently involved in the audit, given the external auditor’s sole responsibility for the audit opinion expressed.  (Ref: Para. A15–A22)

The external auditor shall, in communicating with those charged with governance an overview of the planned scope and timing of the audit in accordance with ASA 260,^[7] communicate how the external auditor has planned to use the work of the internal audit function.  (Ref: Para. A23)

If the external auditor plans to use the work of the internal audit function, the external auditor shall discuss the planned use of its work with the function as a basis for co‑ordinating their respective activities. (Ref: Para. A24–A26)

The external auditor shall read the reports of the internal audit function relating to the work of the function that the external auditor plans to use to obtain an understanding of the nature and extent of audit procedures it performed and the related findings.

The external auditor shall perform sufficient audit procedures on the body of work of the internal audit function as a whole that the external auditor plans to use to determine its adequacy for purposes of the audit, including evaluating whether:

1. The work of the function had been properly planned, performed, supervised, reviewed and documented;
2. Sufficient appropriate evidence had been obtained to enable the function to draw reasonable conclusions; and
3. Conclusions reached are appropriate in the circumstances and the reports prepared by the function are consistent with the results of the work performed. (Ref: Para. A27–A30)

The nature and extent of the external auditor’s audit procedures shall be responsive to the external auditor’s evaluation of:

1. The amount of judgement involved;
2. The assessed risk of material misstatement;
3. The extent to which the internal audit function’s organisational status and relevant policies and procedures support the objectivity of the internal auditors; and
4. The level of competence of the function;^[8] (Ref: Para. A27–A29)

The external auditor shall also evaluate whether the external auditor’s conclusions regarding the internal audit function in paragraph 15 of this Auditing Standard and the determination of the nature and extent of use of the work of the function for purposes of the audit in paragraphs 18–19 of this Auditing Standard remain appropriate.

The external auditor shall not use internal auditors to provide direct assistance on the external audit engagement.

Paragraphs 26-35 have been deleted by the AUASB as the use of internal auditors to provide direct assistance is prohibited in an audit or review conducted in accordance with the Australian Auditing Standards.

[Deleted by the AUASB.  Refer Aus 1.2]^[9],^[10]

If the external auditor uses the work of the internal audit function, the external auditor shall include in the audit documentation:

1. The evaluation of:
   1. Whether the function’s organisational status and relevant policies and procedures adequately support the objectivity of the internal auditors;
   2. The level of competence of the function; and
   3. Whether the function applies a systematic and disciplined approach, including quality control;
2. The nature and extent of the work used and the basis for that decision; and
3. The audit procedures performed by the external auditor to evaluate the adequacy of the work used.

[Deleted by the AUASB.  Refer Aus 1.2]^[11]