When the internal audit function of an entity is outsourced to an internal audit provider, or where personnel from the internal audit provider are seconded to an internal audit client, and the audit working papers belong to the internal audit provider, the external auditor may seek access to the entity’s internal audit working papers to gain an understanding of relevant internal auditing activities that are relevant to the audit or review of the financial report. In such circumstances, the following matters may be considered:

1. the external auditor seeking access to the internal auditor’s audit working papers needs to comply with the requirements and guidance in Auditing Standard ASA 610 Considering the Work of Internal Audit. This includes acknowledging that an understanding of the audit client’s internal control structure and subsequent assessment of audit risk, gained from the review of the internal auditor’s audit working papers, are based solely on the external auditor’s professional judgement; and
2. generally, internal audit working papers prepared by an internal audit provider will not be released for review by the external auditor until after the related internal audit report is finalised and/or has been tabled with the Audit Committee (or equivalent governing body), subject to the terms of the outsourcing arrangement.