FRC prohibits direct assistance by internal audit staff
The revised ISA 610 (UK and Ireland) Using the work of internal auditors no longer allows the use of internal auditors to provide direct assistance to the work of external auditors.
The prohibition, included in the revised International Standard on Auditing 610 (UK and Ireland) published by the Financial Reporting Council (FRC) in June 2013, is effective for audits of financial statements for periods ending on or after 15 June 2014.
Direct assistance is defined in ISA 610 as the use of internal auditors to perform audit procedures under the direction, supervision and review of the external auditor. The direct involvement of the external auditor distinguishes direct assistance from the use of the work of the internal audit function, which is not subject to direction from the external auditor and which is still allowed under the standard.
The text of ISA 610 actually contemplates, under specific circumstances, the provision of direct assistance; however, a supplementary paragraph introduced by the FRC excludes such option for UK and Ireland audits.
Reasons for the changes
The prohibition has been introduced following a public consultation and despite the disagreement of auditors and professional bodies who responded to it. The view taken by the FRC is that direct assistance to the external auditor is undertaken by individuals who are not independent of the audited entity under the ethical standards – the internal auditors are employed by the entity and may also have a financial interest in it – and therefore permitting the direct use of internal auditors would involve agreeing lower independence standards, something that would be against the generally increased expectations of stakeholders to see auditors free from threats to their independence.
The stance taken by the FRC was also compounded by the consultation results received from audit firms and accountancy bodies indicating that the actual use of direct assistance in UK and Ireland audits is limited to a small number of clients, often UK subsidiaries of US parents where direct assistance is an established practice.
However, as the FRC recognised that there would be some costs and planning issues involved by the application of the prohibition, such as the assignment of the external auditors’ own staff to specific tasks in place of the internal auditors, the effective date of enforcement has been set for periods ending on or after 15 June 2014, effectively allowing one year from the date of publication of the revised ISA 610.
Apart from the issues about the provision of direct assistance, the revised ISA 610 (UK and Ireland) allows the use by the external auditor of the work of the internal audit function as part of the audit evidence obtained. Using the work of the internal auditors modifies the timing and type and reduces the extent of the audit procedures to be performed by the external auditor. Therefore, provided that the use of the internal auditors’ work takes place in line with a sensible application of the requirements expressed in ISA 610, taking up such option may allow a more effective and economic performance of the audit.
Determining when the internal audit function can be used
In particular to determine whether the work of the internal audit function can be used, and for which areas and to what extent, the auditor should evaluate a number of aspects. The first is the status of the internal auditors within the entity and whether the policies and procedures applied support the internal auditors’ objectivity.
The level of competence of the internal audit function and whether it applies a systematic and disciplined approach need to be considered as well. For example to assess whether the internal audit function is able to operate with objectivity, ie without bias, conflict of interest or undue influence, the auditor should consider whether the function is placed under the control of management, ie it is not sufficiently independent of those whose activity it reports on.
Additionally if the internal auditors have conflicting responsibilities with their function, such as performing managerial or operational duties, or there are restrictions placed on the scope of their work, their objectivity is likely to be compromised. Where the external auditor determines that there is a lack of competence of the internal audit function, in terms of technical training, knowledge about the entity’s financial reporting and staffing, and the lack of a systematic and disciplined approach, such as documented adequate procedures, work programs and reports, they are likely to find that they are unable to use the work of internal auditors. In fact, when one of the aspects above is not satisfactory, the work of the internal audit function is less likely be appropriate as audit evidence.
Once the external auditor has determined that the work of the internal audit function can be used, they should consider whether the nature and scope of the work performed by the internal auditors is relevant to the overall audit strategy and audit plan established. For example the work of the internal audit function may be used for:
• testing of the operating effectiveness of controls
• substantive procedures involving limited judgement
• observations of stock-takes
• tracing transactions through the information system
• testing of compliance with laws and regulations.
However, in respect of audit procedures that require more judgement in terms of their planning and performance and in the evaluation of the audit evidence gathered, such as those for account balances and classes of transaction with a higher risk of material misstatement, the auditor should perform more work directly and use less of the internal audit work. The auditor should also rely on more direct work for all the procedures involving significant judgements that they need to make in the engagement including:
• evaluation of the use of going concern
• assessment of the risk of material misstatement
• evaluation of significant accounting estimates
• evaluation of tests performed
• evaluation of disclosures in the financial statements.
Furthermore, if the auditor intends to use specific work done by the internal audit function, they shall perform audit procedures on such work and evaluate whether:
• the work of the internal auditors had been properly planned, performed, supervised, reviewed and documented
• sufficient appropriate evidence was gathered to draw reasonable conclusions
• the conclusions were appropriate and the internal auditors’ reports are consistent with the results.
The procedures that the auditor may perform for such purposes will depend on the amount of judgement involved, the risk of material misstatement, the ability of the internal audit function to operate with objectivity and its level of competence and include the following:
• making inquiries of appropriate members of the internal audit function
• observing procedures performed by internal auditors
• reviewing the internal audit work programme and working papers.
Additionally ISA 610 requires re-performance of some of the work to validate the conclusions reached by the internal auditors.