Notesale: Turn your study into money

Document Preview

Extracts from the notes are below, to see the PDF you'll receive please use the links above

---

ISA 610 – Using the work of internal auditors
Purpose and functions of internal audit
1
...
audit,
b
...
review work
Carried out on a voluntary basis by an entity, for its own control purposes
...
The internal audit work may be carried out by
a
...
By an external accountancy firm
...
There is no regulatory or statutory requirement for internal audit; therefore an entity will only carry out internal
audit work if it considers the benefits sufficient to justify the cost
...


Note here:
 External auditor ambit of work > financial only
 Internal auditor ambit of work > financial + operational + feedback to management

The majority of these activities will be classed as operational internal audit assignments
...


Internal auditing activities will usually include one or more or the following:
1
...

 The establishment of an adequate internal control system is a responsibility of management and is an
important aspect of good corporate governance
...

 Internal audit is therefore usually given specific responsibility by management for
o reviewing internal controls,
o monitoring their operation and
o Recommending improvements via a report to the directors
...
Examination of financial and operating information
...
identify,
b
...
classify and
d
...
information or
ii
...
including detailed testing of
i
...
balances and
iii
...

3
...
This could include a review of non-financial
controls
...
Review of compliance with
a
...
regulations and
c
...
with internal requirements such as
i
...
Directives
...
Special investigations into particular areas such as suspected fraud
...
Carrying out audits into the adequacy of financial controls in specific areas of the accounting system
2
...
Auditing the adequacy of controls in the entity’s IT systems
4
...
Carrying out checks into compliance with key aspects of legal or regulatory requirements to which the entity is
subject
...

 Similarly an oil company may use internal auditors to check into compliance with health and safety
regulations at its operating sites
...
Examination and review of financial information produced by the entity
...
Special investigations, such as investigations into suspected cases of fraud within the entity
...

The justification for internal audit may come from: FOR ENTITY
1
...
Improvements in compliance with key laws and regulations, thereby reducing the risk of legal action or action by
the regulators against the entity
3
...
economy,
b
...
effectiveness of operations
There may be other benefits of internal audit
...
If the internal auditors carry out checks into the effectiveness of financial controls within the entity,
 The external auditors may decide that they can rely to some extent on the work done by internal audit
...

 If the external auditors do rely to some extent on the work of internal audit, there may be a reduction in
the external audit fee
...
The existence of an internal audit department may enhance the reputation of the entity for sound corporate
governance in the opinion of customers and investors
...

However internal auditors cannot achieve the same degree of independence as that required of the external
auditor
...

Even external firms that carry out internal audit work for a client entity may lack independence, because
o the audit work is not a regulatory requirement and
o The firm therefore relies on the client’s attitude for their future fee income
...

In order to achieve as much independence as possible it is important that the internal auditor report to the
o highest level of management, or
o To the audit committee if there is one
...


Measures to protect independence
1
...
The chief internal auditor may report to the audit committee and not to the finance director or
chief accountant
...
Deciding the scope of internal audit work
...
The scope of work carried out by the internal auditors should not be decided by the finance director or
line management responsible for the operations that might be subjected to audit
...
This is to avoid the risk that the internal auditors might be assigned to investigations of non-contentious
areas of the business
...
The scope of internal audit work should be decided by the
i
...
By the audit committee
...
Rotation of internal audit staff :
a
...

b
...

4
...

a
...

b
...


5
...

a
...

b
...

c
...


Weaknesses and limitations of internal audit
Requirement for qualification and experience
Since internal audit is not a regulatory requirement, there is no requirement for internal auditors to be professionally
qualified for the work they do (although there may be a professional institute or association of internal auditors)
...

External auditor
In contrast, the external auditor has to comply with regulations set by



government and
his professional body

Covering




technical and
professional standards and
Qualifications
...

Previous Conclusions
Arguments against having an internal audit department, referred to already, include:



the cost of having one
The problems that may arise with ensuring the independence of the internal auditors
...

This is something to bear in mind when answering ‘practical’ questions on auditing in an examination
Area / Detail
Role and
work

Internal audit
1
...

2
...


External audit
1
...

2
...


Qualification
to act

No statutory requirements –
management select a suitably
competent person to act as
internal auditor
...


Set out by statute
...
independent of the entity and
2
...

In order to give as much independence as possible
the internal auditor should therefore report to the
highest level of management
...

This ensures independence
...


Statute
...


Report to

Management
...


The shareholders
...


Fraud/Error

The internal auditor may be given specific
responsibility for investigating
suspected fraud or error by management, and he is
likely to have much lower
materiality thresholds
...


Relationship between ISA 610 and ISA 315
ISA 315 (Revised) Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its
Environment addresses: (Same as Chapter 3)




How the knowledge and experience of the internal audit function can inform the external auditor’s understanding
of
o the entity and its environment and
o Identification and assessment of risks of material misstatement
...


ISA 315 (Revised) requires:
When planning the audit the external auditor must





assess the effectiveness of the internal audit function and
Determine whether they wish to use the work of the audit client’s internal audit function
...

The effectiveness of internal audit will have a great impact on how the external auditors assess the whole control
system and the assessment of audit risk
...

This includes:



using the work of the internal audit function in obtaining audit evidence; and
using internal auditors to provide direct assistance under the
o direction,
o supervision and
o review
Of the external auditor
...
If the entity does not have an internal audit function and
2
...
The external auditor does not expect to use the work of the function in obtaining audit evidence
...
Furthermore, the requirements relating to direct assistance do not apply if the external auditor does not plan to
use internal auditors to provide direct assistance
...
g
...


However, no such restrictions apply in Pakistan
...
the work of the
a
...
direct assistance from internal auditors
Can be used,
And if so,
2
...
to what extent
And having made that determination:



if using the work of the internal audit function, to determine whether that work is adequate for purposes of the
audit; and
if using internal auditors to provide direct assistance, to appropriately
o direct,
o supervise and
o Review their work
...

A decision can then be taken as to whether the work of the internal auditors can be used as part of the evidence on which
the external audit opinion will be based
...
What is the status of the internal audit function within the entity?
2
...
Is it free of any conflicting responsibilities (e
...
any operational responsibilities)?
4
...
Are there any restrictions placed on the internal audit function?
6
...
Are the internal auditor’s members of relevant professional bodies?
2
...
Are there established policies for hiring and training internal auditors?
4
...
Is internal audit work
1) properly planned,
2) supervised,
3) reviewed and
4) documented?
2
...


Examples of work of the internal audit function that can be used by the external auditor include:
1
...

3
...

5
...


Testing of the operating effectiveness of controls;
Substantive procedures involving limited judgment;
Observations of inventory counts;
Tracing transactions through the information system relevant to financial reporting;
Testing of compliance with regulatory requirements;
In some circumstances, audits or reviews of the financial information of subsidiaries that are not significant
components to the group (where this does not conflict with the requirements of ISA 600)
...

Consider extent of use of internal auditor’s work
(What?)
As a basis for determining the areas and extent to which work of the internal audit function can be used, the external
auditor shall consider
 the nature and scope of the work that has been performed and
 its relevance to the external auditor’s overall audit strategy and audit plan
...

Matters to agree
Agreeing certain matters in advance should make it more likely that the external auditor will be able to rely on the work of
internal audit
...

the timing of such work
ii
...

the extent of audit coverage
iv
...

methods of item selection and sample sizes
vi
...

Review and reporting procedures
...

Procedures may include:
i
...

observing procedures performed by internal audit;
iii
...

Reperforming a sample of the internal audit function’s procedures to validate conclusions reached by the internal
audit function
...


Reperformance
Whilst reperformance provides more persuasive evidence regarding
 the adequacy of the work of the internal audit function compared to
 the other procedures mentioned above,
it does not necessarily need to be applied in all audit areas
...

This is more likely to be focused on areas where
 most judgment was required and/or
 in areas of higher risk of material misstatement
...

ii
...


communicate the planned use of the work of the internal audit function to
those charged with governance
for their understanding of the proposed audit approach
...

ii
...


the adequacy of the internal audit function and
its work, and
the audit procedures performed by him on that work
...


Considering the use of internal auditors to provide direct assistance
If the external auditor plans to use internal auditors to provide direct assistance on the audit (and is not prohibited from
doing so by law or regulation)




they must evaluate the
existence and
significance of threats to
o objectivity and
o the level of competence of the internal auditors who will be providing such assistance
...


No direct assistance if:
Internal auditors may not provide direct assistance if:



there are significant threats to the objectivity of the internal auditor; or
The internal auditor lacks sufficient competence to perform the proposed work
...

ii
...


iv
...
objectivity and
b
...
to provide direct assistance to the extent planned,
b
...
would still result in the external auditor being sufficiently involved in the audit,
d
...


Don’t perform such procedures
ISA 610 (Revised) prevents/precludes the use of internal audit to perform direct assistance procedures that:
i
...


iii
...


involve making significant judgments in the audit;
relate to higher assessed risks of material misstatement where the Judgment required
a
...
evaluating the audit evidence gathered
Is more than limited;
relate to work with which the internal auditors
a
...
which has already been,
c
...
management or
e
...
the external auditor makes in accordance with ISA 610 (Revised) regarding the internal audit function and
b
...
direct assistance

Communication with those charged with governance
ISA 610 (Revised) requires the external auditor to communicate




the planned use of internal audit
in providing direct assistance
To those charged with governance
...
Obtain written agreement from an authorized representative of the entity that
a
...
that the entity will not intervene in the work the internal auditor performs for the external auditor; and
2
...
they will keep confidential specific matters as instructed by the external auditor and
b
...

Direction, supervision and review
The external auditor shall direct, supervise and review the work performed by internal auditors on the engagement in
accordance with ISA 220 Quality Control for an Audit of Financial Statements
...
The nature, timing and extent of direction, supervision, and review shall recognize that
a
...
be responsive to the outcome of the evaluation of the amount of
i
...
the assessed risk of material misstatement and
iii
...
existence and
2
...
objectivity and
b
...
The review procedures shall include the external auditor checking back to the underlying audit evidence for some
of the work performed by the internal auditors
...


Alertness





In directing, supervising and reviewing the work performed by internal auditors,
the external auditor shall remain alert for indications that the external auditor’s evaluations of
the existence and significance of threats to the objectivity and level of competence of the internal auditors
providing direct assistance
Are no longer appropriate
...

2
...

4
...


The evaluation of the existence and significance of threats to the objectivity of the internal auditors, and the level
of competence of the internal auditors used to provide direct assistance;
The basis for the decision regarding the nature and extent of the work performed by the internal auditors;
Who reviewed the work performed and the date and extent of that review in accordance with ISA 230;
The written agreements obtained from an authorized representative of the entity and the internal auditors; and
The working papers prepared by the internal auditors who provided direct assistance on the audit engagement

---