By: Brad Johnson, CPA, MS
For audits of financial statements for periods ending on or after December 15, 2014, CPA firms will encounter a number of significant changes when faced with the question of using the work of internal auditors, based upon the requirements of recently issued Statement on Auditing Standard 128.
The concept of a “systematic and disciplined approach” is introduced. AU-C 610.14 says that the external auditor “should not use the work of the internal audit function in obtaining audit evidence” if the external auditor determines that the internal audit “function does not apply a systematic and disciplined approach, including quality control.”
In addition, the SAS sections AU-C 610.15-32 say that the internal audit function may be used by the external auditor:
- to obtain audit evidence
- to provide direct assistance
Before the external auditor uses the internal audit function to obtain audit evidence, the external auditor should review the function’s organizational status, level of competence, and its application of a systematic and disciplined approach, including quality control. (AU-C 610.06) If the external auditor desires to use the internal audit function to provide direct assistance, the external auditor should evaluate any threats to the objectivity of the internal auditors as well as their competence. If the external auditor uses the work of the internal audit function, the extent of use should be communicated to those charged with governance. This is in addition to obtaining written acknowledgment from management about the internal auditor taking direction from the external auditor. The external auditor should perform procedures on the work of the internal auditors to insure that they are adequately planned, performed and documented and that sufficient appropriate evidence was obtained. In addition, the external auditor should re-perform a portion of the internal auditor’s work. Finally, the external auditor “should read the reports of the internal audit function which relate to the work of the function the external auditor plans to use” as part of its review process.
SAS 128 supersedes SAS 65, The Auditor’s Consideration of the Internal Audit Function in an Audit of Financial Statements; in addition SAS 128 amends certain sections of SAS 122 and Statement on Quality Control Standards No.8, a Firm’s System of Quality Control.
Key definitions included in SAS 128 are: (AU-C 610.12):
- Direct assistance: The use of internal auditors to perform audit procedures under the direction, supervision, and review of the external auditor.
- Internal audit function: A function of an entity that performs assurance and consulting activities designed to evaluate and improve the effectiveness of the entity’s governance, risk management, and internal control processes.
Statement on Quality Control Standards No. 8 was amended by SAS 128 to redefine the term “engagement team.” Under SAS 128, “engagement team” excludes members of the internal audit function, even if the internal auditors are used by the external auditor.
Before the conclusion of the audit, the external auditor should evaluate whether the external auditor’s conclusion pre audit about using the internal auditor remains valid.
If an external auditor uses the work of the internal audit function, certain workpaper documentation should be obtained in accordance with AU-C 610.33. The documentation should include the results of the evaluation of the internal audit function, the audit procedures performed by the external auditor to evaluate the adequacy of the work used, among other procedures.
It is important to note that the external auditor is not required to use the internal audit function. The SAS does not apply if the internal audit function is not relevant to the audit or if the external auditor does not expect to use the work of the internal audit function.
Brad Johnson, CPA, MS, is an auditor with the CPA firm Minor, Anglin & Associates, PA, in Durham. He is a member of two NCACPA committees—Accounting & Attestation and Not for Profit. He has over twenty years of experience in private industry as a controller and CFO.