Internal audit can give a statutory auditor valuable knowledge about processes, controls and recurring risk areas, but an external auditor cannot simply adopt internal audit conclusions as a substitute for their own work. SA 610 (Revised), Using the Work of Internal Auditors, sets the framework for deciding whether internal audit work can be used, how much can be used, and what the external auditor must do before relying on it.
ICAI lists Revised SA 610 in its current Engagement and Quality Control Standards collection. The detailed requirements are in the official SA 610 (Revised) text.
What SA 610 actually allows
SA 610 deals with two different ways internal auditors may contribute to an external audit: the external auditor may use work already performed by the internal audit function as audit evidence, and, where permitted, may use internal auditors to provide direct assistance under the external auditor's direction, supervision and review. These are not the same arrangement and should be planned separately.
Nothing in SA 610 requires an external auditor to use internal audit work. The decision remains part of the external auditor's overall audit strategy. Most importantly, using internal auditors does not transfer responsibility for the audit opinion. The external auditor remains solely responsible for that opinion.
First question: is the internal audit function usable?
Before deciding which internal audit reports might help, the external auditor evaluates the function itself. Three considerations are central.
- Objectivity: consider the internal audit function's organisational status, relevant policies and whether threats to objectivity are adequately addressed.
- Competence: consider whether the function collectively has the knowledge, skills and experience needed to perform its work appropriately.
- Systematic and disciplined approach: consider whether internal audit applies a structured approach, including quality control.
If the function's organisational status and policies do not adequately support objectivity, it lacks sufficient competence, or it does not apply a systematic and disciplined approach, the external auditor should not use its work for purposes of the external audit.
How to decide how much internal audit work to use
Passing the function-level assessment does not mean every internal audit assignment is suitable for reliance. The external auditor must decide the nature and extent of work that can be used while avoiding undue use of internal audit.
The more judgment an audit area requires, the higher the assessed risk of material misstatement, and the weaker the internal audit function's objectivity or competence, the more work should be performed directly by the external auditor. Significant judgments in the audit remain with the external auditor.
Practical example
Assume internal audit tested routine purchase-order controls throughout the year and documented samples, exceptions and follow-up. If the external auditor evaluates the function positively and finds the specific work suitable, parts of that work may contribute to audit evidence. By contrast, the external auditor should be much more cautious about reducing direct work in an area involving a significant accounting estimate with high estimation uncertainty, because that area involves greater judgment and risk.
Evaluate the specific work before using it
The external auditor should coordinate with internal audit regarding planned use of its work and read the relevant internal audit reports. The external auditor then performs sufficient audit procedures on the body of work intended to be used to determine whether it is adequate for the external audit.
The evaluation should address whether the work was properly planned, performed, supervised, reviewed and documented; whether sufficient appropriate evidence was obtained to support the conclusions; whether the conclusions are appropriate in the circumstances; and whether reports are consistent with the work performed.
Re-performance is an important part of this evaluation. It gives the external auditor direct evidence about the quality of internal audit's work rather than relying only on descriptions of the process.
Direct assistance is a separate decision
Direct assistance means internal auditors perform audit procedures under the external auditor's direction, supervision and review. Before using direct assistance, the external auditor evaluates threats to the individual internal auditors' objectivity and their competence. Direct assistance must not be used where law or regulation prohibits it.
The external auditor also needs to keep judgment-heavy and higher-risk work appropriately within the external audit team. Internal auditors providing direct assistance should not be assigned procedures involving significant judgments in the audit or work in areas where relevant threats to objectivity are more than low, subject to the detailed requirements of SA 610.
Where direct assistance is used, SA 610 requires appropriate written agreements from an authorised representative of the entity and from the internal auditors before they provide that assistance. The external auditor must direct, supervise and review their work.
A practical SA 610 decision framework
- Understand the function: use the audit-planning understanding of internal audit, its role, reporting lines, scope and activities.
- Assess usability: evaluate objectivity, competence, and whether the function follows a systematic and disciplined approach.
- Map relevant work: identify internal audit assignments that overlap with financial-statement risks and planned external audit procedures.
- Apply a judgment-and-risk filter: retain more direct external-auditor work where judgment or assessed risk is higher.
- Inspect the work: read reports and examine the underlying planning, testing, evidence, review and conclusions.
- Test quality: perform procedures, including re-performance, on the body of internal audit work proposed for use.
- Conclude on use: decide exactly what work will contribute to audit evidence and how it changes the nature, timing or extent of external audit procedures.
- Handle direct assistance separately: assess individual objectivity and competence, legal permissibility, written agreements, assignments, supervision and review.
- Document the rationale: preserve the assessments, work evaluated, procedures performed and conclusions reached.
Common mistakes
- Assuming that having an internal audit department automatically permits reliance on all its work.
- Looking only at professional qualifications while ignoring reporting lines and threats to objectivity.
- Using internal audit work in high-judgment areas merely to reduce external audit effort.
- Reading an internal audit report without inspecting or testing the underlying work.
- Confusing use of completed internal audit work with direct assistance.
- Allowing reliance on internal audit to dilute the external auditor's responsibility for significant judgments and the audit opinion.
Documentation checklist
A strong audit file should make the reasoning visible. Record the evaluation of the internal audit function's objectivity, competence and systematic approach; the nature and extent of work selected for use and the basis for that decision; the external auditor's procedures on that work; and conclusions on adequacy. Where direct assistance is used, document the evaluation of the individuals involved, the basis for the nature and extent of their work, who reviewed it, and the external auditor's procedures on that work.
Practical takeaway
SA 610 is not a shortcut for outsourcing the statutory audit. It is a controlled framework for using relevant internal audit capability without surrendering external-auditor judgment or responsibility. Start with the quality and position of the internal audit function, reduce reliance as judgment and risk increase, independently evaluate the specific work you plan to use, and treat direct assistance as a separately controlled arrangement.
