6.4 Using the Work of Internal Auditors (AU-C 610) & Specialists (AU-C 620)

6.4 Using the Work of Internal Auditors (AU-C 610) & Specialists (AU-C 620)

Core Principle: Modern audits frequently require specialized technical skills and extensive testing resources. External auditors may utilize the work of a client's internal audit function or engage outside specialists (e.g., actuaries, appraisers, geologists). However, under AU-C 610 (Using the Work of Internal Auditors) and AU-C 620 (Using the Work of an Auditor's Specialist), the external auditor has sole, undivided responsibility for the audit opinion expressed. That professional responsibility is never diminished or divided by utilizing internal auditors or specialized experts.

---

1. AU-C 610: Two Ways to Use Internal Auditors

External auditors can incorporate internal audit resources into the financial statement audit through two entirely distinct operational mechanisms:

                                  USING INTERNAL AUDITORS (AU-C 610)
                                                   |
                        +--------------------------+--------------------------+
                        |                                                     |
         [ USING THE WORK OF THE IAF ]                                [ DIRECT ASSISTANCE ]
                        |                                                     |
        Relying on prior audit work,                                  Assigning internal auditors
        internal controls testing, or                                 to perform specific audit
        substantive procedures performed                              procedures under external
        independently by internal audit                               auditor direction & supervision

1. Using the Work of the Internal Audit Function (IAF)

• The external auditor reviews, evaluates, and re-performs portions of audit procedures that the internal audit department performed as part of its regular internal audit plan during the year (e.g., testing operational controls, cycle counts, or branch reconciliations).

2. Using Internal Auditors for Direct Assistance

• The external auditor directly instructs, assigns, supervises, and reviews internal audit staff members who assist the external audit team in performing specific audit procedures (e.g., performing substantive tests of detail, assisting with inventory observations, or gathering confirmation responses).

---

2. Evaluating the Internal Audit Function: The Three Pillars

Before the external auditor can rely on the work of the internal audit function, AU-C 610 requires evaluating the function across three mandatory pillars:

+-------------------------------------------------------------------------------------------------------+
|                                THREE PILLARS OF IAF EVALUATION                                        |
|                                                                                                       |
|   1. OBJECTIVITY                        2. COMPETENCE                  3. SYSTEMATIC & DISCIPLINED    |
|   Organizational reporting status;     Professional certifications     Adherence to professional      |
|   reporting functionally to Audit      (CPA, CIA, CISA), technical     standards (IIA), documented    |
|   Committee vs. CFO; free from         training, experience, hiring    methodology, quality control,  |
|   operational responsibilities         policies, continuing education  and supervisory review         |
+-------------------------------------------------------------------------------------------------------+

Pillar 1: Objectivity (Freedom from Operational Bias)

• Reporting Hierarchy (The Decisive Factor): Objectivity is highest when the Chief Audit Executive (CAE) reports functionally directly to Those Charged With Governance (the Audit Committee) and administratively to the CEO.
• Impairments to Objectivity: Objectivity is severely compromised or destroyed if:
  • The internal audit function reports directly to the Chief Financial Officer (CFO) or Corporate Controller (the very executives whose accounting records they are evaluating).
  • Internal auditors perform operating duties, such as preparing journal entries, authorizing payments, or reconciling accounts.
  • Internal audit compensation is tied directly to company financial metrics (e.g., net income or operating earnings bonuses).

Pillar 2: Competence (Technical Proficiency)

• Evaluated by examining educational backgrounds, professional certifications (CPA, CIA - Certified Internal Auditor, CISA - Certified Information Systems Auditor), years of auditing experience, hiring and training practices, and documented performance evaluations.

Pillar 3: Systematic & Disciplined Approach

• Evaluated by determining whether the internal audit function applies structured internal audit standards (such as the Institute of Internal Auditors - IIA International Professional Practices Framework), maintains written audit manuals, operates under a documented risk assessment process, and enforces formal supervisory workpaper review and quality assurance programs.

Key Rule: If the external auditor determines that the internal audit function lacks adequate competence, lacks objectivity, or does not apply a systematic and disciplined approach, the external auditor cannot use the work of the internal audit function.

---

3. What CANNOT Be Shared or Delegated (Non-Delegable Duties)

A bedrock principle of GAAS is that the external auditor must make all significant professional judgments. The external auditor cannot delegate, assign, or share any of the following critical audit responsibilities with internal auditors:

+-------------------------------------------------------------------------------------------------------+
|                                 THE NON-DELEGABLE AUDIT DUTIES                                        |
|                                                                                                       |
|   STRICTLY RESERVED FOR EXTERNAL AUDITOR:        PERMISSIBLE PROCEDURES FOR INTERNAL AUDITORS:        |
|   - Assessing Risks of Material Misstatement     - Testing operating effectiveness of routine         |
|     (Inherent Risk and Control Risk)               internal controls (ITGCs, cash reconciliations)    |
|   - Determining Materiality (Overall,            - Substantive tests with low risk and high           |
|     Performance, Tolerable Misstatement)           objectivity (tracing vendor invoices, vouchers)    |
|   - Evaluating the Sufficiency & Appropriateness - Assisting in physical inventory observation        |
|     of audit evidence gathered                     counts and clerical tracing                        |
|   - Evaluating highly subjective estimates       - Preparing analytical schedules and confirm leads   |
|     or complex fair value calculations           - Re-performing routine mathematical calculations    |
|   - Assessing going concern uncertainties        - Examining standard documentation with clear        |
|   - Forming the ultimate audit opinion             predetermined exception criteria                   |
+-------------------------------------------------------------------------------------------------------+

---

4. Mandatory Protocols for Direct Assistance

When using internal auditors to provide direct assistance, the external auditor must satisfy strict operational prerequisites:

1. Competence & Objectivity Assessment: Evaluate the competence and objectivity of the specific individuals assigned to assist.
2. Obtain Written Agreements (Mandatory Prerequisite): Prior to commencing work, the external auditor must obtain two separate written confirmations:
   • From Authorized Management: Written acknowledgment that internal auditors will be allowed to follow the external auditor's direct instructions, and that the entity will not intervene, influence, or restrict their work.
   • From Internal Auditors: Written agreement that internal auditors will follow the external auditor's instructions, maintain confidentiality regarding audit procedures, and promptly disclose any potential conflicts of interest.
3. Direction, Supervision & Review: The external auditor must inform internal auditors of their responsibilities, the objectives of the procedures, and matters that may affect the nature, timing, and extent of testing. The external auditor must review all work performed and test some of the underlying evidence.

---

5. AU-C 620: Using the Work of an Auditor's Specialist

When an audit involves complex matters outside the traditional expertise of accounting and auditing, the auditor may utilize an auditor's specialist:

Common Specialists & Engagements

• Actuaries: Calculating pension obligations (ASC 715) or insurance loss reserves.
• Appraisers / Valuation Specialists: Valuing complex real estate, specialized equipment, intangible assets, or Level 3 financial instruments.
• Geologists / Petroleum Engineers: Estimating physical mineral, timber, oil, or gas reserves.
• Environmental Engineers: Estimating hazardous waste site remediation liabilities.
• Legal Counsel: Providing complex interpretations of statutes, contracts, or patents.

Auditor's Specialist vs. Management's Specialist

The Three Mandatory Evaluations for an Auditor's Specialist

1. Competence, Capabilities, and Objectivity: Verify credentials, professional certifications, licensing, reputation in the field, and evaluate independence and relationships that might impair objectivity.
2. Agreement on Scope and Terms: Agree with the specialist, in writing when appropriate, on: the nature, scope, and objectives of the work; respective roles and responsibilities; confidentiality; and report format.
3. Evaluating the Adequacy of Specialist Work:
   • Evaluate the reasonableness of findings and conclusions and their consistency with other audit evidence.
   • Evaluate the reasonableness of significant assumptions and methods used by the specialist.
   • Test the accuracy, completeness, and relevance of source data provided by the client to the specialist.

---

6. Audit Report Reference Rules for Specialists

The reporting rules governing specialists on the CPA AUD exam follow an absolute, strict dichotomy:

+-------------------------------------------------------------------------------------------------------+
|                                 SPECIALIST REPORTING RULES (AU-C 620)                                 |
|                                                                                                       |
|   UNMODIFIED (CLEAN) AUDIT REPORT:               MODIFIED AUDIT REPORT:                               |
|   --> NEVER REFER TO SPECIALIST                  --> MAY REFER TO SPECIALIST ONLY IF:                 |
|                                                      1. Reference is relevant to understanding the    |
|   RATIONALE:                                            reason for the modification (Qualified,      |
|   Referencing a specialist in a clean report            Adverse, or Disclaimer), AND                  |
|   misleads users into believing the opinion is       2. Report explicitly states that reference DOES   |
|   qualified or that responsibility is divided!          NOT reduce auditor's sole responsibility!     |
+-------------------------------------------------------------------------------------------------------+

1. Unmodified (Clean) Opinion -> Zero Reference

• The auditor must not refer to the work of an auditor's specialist in an unmodified audit report under any circumstances.
• Mentioning that a specialist was used creates the false impression that the auditor is qualifying the opinion, disclaiming expertise, or dividing responsibility with the expert.

2. Modified Opinion (Qualified, Adverse, or Disclaimer)

• The auditor may refer to the work of an auditor's specialist in a report containing a modified opinion, only if the reference is relevant to an understanding of the reason for the modification.
• Mandatory Explanatory Language: If reference is made, the auditor must explicitly state in the audit report that the reference does not reduce or diminish the auditor's sole responsibility for the audit opinion.