October 2008

Basis for Conclusions: ISA 610 (Redrafted), Using the Work of Internal Auditors Prepared by the Staff of the International Auditing and Assurance Standards Board

BASIS FOR CONCLUSIONS: ISA 610 (REDRAFTED), USING THE WORK OF INTERNAL AUDITORS This Basis for Conclusions has been prepared by staff of the International Auditing and Assurance Standards Board (IAASB). It relates to, but does not form part of, ISA 610 (Redrafted), “Using the Work of Internal Auditors,” which was approved by the IAASB in June 2008.1

Background 1.

In September 2006, the IAASB agreed the conventions to be used in drafting future International Standards on Auditing (ISAs). These conventions are commonly referred to as the IAASB’s Clarity conventions.2

2.

The IAASB has undertaken to redraft all of its ISAs in accordance with the Clarity conventions. This approach responds to the desire for all ISAs to be consistently drafted, and subject to a single statement of their authority and effect. The IAASB has agreed, in response to the general call for the Clarity project to be completed within a reasonable time, that while a significant number of the ISAs are under substantive revision as well as redrafting to reflect the new conventions, others will be subject to a limited redrafting to reflect only the conventions and matters of clarity generally. ISA 610 is in the latter category.

3.

The IAASB issued an exposure draft of proposed ISA 610 (Redrafted) (ED-ISA 610) in December 2006, with a comment date of March 31, 2007. The IAASB received forty-eight comment letters from a variety of respondents, including IFAC member bodies, national standard setters, firms, regulators, government authorities and others. Input was also received from IFAC’s Small and Medium Practices Committee. The IAASB made changes to ED-ISA 610 in response to these comments. In addition, the IAASB discussed significant issues in the development of ED-ISA 610, and the finalization of ISA 610 (Redrafted), with its Consultative Advisory Group (CAG). The CAG raised no significant concerns about the proposed treatment of these issues with the IAASB.

4.

This Basis for Conclusions explains the more significant issues raised by respondents on ED-ISA 610, and how the IAASB has addressed them. In general, ED-ISA 610 received support from respondents in terms of how the extant ISA had been redrafted in accordance with the IAASB’s Clarity conventions. However, a number of respondents, including some of those who expressed support for the redrafting, expressed the view that ISA 610 is in

1

2

See minutes of the June 16-20, 2008 IAASB meeting at http://www.ifac.org/IAASB/MeetingFileDL.php?FID=4272. The IAASB’s Clarity conventions, and the authority and obligation attaching to them, are established in ISA 200 (Revised and Redrafted), “Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with International Standards on Auditing,” which was approved by the IAASB in June 2008 for submission to the Public Interest Oversight Board for its confirmation of due process.

PREPARED BY STAFF OF THE IAASB

1

BASIS FOR CONCLUSIONS: ISA 610 (REDRAFTED)

need of a full revision at a future date. This is allowed for in the IAASB’s future work program.3

Obtaining an Understanding of the Internal Audit Function 5.

Paragraph 6 of ED-ISA 610 stated: The objective of the external auditor is to obtain an understanding of the internal audit function and determine whether the activities of the internal audit function are relevant to planning and performing the audit and, if relevant, the effect on the procedures performed by the external auditor.

6.

Paragraph 7 of ED-ISA 610 stated: The external auditor shall obtain an understanding of the internal audit function in conjunction with obtaining an understanding of internal control (as required by ISA 315 (Redrafted), “Identifying and Assessing the Risks of Material Misstatement Through Understanding the Entity and Its Environment”). The understanding obtained by the auditor shall include an understanding of the organizational status of the internal audit function and the scope of the internal audit function’s responsibilities.

7.

A number of aspects of these paragraphs caused concern, with one common theme evident in respondents’ comments: ED-ISA 610 is unclear in regard to the relationship between it and ISA 315 (Redrafted) and the extent of the understanding of the internal audit function that the external auditor is required to obtain under the respective ISAs, and whether or not the external auditor is obliged to use the work of internal auditors.

8.

Some respondents, for example, noted that the understanding of the entity and its internal control required by ISA 315 (Redrafted) subsumes an understanding of the entity’s use of an internal audit function. Further, no understanding that meets the requirements of ISA 315 (Redrafted) could fail to omit an understanding of the organizational status and scope of responsibilities of the internal audit function. Accordingly, it was questioned why it is necessary to include the external auditor’s understanding of the internal audit function as part of the objective and requirements of ED-ISA 610.

9.

Some respondents expressed concern that the objective implies that the external auditor must use the work of internal auditors when the activities of the internal audit function are relevant to planning and performing the audit. This implication, were it valid, would not be consistent with the extant ISA. Further, some felt that the linkage between the objective and requirements was unclear.

10.

Some respondents also were of the view that ED-ISA 610 did not adequately explain whether and how the work performed in accordance with paragraph 7 is, or could be, used by the external auditor to determine whether the work of the internal audit function is likely to be relevant to the external auditor’s work. Others noted that the distinction between the

3

The IAASB’s Strategy and Work Program, 2009-2011 is available on the IFAC website at http://www.ifac.org/Store/Details.tmpl?SID=1216051339304536 .

PREPARED BY STAFF OF THE IAASB

2

BASIS FOR CONCLUSIONS: ISA 610 (REDRAFTED)

flow of work involved in gaining an understanding of the internal audit function and performing further audit procedures is not clear. IAASB Decision 11.

12.

The IAASB concluded that these concerns could be resolved, and the overall clarity of the ISA improved, through the following principal changes: •

ISA 315 (Redrafted) was amended to require that the external auditor obtain an understanding of the principal responsibilities and activities of the internal audit function to determine whether it is likely to be relevant to the audit. Related application material in ED-ISA 610 relevant to the required understanding was transferred to, or repeated in, ISA 315 (Redrafted). Paragraph 7 of ED-ISA 610 also was deleted. See conforming amendments in paragraphs 22a and A96b-A96c of ISA 315 (Redrafted).

•

ISA 315 (Redrafted) also was amended to make clear the meaning of the phrase “[likely to be] relevant to the audit.”. The conforming amendments in paragraph A96a of ISA 315 (Redrafted) state that the internal audit function is [likely to be] relevant to the audit when its responsibilities and activities are related to the entity’s financial reporting, and the external auditor expects to use the work of the internal auditors to modify the nature or timing, or reduce the extent, of audit procedures to be performed by the external auditor.

•

The scope and objective of ED-ISA 610, and related application material, were amended to make clear that ISA 610 (Redrafted) is applicable in regard to the work of internal auditors where the entity has an internal audit function that the external auditor, in accordance with ISA 315 (Redrafted), has determined is likely to be relevant to the audit. See paragraphs 1, 6 and A1 of ISA 610 (Redrafted).

•

ED-ISA 610 was amended to emphasize that the external auditor’s responsibilities regarding the work of internal auditors is in relation to determining whether, and to what extent, to use specific work of internal auditors and, if so, whether such work is adequate for the purposes of the audit. Further, guidance was introduced to explain that carrying out procedures in accordance with ISA 610 (Redrafted) may cause the external auditor to re-evaluate the external auditor’s determination of the relevance of the internal audit function to the audit, or the external auditor’s decision to otherwise use the work of internal auditors to affect the nature, timing or extent of the external auditor’s procedures. In such circumstances, the external auditor’s further application of ISA 610 may not be necessary. See paragraphs 6 and 8, and A2, respectively, of ISA 610 (Redrafted).

The IAASB believes that the above clarification has several benefits. First, it improves the logical flow of the respective ISAs. It makes clear the responsibilities of the external auditor in achieving the objective stated in ISA 315 (Redrafted), and provides greater prominence to those aspects of the internal audit function that should be understood for purposes of informing the external auditor’s assessment of risks and determination of the planned audit approach.

PREPARED BY STAFF OF THE IAASB

3

BASIS FOR CONCLUSIONS: ISA 610 (REDRAFTED)

13.

Second, it clarifies the concept of when ISA 610 (Redrafted) is, or is not, applicable in the circumstances of the engagement. It explains the key factor in determining whether ISA 610 (Redrafted) applies – being when the external auditor determines that the internal audit function is likely to be relevant to the audit – and how this determination is made. The phrase “relevant to the audit” is used in extant ISA 610 to indicate the basis for when the ISA is applicable, but the concept is never explained.

14.

Finally, it clarifies the relationship between ISA 315 (Redrafted) and ISA 610 (Redrafted), and the objective and requirements of ISA 610 (Redrafted), and acknowledges the fact that the audit evidence gathering process is a continuous and dynamic process. It allows the external auditor to consider matters that affect the external auditor’s determination of whether, in fact, the internal audit function is [likely to be] relevant to the audit, including whether it remains appropriate to expect to use the work of internal auditors to affect the nature, timing or extent of the external auditor’s procedures, while retaining the need for the external auditor to determine that the work is adequate for the purposes of the audit.

Definitions 15.

Extant ISA 610 includes references to “internal auditor” and “internal auditing.” In ED-ISA 610, these references were changed to “internal audit function,” and the extant definition of “internal auditing” was deleted accordingly.

16.

Several respondents were of the view that a definition of “internal audit function” is necessary to the consistent and proper application of the ISA. A respondent also noted that ED-ISA 610 is confusing since its uses the term “internal audit function” interchangeably to refer to both the activities of the function and the individuals performing the work.

17.

A few respondents suggested that the IAASB adopt the definition of “internal auditing” contained in The International Standards for the Professional Practice of Internal Auditing issued by The Institute of Internal Auditors (IIA). That definition states: “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”

IAASB Decision 18.

The IAASB concluded that the clarity of the ISA would be enhanced by defining both “internal audit function” and “internal auditors,” and thereby allowing greater precision in the drafting to refer to one or the other in the appropriate context.

19.

The IAASB used the definitions of “internal auditing” in the extant Glossary of Terms in the Handbook of International Auditing, Assurance, and Ethics Pronouncements published by IFAC as the basis for the definition of “internal audit function” in paragraph 7(a) of ISA 610 (Redrafted). The IAASB did not accept the suggestion to use the definition promulgated by the IIA for purposes of the ISAs. That definition includes reference to internal auditing as an “independent activity.” While the internal audit function can achieve a level of objectivity and autonomy, the IAASB is of the view that internal auditors are

PREPARED BY STAFF OF THE IAASB

4

BASIS FOR CONCLUSIONS: ISA 610 (REDRAFTED)

employed or engaged by the entity and responsible to those charged with governance and management and, accordingly, cannot be considered independent of the entity. 20.

In formulating the definition for the term “internal auditors” in paragraph 7(b) of ISA 610 (Redrafted), the IAASB believes that extant ISA 610 applies not only to traditional internal auditors, but also to those individuals who perform the activities or functions of an internal auditor. These individuals will not always be referred to as “internal auditors,” (e.g., a compliance function); nevertheless, the role these individuals play in the organization is important to the external auditor’s consideration of risk assessment and the determination of the nature, timing and extent of procedures to be performed. Accordingly, the IAASB determined that the definition of internal auditors in ISA 610 (Redrafted) should include the phrase “or equivalent function” to encompass such individuals.

Evaluation of the Internal Auditor’s Work 21.

Paragraph 11 of ED-ISA 610 (which is an elevation of the text of paragraph 17 of extant ISA 610) stated: When evaluating specific work performed by the internal audit function, the external auditor shall consider the adequacy of the scope of work and whether the evaluation of the internal audit function remains appropriate. The external auditor shall evaluate whether:

22.

(a)

The work is performed by persons having appropriate skills and expertise;

(b)

The work is properly supervised, reviewed and documented;

(c)

Sufficient appropriate audit evidence is obtained to be able to draw reasonable conclusions;

(d)

Conclusions reached are appropriate in the circumstances and any reports prepared are consistent with the results of the work performed; and

(e)

Any exceptions or unusual matters disclosed by the internal audit function are properly resolved.

Some respondents did not support the treatment of the material in paragraph 17 of the extant ISA 610 as a requirement. They were of the view that the material is more appropriately characterized as application material to the requirement in paragraph 10 of ED-ISA 610, which required the auditor to perform procedures to evaluate the adequacy of the internal auditors’ work. Other respondents, however, expressed support for the proposed requirement in paragraph 11 of ED-ISA 610.

IAASB Decision 23.

The IAASB is of the view that the external auditor’s evaluation of the specific aspects of the internal auditor’s work identified in the proposed requirement is important in determining whether the external auditor should, in fact, use specific work of the internal auditors. Accordingly, the IAASB concluded that the requirement should be retained in ISA 610 (Redrafted). See paragraph 12 of ISA 610 (Redrafted).

PREPARED BY STAFF OF THE IAASB

5

BASIS FOR CONCLUSIONS: ISA 610 (REDRAFTED)

Testing of the Internal Auditor’s Work 24.

Paragraph A11 of ED-ISA 610 provided guidance as to how the external auditor might test the work of internal auditors. Some respondents suggested that this material be specified as a requirement. In contrast, other respondents expressly supported the position in ED-ISA 610 that there not be a requirement for the external auditor to test a portion of the work of internal auditors.

IAASB Decision 25.

The IAASB re-affirmed its view that there should be some flexibility allowed for the external auditor to determine the procedures to be performed rather than mandating the reperformance, examination or observation procedures specified in paragraph A11 of EDISA 610. Accordingly, the IAASB retained this material as guidance in paragraph A6 of ISA 610 (Redrafted). Nevertheless, the IAASB redrafted the guidance by aligning it more closely with the wording in extant ISA 610, as some respondents were of the view that the wording proposed in ED-ISA 610 appeared to suggest that the auditor should be testing the work of the internal auditors which is only one possible way of obtaining assurance about its adequacy.

Documentation 26.

Several respondents expressed concern that ED-ISA 610 did not contain a documentation requirement despite the fact that paragraph 19 of extant ISA 610 states: “The external auditor would record conclusions regarding the specific internal auditing work that has been evaluated and the audit procedures performed on the internal auditor’s work.”

IAASB Decision 27.

The IAASB concluded that a specific audit documentation requirement in ISA 610 (Redrafted) in respect of the above matters is appropriate to promote consistency in the application of the general requirements of ISA 230 (Redrafted),4 and that it would be consistent with the intent of extant ISA 610. See paragraph 13 of ISA 610 (Redrafted).

Revision of ISA 610 and the Need for Additional Requirements or Guidance 28.

Several respondents indicated that the ISA requires a full revision by the IAASB. Among other reasons, these respondents believe that further consideration should be given to expanding the scope of the ISA to cover circumstances where internal auditors are used to provide direct assistance to the external auditor, and to address other revisions necessary to reflect the current internal auditing environment.

29.

In addition, various suggestions were received from respondents for additional requirements or guidance in the ISA, for example to establish a requirement that the auditor assess any negative information it has learned of, or obtained from, the internal audit function in the auditor’s risk assessment, irrespective of whether the auditor expects to use the work of the internal audit function.

4

ISA 230 (Redrafted), “Audit Documentation.”

PREPARED BY STAFF OF THE IAASB

6

BASIS FOR CONCLUSIONS: ISA 610 (REDRAFTED)

IAASB Decision 30.

The IAASB considered that these suggestions would introduce requirements or guidance that would go beyond a clarity redraft of the extant ISA. Accordingly, the IAASB determined that the suggestions should not be acted upon at this time. However, taking account of this and other input obtained, the IAASB concluded that a full revision of ISA 610 (Redrafted) should be included in the IAASB Strategy and Work Program, 2009-2011.

PREPARED BY STAFF OF THE IAASB

7