II. Internal Control - Concepts and Standards - Using the Work of an Internal Audit Function Flashcards
What is an internal audit function?
“a function of an entity that performs assurance and consulting activities designed to evaluate and improve the effectiveness of the entity’s governance, risk management, and internal control processes.”
Note: GRC
What are Two Ways to Use the Work of an Internal Audit Function?
external auditor may use the internal audit function to:
- Obtain audit evidence that modifies the nature, timing, or extent of audit procedures to be performed by the external auditor.
- Provide direct assistance to the external auditor under the external auditor’s direction, supervision, and review.
Three necessary conditions before the external auditor may use the internal audit function:
- Objectivity - internal audit function’s organizational status and relevant policies and procedures must support the objectivity of the internal auditors.
- Competence - internal auditors must be competent (related to their education, experience, certification, etc.) to perform reliable work.
- Systematic and disciplined approach - I/A should use a formal and structured approach, including quality control
What factors would the independent auditor most likely consider in assessing the objectivity of an internal auditor?
If the internal audit function reports to those charged with governance (such as the audit committee), objectivity of the internal audit function is enhanced.
Internal auditing standards developed by The Institute of Internal Auditors address independence and objectivity and thus might be considered by an independent CPA in assessing the objectivity of internal auditors.
Determine the organizational level to which the internal auditors report.
Note: In other words:
When assessing the internal auditor’s objectivity, the auditor should consider
(1) the organizational status of the internal audit function; and
(2) the policies affecting the internal auditor’s objectivity about areas audited. The latter includes policies prohibiting the internal auditor from auditing areas where recently assigned.
Definition of Objectivity - internal audit function’s organizational status and relevant policies and procedures must support the objectivity of the internal auditors.
When assessing the competence of the internal auditors, an independent CPA should obtain information about the
Quality of the internal auditors’ working paper documentation.
The educational level and professional experiences of the internal auditor.
Test a sample of the transactions and balances that the internal auditors examined.
Evaluate the quality control program in effect for the internal auditors.
Examine documentary evidence of the work performed by the internal auditors.
Note: The independent auditor would consider the quality of the internal auditor’s work products, including documentation, among other matters, in evaluating the internal auditor’s competence.
In other words:
In evaluating the internal auditors’ competence, the auditor should obtain (or update) information about:
- educational level and professional experience;
- professional certification and continuing education;
- policies related to assignment of internal auditors;
- policies related to supervision and review;
- quality of work products; and
- performance evaluations.
Miller Retailing, Inc. maintains a staff of three full-time internal auditors who report directly to the controller. In planning to use the internal auditors to provide assistance in performing the audit, the independent auditor will most likely
Place limited reliance on the work performed by the internal auditors.
Why? Because of their lack of independence.
For which of the following judgments may an independent auditor share responsibility with an entity’s internal auditor who is assessed to be both competent and objective?
Materiality of misstatements
Evaluation of accounting estimates
No
No
Why?
An independent auditor may NOT share responsibility with an internal auditor in any audit judgment area, regardless of the internal auditor’s competence and objectivity.
The internal auditor’s work may be considered by the independent auditor in obtaining an understanding of the internal control structure or as evidence about material misstatements. Final judgments, however, must always be made by the independent auditor.
In assessing the competence and objectivity of an entity’s internal auditor, an independent auditor would be least likely to consider information obtained from
Analytical procedures
Why?
They are used to aid in the detection of unusual transactions, as substantive procedures, and to aid in the overall review of the financial statements.
- The results of such procedures would not provide evidence which would aid the independent auditor in assessing the competence and objectivity of the internal auditors.
An internal auditor’s work would most likely affect the nature, timing, and extent of an independent CPA’s auditing procedures when the internal auditor’s work relates to assertions about the
Existence of fixed asset additions.
Why? would provide direct evidence which could be used to restrict other audit work to be performed.
The work of internal auditors may affect the independent auditor’s
I. Procedures performed in obtaining an understanding of the internal control structure.
II. Procedures performed in assessing the risk of material misstatement.
III. Substantive procedures performed in gathering direct evidence.
Note: The internal auditors’ work may affect the independent auditors’ work in all three areas. When such work is expected to affect the audit, the independent auditor must evaluate its quality and effectiveness in order to determine the extent to which such work may be relied upon.
- Note that even when the internal auditors’ work is to be used, the independent auditor is still responsible for ensuring that sufficient, competent evidential matter is obtained to support the opinion.
- Meaning: The auditor should supervise, review, evaluate, and test the work performed by the internal auditors.
- Auditor can use the internal auditors to provide direct assistance in performing tests of controls and/or substantive procedures, subject to appropriate supervision by the auditor.
- Independent Auditor (External, NOT internal) may use the work of internal auditors in providing direct assistance to the auditor.
- Rememeber Internal Auditor lacks independence.
In connection with the examination of financial statements by an independent auditor, the client suggests that members of the internal audit staff be utilized to minimize audit costs. Which of the following tasks could most appropriately be delegated to the internal audit staff?
Preparation of schedules for negative accounts receivable responses.
Note:
The CPA may review the work of the internal auditor relating to the preparation of schedules for negative accounts receivable responses.
The company being audited has an internal auditor that is both competent and objective. The independent auditor wants to assign tasks for the internal auditor to perform. Under these circumstances, the independent auditor may
the independent auditor may allow the internal auditor to perform tests of controls, although the independent auditor must bear in mind that s/he is still ultimately responsible for the opinion and the underlying evidence.
For which of the following judgments may an independent auditor share responsibility with an entity’s internal auditor who is assessed to be both competent and objective?
Judgments about inherent and control risk always be those of the independent auditor.
note: It also requires that judgments about the materiality of misstatements, the sufficiency of tests performed, the valuation of significant accounting estimates, and other matters affecting the auditor’s report should always be those of the independent auditor.
When considering the effect of the internal auditors’ work, the CPA considers
1) the materiality of financial statement amounts,
(2) the risk of material misstatement of the assertions, and
(3) the degree of subjectivity involved in the evaluation of the audit evidence.
In comparison to the external auditor, an internal auditor is more likely to be concerned with
operational auditing, a broader concept than included in financial statement audits, is more important to the internal auditor because it includes budgets and other control devices.
When assessing internal auditors’ objectivity, an independent auditor should
Consider the policies that prohibit the internal auditors from auditing areas where they were recently assigned.
Note: they may in essence be performing a self-review of their own work.
When assessing the internal auditor’s competence, the independent CPA should obtain information about the
AU-C 610 indicates that the CPA should obtain evidence on the educational background and professional certification of the internal auditors when considering competence.
For which of the following judgments may an independent auditor share responsibility with an entity’s internal auditor who is assessed to be both competent and objective?
Materiality of misstatements
Evaluation of accounting estimates
No
No
Why?
Independent auditor responsibility cannot be shared with the internal auditors for any judgments; the responsibility to report on the financial statements rests solely with the independent auditor.
Independent auditor’s reliance on a client’s internal audit staff
An auditor assesses the organizational status of the director of internal audit as a method of addressing the function’s likely independence from management.
If the independent auditor decides that the work performed by internal auditors may have a bearing on the independent auditor’s own procedures, the independent auditor should consider the objectivity of the internal auditors. One method of judging objectivity is to
Review the recommendations made in the reports of internal auditors.
Why?
Reviewing the recommendations made in the reports of internal auditors is an important method of judging the objectivity of internal audit.
In assessing the objectivity of internal auditors, an independent auditor should
Determine the organizational level to which the internal auditors report.
Note:
when assessing the objectivity of an internal auditor the CPA should consider organizational status and policies for maintaining objectivity
The work of internal auditors may affect the independent auditor’s
The work of internal auditors may affect the nature, timing and extent of the audit, including:
(1) procedures the auditor performs when obtaining an understanding of the entity’s internal control,
(2) procedures the auditor performs when assessing risk, and
(3) substantive procedures the auditor performs.
When assessing the competence of the internal auditors, an independent CPA should obtain information about the
When assessing internal auditors’ competence, auditors consider the quality of internal auditors’ working paper documentation, as well as educational level, professional experience, professional certification, audit policies, and practices regarding assignment, supervision and performance.
During an audit an internal auditor may provide direct assistance to an independent CPA in
obtaining an understanding of internal control, in performing tests of controls, and in performing substantive tests.
In assessing the competence of internal auditors, an independent CPA most likely would obtain information about the
Quality of the internal auditors’ working paper documentation.
Note:
analytical procedures do not ordinarily provide information on the internal auditor.
If the independent auditors decide that the work performed by the internal auditor may have a bearing on their own procedures, they should consider the internal auditor’s
Competence and objectivity.
Note:
AICPA’s Professional Standards require independent auditors to consider internal auditor’s competence, objectivity, and work performance.
Which of the following factors most likely would assist an independent auditor in assessing the objectivity of the internal auditor?
The organizational status of the director of internal audit.
note:
The organizational status of the director of internal audit, and who he or she reports to (e.g., top management and the audit committee vs. the controller) impacts likely objectivity of the director.
An independent auditor asked a client’s internal auditor to assist in preparing a standard financial institution confirmation request for a payroll account that had been closed during the year under audit. After the internal auditor prepared the form, the controller signed it and mailed it to the bank. What was the major flaw in this procedure?
The form was mailed by the controller.
Why?
The auditors, not the controller, should maintain control over the mailing of the confirmations so as to assure that the confirmations are actually mailed to the financial institution.
A government internal audit function is presumed to be free from organizational independence impairments for reporting internally when the head of the organization
Head of the organization is removed from political pressures, such independence may be obtained.
Miller Retailing, Inc. maintains a staff of three full-time internal auditors who report directly to the controller. In planning to use the internal auditors to provide assistance in performing the audit, the independent auditor most likely will
Place limited reliance on the work performed by the internal auditors.
Note:
Because they are reporting to the controller here, not the audit committee so that would result in limited reliance placed uon their work.