Your firm is the newly appointed external auditor to a large company that sells, maintains and leases office equipment and furniture to its customers and you have been asked to co- operate with internal audit to keep total audit costs down. The company wants the external auditors to rely on some of the work already performed internal audit.
The internal auditors provide the following services to the company:
(i) A cyclical audit of the operation of internal controls in the company‘s major functions (operations, finance, customer support and information services);
(ii) A review of the structure of internal controls in each major function every four years;
(iii) An annual review of the effectiveness of measures put in place management to minimise the major risks facing the company.
During the current year, the company has gone through a major internal restructuring in its information services function and the internal auditors have been closely involved in the preparation of plans for restructuring, and in the related post-implementation review.
a) Explain the extent to which your firm will seek to rely on the work of the internal auditors in each of the areas noted above. (6 marks)
b) Describe the information your firm will seek from the internal auditors in order for you to determine the extent of your reliance. (6 marks)
c) Describe the circumstances in which it would not be possible to rely on the work of the
internal auditors. (4 marks)
d) Explain why it will be necessary for your firm to perform its own work in certain audit areas in addition to relying on the work performed internal audit. (4 marks)
(Total: 20 marks)
(a) Reliance on work of internal auditors
(i) As requested, the external auditors will seek to rely on the work of internal audit to the maximum extent possible. This might cover planning, risk assessment, tests of controls and substantive testing.
(ii) In all cases, the external auditor should be aware that the purpose of internal audit‘s work will not be primarily directed towards the financial statements.
(iii) In relation to the audit of internal controls, it may be possible to rely on the work of internal audit in relation to all of the areas noted, but only if the internal controls audited affect the financial statements. It may be that internal audit‘s work on operations and customer support is less relevant than its work in other areas.
(iv) In relation to the four-year review of internal controls – the extent of reliance will depend on how long ago the last review was conducted. If it was conducted recently, it will provide help in relation to the external auditor‘s assessment of the accounting and internal control systems.
(v) In relation to risk management – the relevance of internal audit work depends on the extent to which risks in relation to reporting in general, and the financial statements in particular, have been addressed separately management. This work will be relevant to
the external auditor‘s risk assessment and planning
(b) Information required
(i) The information required to determine the extent of external audit reliance on internal audit‘s will be:
– Internal audit‘s systems documentation (the work on information systems and finance may include documentation of the company‘s accounting and internal control systems);
– Internal audit‘s planning documentation, which may cover a risk analysis, tests of controls and substantive procedures;
– The results of tests of control and substantive procedures;
– Documentation on the four-year review of internal controls, particularly in relation to the finance and information services functions.
(ii) The external auditors should ask to see all documentation relating to the work performed internal audit on information services restructuring during the year because the external auditor‘s assessment and testing of systems will be split into two parts, pre- and post-restructuring.
(iii) Other documentation requested will include internal audit‘s operating procedures manuals and documentation relating to the recruitment, training and development of internal audit staff, and management responses to internal audit recommendations. This information is required to enable the external auditor to form an opinion on the competence and effectiveness of the internal audit function.
(c) Circumstances in which it would not be possible to rely on the work of internal audit
(i) It may not be possible to rely on the work of internal auditors if they:
– Are not competent (this relates to experience as well as qualifications);
– Lack integrity;
– Do not properly plan or document their work, or if management does not act on (or at least respond to) recommendations made;
– Do not perform work relevant to the external auditor.
(ii) It will also not be possible to rely on internal audit if internal audit is insufficiently independent within the organisation, i.e. where internal auditors have insufficient operational freedom, where they are reporting to those who control the functions that they work on, or where they are reporting on their own work.
(d) External auditor work
(i) External auditors will wish to perform work independently, regardless of internal audit work, in all areas that are material to the financial statements. For immaterial areas in which internal audit work can be shown testing and review to be adequate, it may be possible to rely on the work of internal audit without performing any other work.
(ii) Areas material to the financial statements are likely to be long and short-term leasing receivables and inventory. Leases may be complex and the auditors will wish to ensure that accounting policies are appropriate and that they have been properly applied. The valuation of inventory will have a direct effect on the profit for the period. This is an area that is easy to manipulate and external auditors will wish to ensure that this has not happened.
(iii) External auditors will also wish to perform their own risk analysis and final review of financial statements in order to ensure that no high risk areas have been overlooked.