Understanding and Preliminary AssessmentUnderstanding and Preliminary Assessment of Internal Audit

Understanding and Preliminary Assessment of Internal Audit

12 The external auditor shall obtain a sufficient understanding of internal audit activities to identify and assess the risks of material misstatement of the financial report and to design and perform further audit procedures.

13 Effective internal audit will often allow a modification in the nature and timing, and a reduction in the extent of audit procedures performed by the external auditor but cannot eliminate them entirely. In some cases, however, having considered the activities of internal audit, the external auditor may decide that internal audit will have no effect on external audit procedures.

14 The external auditor shall perform an assessment of the internal audit function when internal audit is relevant to the external auditor’s risk assessment.

15 The external auditor’s assessment of the internal audit function will influence the external auditor’s judgement about the use which may be made of internal audit in making risk assessments and thereby modifying the nature, timing and extent of further external audit procedures.

16 When obtaining an understanding and performing an assessment of the internal audit function, the important criteria are ordinarily the following:

• Organisational status: Specific status of internal audit in the entity and the effect this has on its ability to be objective. In the ideal situation, internal audit will report administratively to the highest level of management and functionally to those charged with governance and be free of any other operating responsibility. Any constraints or restrictions placed on internal audit by management or those charged with governance would ordinarily be carefully considered. In particular, the internal auditors will need to be free to communicate fully with the external auditor.
• Scope of function: The nature and extent of internal audit assignments performed. The external auditor would also ordinarily consider whether management and those charged with governance act on internal audit recommendations and how this is evidenced.
• Technical competence: Whether internal audit is performed by persons having adequate technical training and proficiency as internal auditors. The external auditor may, for example, review the policies for hiring and training the internal audit staff and their experience and professional qualifications.
• Due professional care: Whether internal audit is properly planned, supervised, reviewed and documented. The existence of adequate audit manuals, work programs and working papers would ordinarily be considered.

17 A suggested questionnaire to assist in obtaining an understanding and making a preliminary assessment of internal audit is attached at Appendix 1.