Enquiries of the Internal Audit FunctionEnquiries of the Internal Audit Function

Enquiries of the Internal Audit Function

1. If an entity has an internal audit function, enquiries of the appropriate individuals within the function may provide information that is useful to the auditor in obtaining an understanding of the entity and its environment, the applicable financial reporting framework and the entity’s system of internal control, and in identifying and assessing risks of material misstatement at the financial report and assertion levels. In performing its work, the internal audit function is likely to have obtained insight into the entity’s operations and business risks, and may have findings based on its work, such as identified control deficiencies or risks, that may provide valuable input into the auditor’s understanding of the entity and its environment, the applicable financial reporting framework, the entity’s system of internal control, the auditor’s risk assessments or other aspects of the audit. The auditor’s enquiries are therefore made whether or not the auditor expects to use the work of the internal audit function to modify the nature or timing, or reduce the extent, of audit procedures to be performed.[73] Enquiries of particular relevance may be about matters the internal audit function has raised with those charged with governance and the outcomes of the function’s own risk assessment process.
2. If, based on responses to the auditor’s enquiries, it appears that there are findings that may be relevant to the entity’s financial reporting and the audit of the financial report, the auditor may consider it appropriate to read related reports of the internal audit function. Examples of reports of the internal audit function that may be relevant include the function’s strategy and planning documents and reports that have been prepared for management or those charged with governance describing the findings of the internal audit function’s examinations.
3. In addition, in accordance with ASA 240,[74] if the internal audit function provides information to the auditor regarding any actual, suspected or alleged fraud, the auditor takes this into account in the auditor’s identification of risk of material misstatement due to fraud.
4. Appropriate individuals within the internal audit function with whom enquiries are made are those who, in the auditor’s judgement, have the appropriate knowledge, experience and authority, such as the chief internal audit executive or, depending on the circumstances, other personnel within the function. The auditor may also consider it appropriate to have periodic meetings with these individuals.