ISA (NZ) 610 (Revised 2013)

1. This International Standard on Auditing (New Zealand) (ISA (NZ)) deals with the external auditor’s responsibilities if using the work of internal auditors. This includes (a) using the work of the internal audit function in obtaining audit evidence and (b) using internal auditors to provide direct assistance under the direction, supervision and review of the external auditor.

2. This ISA (NZ) does not apply if the entity does not have an internal audit function. (Ref: Para. A2)

3. If the entity has an internal audit function, the requirements in this ISA (NZ) relating to using the work of that function do not apply if:

1. The responsibilities and activities of the function are not relevant to the audit; or

2. Based on the auditor’s preliminary understanding of the function obtained as a result of procedures performed under ISA (NZ) 315 (Revised 2019)¹, the external auditor does not expect to use the work of the function in obtaining audit evidence.

Nothing in this ISA (NZ) requires the external auditor to use the work of the internal audit function to modify the nature or timing, or reduce the extent, of audit procedures to be performed directly by the external auditor; it remains a decision of the external auditor in establishing the overall audit strategy.

4. Furthermore, the requirements in this ISA (NZ) relating to direct assistance do not apply if the external auditor does not plan to use internal auditors to provide direct assistance.

5. In some jurisdictions, the external auditor may be prohibited, or restricted to some extent, by law or regulation from using the work of the internal audit function or using internal auditors to provide direct assistance. The ISAs (NZ) do not override laws or regulations that govern an audit of financial statements.² Such prohibitions or restrictions will therefore not prevent the external auditor from complying with the ISAs (NZ). (Ref: Para. A31)

6. Many entities establish internal audit functions as part of their internal control and governance structures. The objectives and scope of an internal audit function, the nature of its responsibilities and its organisational status, including the function’s authority and accountability, vary widely and depend on the size and structure of the entity and the requirements of management and, where applicable, those charged with governance.

7. ISA (NZ) 315 (Revised 2019) addresses how the knowledge and experience of the internal audit function can inform the external auditor’s understanding of the entity and its environment, the applicable financial reporting framework and the entity’s system of internal control, and identification and assessment of risks of material misstatement. ISA (NZ) 315 (Revised 2019)³ also explains how effective communication between the internal and external auditors also creates an environment in which the external auditor can be informed of significant matters that may affect the external auditor’s work.

8. Depending on whether the internal audit function’s organisational status and relevant policies and procedures adequately support the objectivity of the internal auditors, the level of competency of the internal audit function, and whether the function applies a systematic and disciplined approach, the external auditor may also be able to use the work of the internal audit function in a constructive and complementary manner. This ISA (NZ) addresses the external auditor’s responsibilities when, based on the external auditor’s preliminary understanding of the internal audit function obtained as a result of procedures performed under ISA (NZ) 315 (Revised 2019), the external auditor expects to use the work of the internal audit function as part of the audit evidence obtained.⁴ Such use of that work modifies the nature or timing, or reduces the extent, of audit procedures to be performed directly by the external auditor.

9. In addition, this ISA (NZ) also addresses the external auditor’s responsibilities if considering using internal auditors to provide direct assistance under the direction, supervision and review of the external auditor.

10. There may be individuals in an entity that perform procedures similar to those performed by an internal audit function. However, unless performed by an objective and competent function that applies a systematic and disciplined approach, including quality control, such procedures would be considered internal controls and obtaining evidence regarding the effectiveness of such controls would be part of the auditor’s responses to assessed risks in accordance with ISA (NZ) 330.⁵

11. The external auditor has sole responsibility for the audit opinion expressed, and that responsibility is not reduced by the external auditor’s use of the work of the internal audit function or internal auditors to provide direct assistance on the engagement. Although they may perform audit procedures similar to those performed by the external auditor, neither the internal audit function nor the internal auditors are independent of the entity as is required of the external auditor in an audit of financial statements in accordance with ISA (NZ) 200.⁶ This ISA (NZ), therefore, defines the conditions that are necessary for the external auditor to be able to use the work of internal auditors. It also defines the necessary work effort to obtain sufficient appropriate evidence that the work of the internal audit function, or internal auditors providing direct assistance, is adequate for the purposes of the audit. The requirements are designed to provide a framework for the external auditor’s judgements regarding the use of the work of internal auditors to prevent over or undue use of such work.

12. This ISA (NZ) is effective for audits of financial statements for periods ending on or after 15 December, 2013, except for material underlined pertaining to the use of internal auditors to provide direct assistance which is effective for audits of financial statements for periods ending on or after 15 December, 2014. [Note: For the effective dates of paragraphs changed or added by an Amending Standard see the History of Amendments].

NZ12.1 This ISA (NZ) supersedes International Standard on Auditing (New Zealand) 610, Using the Work Of Internal Auditors.

13. The objectives of the external auditor, where the entity has an internal audit function and the external auditor expects to use the work of the function to modify the nature or timing, or reduce the extent, of audit procedures to be performed directly by the external auditor, or to use internal auditors to provide direct assistance, are:

1. To determine whether the work of the internal audit function or direct assistance from internal auditors can be used, and if so, in which areas and to what extent;

and having made that determination:

1. If using the work of the internal audit function, to determine whether that work is adequate for purposes of the audit; and

2. If using internal auditors to provide direct assistance, to appropriately direct, supervise and review their work.

14. For purposes of the ISAs (NZ), the following terms have the meanings attributed below:

1. Internal audit function – A function of an entity that performs assurance and consulting activities designed to evaluate and improve the effectiveness of the entity’s governance, risk management and internal control processes. (Ref: Para. A1-A4)

2. Direct assistance – The use of internal auditors to perform audit procedures under the direction, supervision and review of the external auditor.

15. The external auditor shall determine whether the work of the internal audit function can be used for purposes of the audit by evaluating the following:

1. The extent to which the internal audit function’s organisational status and relevant policies and procedures support the objectivity of the internal auditors; (Ref: Para. A5-A9)

2. The level of competence of the internal audit function; and (Ref: Para.A5-A9)

3. Whether the internal audit function applies a systematic and disciplined approach, including quality control. (Ref: Para. A10-A11)

16. The external auditor shall not use the work of the internal audit function if the external auditor determines that:

1. The function’s organisational status and relevant policies and procedures do not adequately support the objectivity of internal auditors;

2. The function lacks sufficient competence; or

3. The function does not apply a systematic and disciplined approach, including quality control. (Ref: Para. A12-A14)

17. As a basis for determining the areas and the extent to which the work of the internal audit function can be used, the external auditor shall consider the nature and scope of the work that has been performed, or is planned to be performed, by the internal audit function and its relevance to the external auditor’s overall audit strategy and audit plan. (Ref: Para. A15-A17)

18. The external auditor shall make all significant judgements in the audit engagement and, to prevent undue use of the work of the internal audit function, shall plan to use less of the work of the function and perform more of the work directly: (Ref: Para A15-A17)

1. The more judgement is involved in:

   1. Planning and performing relevant audit procedures; and

   2. Evaluating the audit evidence gathered; (Ref: Para A18-A19)

2. The higher the assessed risk of material misstatement at the assertion level, with special consideration given to risks identified as significant; (Ref: Para. A20-A22)

3. The less the internal audit function’s organisational status and relevant policies and procedures adequately support the objectivity of the internal auditors; and

4. The lower the level of competence of the internal audit function.

19. The external auditor shall also evaluate whether, in aggregate, using the work of the internal audit function to the extent planned would still result in the external auditor being sufficiently involved in the audit, given the external auditor’s sole responsibility for the audit opinion expressed. (Ref: Para A15-A22)

20. The external auditor shall, in communicating with those charged with governance an overview of the planned scope and timing of the audit in accordance with ISA (NZ) 260 (Revised)⁷, communicate how the external auditor has planned to use the work of the internal audit function. (Ref: Para. A23)

21. If the external auditor plans to use the work of the internal audit function, the external auditor shall discuss the planned use of its work with the function as a basis for coordinating their respective activities. (Ref: Para. A24-A26)

22. The external auditor shall read the reports of the internal audit function relating to the work of the function that the external auditor plans to use to obtain an understanding of the nature and extent of audit procedures it performed and the related findings.

23. The external auditor shall perform sufficient audit procedures on the body of work of the internal audit function as a whole that the external auditor plans to use to determine its adequacy for purposes of the audit, including evaluating whether:

1. The work of the function had been properly planned, performed, supervised, reviewed and documented;

2. Sufficient appropriate evidence had been obtained to enable the function to draw reasonable conclusions; and

3. Conclusions reached are appropriate in the circumstances and the reports prepared by the function are consistent with the results of the work performed. (Ref: Para. A27-A30)

24. The nature and extent of the external auditor’s audit procedures shall be responsive to the external auditor’s evaluation of:

1. The amount of judgement involved;

2. The assessed risk of material misstatement;

3. The extent to which the internal audit function’s organisational status and relevant policies and procedures support the objectivity of the internal auditors; and

4. The level of competence of the function;⁸ (Ref: Para. A27-A29) and shall include reperformance of some of the work. (Ref: Para.A30)

25. The external auditor shall also evaluate whether the external auditor’s conclusions regarding the internal audit function in paragraph 15 of this ISA (NZ) and the determination of the nature and extent of use of the work of the function for purposes of the audit in paragraphs 18-19 of this ISA (NZ) remain appropriate.

26. The external auditor may be prohibited by law or regulation from obtaining direct assistance from internal auditors. If so, paragraphs 27–35 and 37 do not apply. (Ref: Para. A31)

27. If using internal auditors to provide direct assistance is not prohibited by law or regulation, and the external auditor plans to use internal auditors to provide direct assistance on the audit, the external auditor shall evaluate the existence and significance of threats to objectivity and the level of competence of the internal auditors who will be providing such assistance. The external auditor’s evaluation of the existence and significance of threats to the internal auditors’ objectivity shall include enquiry of the internal auditors regarding interests and relationships that may create a threat to their objectivity. (Ref: Para. A32–A34)

28. The external auditor shall not use an internal auditor to provide direct assistance if:

1. There are significant threats to the objectivity of the internal auditor; or

2. The internal auditor lacks sufficient competence to perform the proposed work. (Ref: Para. A32–A34)

29. In determining the nature and extent of work that may be assigned to internal auditors and the nature, timing and extent of direction, supervision and review that is appropriate in the circumstances, the external auditor shall consider:

1. The amount of judgement involved in:

   1. Planning and performing relevant audit procedures; and

   2. Evaluating the audit evidence gathered;

2. The assessed risk of material misstatement; and

3. The external auditor’s evaluation of the existence and significance of threats to the objectivity and level of competence of the internal auditors who will be providing such assistance. (Ref: Para. A35–A39)

30. The external auditor shall not use internal auditors to provide direct assistance to perform procedures that:

1. Involve making significant judgements in the audit; (Ref: Para. A19)

2. Relate to higher assessed risks of material misstatement where the judgement required in performing the relevant audit procedures or evaluating the audit evidence gathered is more than limited; (Ref: Para. A38)

3. Relate to work with which the internal auditors have been involved and which has already been, or will be, reported to management or those charged with governance by the internal audit function; or

4. Relate to decisions the external auditor makes in accordance with this ISA (NZ) regarding the internal audit function and the use of its work or direct assistance. (Ref: Para. A35–A39)

31. Having appropriately evaluated whether and, if so, to what extent internal auditors can be used to provide direct assistance on the audit, the external auditor shall, in communicating with those charged with governance an overview of the planned scope and timing of the audit in accordance with ISA (NZ) 260 (Revised),⁹ communicate the nature and extent of the planned use of internal auditors to provide direct assistance so as to reach a mutual understanding that such use is not excessive in the circumstances of the engagement. (Ref: Para. A39)

32. The external auditor shall evaluate whether, in aggregate, using internal auditors to provide direct assistance to the extent planned, together with the planned use of the work of the internal audit function, would still result in the external auditor being sufficiently involved in the audit, given the external auditor’s sole responsibility for the audit opinion expressed.

33. Prior to using internal auditors to provide direct assistance for purposes of the audit, the external auditor shall:

1. Obtain written agreement from an authorised representative of the entity that the internal auditors will be allowed to follow the external auditor’s instructions, and that the entity will not intervene in the work the internal auditor performs for the external auditor; and

2. Obtain written agreement from the internal auditors that they will keep confidential specific matters as instructed by the external auditor and inform the external auditor of any threat to their objectivity.

34. The external auditor shall direct, supervise and review the work performed by internal auditors on the engagement in accordance with ISA (NZ) 220 (Revised)¹⁰. In so doing:

1. The nature, timing and extent of direction, supervision, and review shall recognise that the internal auditors are not independent of the entity and be responsive to the outcome of the evaluation of the factors in paragraph 29 of this ISA (NZ); and

2. The review procedures shall include the external auditor checking back to the underlying audit evidence for some of the work performed by the internal auditors.

The direction, supervision and review by the external auditor of the work performed by the internal auditors shall be sufficient in order for the external auditor to determine that the internal auditors have obtained sufficient appropriate audit evidence to support the conclusions based on that work. (Ref: Para. A40-A41)

35. In directing, supervising and reviewing the work performed by internal auditors, the external auditor shall remain alert for indications that the external auditor’s evaluations in paragraph 27 are no longer appropriate.

36. If the external auditor uses the work of the internal audit function, the external auditor shall include in the audit documentation:

1. The evaluation of:

   1. Whether the function’s organisational status and relevant policies and procedures adequately support the objectivity of the internal auditors;

   2. The level of competence of the function; and

   3. Whether the function applies a systematic and disciplined approach, including quality control;

2. The nature and extent of the work used and the basis for that decision; and

3. The audit procedures performed by the external auditor to evaluate the adequacy of the work used.

37. If the external auditor uses internal auditors to provide direct assistance on the audit, the external auditor shall include in the audit documentation:

1. The evaluation of the existence and significance of threats to the objectivity of the internal auditors, and the level of competence of the internal auditors used to provide direct assistance;

2. The basis for the decision regarding the nature and extent of the work performed by the internal auditors;

3. Who reviewed the work performed and the date and extent of that review in accordance with ISA (NZ) 230;¹¹

4. The written agreements obtained from an authorised representative of the entity and the internal auditors under paragraph 33 of this ISA (NZ); and

5. The working papers prepared by the internal auditors who provided direct assistance on the audit engagement.

A1. The objectives and scope of internal audit functions typically include assurance and consulting activities designed to evaluate and improve the effectiveness of the entity’s governance processes, risk management and internal control such as the following:

A2. Activities similar to those performed by an internal audit function may be conducted by functions with other titles within an entity. Some or all of the activities of an internal audit function may also be outsourced to a third-party service provider. Neither the title of the function, nor whether it is performed by the entity or a third-party service provider, are sole determinants of whether or not the external auditor can use the work of the function. Rather, it is the nature of the activities; the extent to which the internal audit function’s organisational status and relevant policies and procedures support the objectivity of the internal auditors; competence; and systematic and disciplined approach of the function that are relevant. References in this ISA (NZ) to the work of the internal audit function include relevant activities of other functions or third-party providers that have these characteristics.

A3. In addition, those in the entity with operational and managerial duties and responsibilities outside of the internal audit function would ordinarily face threats to their objectivity that would preclude them from being treated as part of an internal audit function for the purpose of this ISA (NZ), although they may perform controls that can be tested in accordance with ISA (NZ) 330¹². For this reason, monitoring controls performed by an owner-manager would not be considered equivalent to an internal audit function.

A4. While the objectives of an entity’s internal audit function and the external auditor differ, the function may perform audit procedures similar to those performed by the external auditor in an audit of financial statements. If so, the external auditor may make use of the function for purposes of the audit in one or more of the following ways:

A5. The external auditor exercises professional judgement in determining whether the work of the internal audit function can be used for purposes of the audit, and the nature and extent to which the work of the internal audit function can be used in the circumstances.

A6. The extent to which the internal audit function’s organisational status and relevant policies and procedures support the objectivity of the internal auditors and the level of competence of the function are particularly important in determining whether to use and, if so, the nature and extent of the use of the work of the function that is appropriate in the circumstances.

A7. Objectivity refers to the ability to perform those tasks without allowing bias, conflict of interest or undue influence of others to override professional judgements. Factors that may affect the external auditor’s evaluation include the following:

A8. Competence of the internal audit function refers to the attainment and maintenance of knowledge and skills of the function as a whole at the level required to enable assigned tasks to be performed diligently and in accordance with applicable professional standards. Factors that may affect the external auditor’s determination include the following:

A9. Objectivity and competence may be viewed as a continuum. The more the internal audit function’s organisational status and relevant policies and procedures adequately support the objectivity of the internal auditors and the higher the level of competence of the function, the more likely the external auditor may make use of the work of the function and in more areas. However, an organisational status and relevant policies and procedures that provide strong support for the objectivity of the internal auditors cannot compensate for the lack of sufficient competence of the internal audit function. Equally, a high level of competence of the internal audit function cannot compensate for an organisational status and policies and procedures that do not adequately support the objectivity of the internal auditors.

A10. The application of a systematic and disciplined approach to planning, performing, supervising, reviewing and documenting its activities distinguishes the activities of the internal audit function from other monitoring controls that may be performed within the entity.

A11. Factors that may affect the external auditor’s determination of whether the internal audit function applies a systematic and disciplined approach include the following:

A12. The external auditor’s evaluation of whether the internal audit function’s organisational status and relevant policies and procedures adequately support the objectivity of the internal auditors, the level of competence of the internal audit function, and whether it applies a systematic and disciplined approach may indicate that the risks to the quality of the work of the function are too significant and therefore it is not appropriate to use any of the work of the function as audit evidence.

A13. Consideration of the factors in paragraphs A7, A8 and A11 of this ISA (NZ) individually and in aggregate is important because an individual factor is often not sufficient to conclude that the work of the internal audit function cannot be used for purposes of the audit. For example, the internal audit function’s organisational status is particularly important in evaluating threats to the objectivity of the internal auditors. If the internal audit function reports to management, this would be considered a significant threat to the function’s objectivity unless other factors such as those described in paragraph A7 of this ISA (NZ) collectively provide sufficient safeguards to reduce the threat to an acceptable level.

A14. In addition, Professional and Ethical Standard 1¹⁶ states that a self-review threat is created when the external auditor accepts an engagement to provide internal audit services to an audit client, and the results of those services will be used in conducting the audit. This is because of the possibility that the engagement team will use the results of the internal audit service without properly evaluating those results or without exercising the same level of professional scepticism as would be exercised when the internal audit work is performed by individuals who are not members of the firm. Professional and Ethical Standard 1¹⁷ discusses the prohibitions that apply in certain circumstances and the threats and the safeguards that can be applied to reduce the threats to an acceptable level in other circumstances.

A15. Once the external auditor has determined that the work of the internal audit function can be used for purposes of the audit, a first consideration is whether the planned nature and scope of the work of the internal audit function that has been performed, or is planned to be performed, is relevant to the overall audit strategy and audit plan that the external auditor has established in accordance with ISA (NZ) 300.¹⁸

A16. Examples of work of the internal audit function that can be used by the external auditor include the following:

A17. The external auditor’s determination of the planned nature and extent of use of the work of the internal audit function will be influenced by the external auditor’s evaluation of the extent to which the internal audit function’s organisational status and relevant policies and procedures adequately support the objectivity of the internal auditors and the level of competence of the internal audit function in paragraph 18 of this ISA (NZ). In addition, the amount of judgement needed in planning, performing and evaluating such work and the assessed risk of material misstatement at the assertion level are inputs to the external auditor’s determination. Further, there are circumstances in which the external auditor cannot use the work of the internal audit function for purpose of the audit as described in paragraph 16 of this ISA (NZ).

A18. The greater the judgement needed to be exercised in planning and performing the audit procedures and evaluating the audit evidence, the external auditor will need to perform more procedures directly in accordance with paragraph 18 of this ISA (NZ), because using the work of the internal audit function alone will not provide the external auditor with sufficient appropriate audit evidence.

A19. Since the external auditor has sole responsibility for the audit opinion expressed, the external auditor needs to make the significant judgements in the audit engagement in accordance with paragraph 18. Significant judgements include the following:

A20. For a particular account balance, class of transaction or disclosure, the higher an assessed risk of material misstatement at the assertion level, the more judgement is often involved in planning and performing the audit procedures and evaluating the results thereof. In such circumstances, the external auditor will need to perform more procedures directly in accordance with paragraph 18 of this ISA (NZ), and accordingly, make less use of the work of the internal audit function in obtaining sufficient appropriate audit evidence. Furthermore, as explained in ISA (NZ) 200¹⁹, the higher the assessed risks of material misstatement, the more persuasive the audit evidence required by the external auditor will need to be, and, therefore, the external auditor will need to perform more of the work directly.

A21. As explained in ISA (NZ) 315 (Revised 2019)²⁰, significant risks are risks assessed close to the upper end of the spectrum of inherent riskand therefore the external auditor’s ability to use the work of the internal audit function in relation to significant risks will be restricted to procedures that involve limited judgement. In addition, where the risks of material misstatement is other than low, the use of the work of the internal audit function alone is unlikely to reduce audit risk to an acceptably low level and eliminate the need for the external auditor to perform some tests directly.

A22. Carrying out procedures in accordance with this ISA (NZ) may cause the external auditor to re-evaluate the external auditor’s assessment of the risks of material misstatement. Consequently, this may affect the external auditor’s determination of whether to use the work of the internal audit function and whether further application of this ISA (NZ) is necessary.

A23. In accordance with ISA (NZ) 260 (Revised),²¹ the external auditor is required to communicate with those charged with governance an overview of the planned scope and timing of the audit. The planned use of the work of the internal audit function is an integral part of the external auditor’s overall audit strategy and is therefore relevant to those charged with governance for their understanding of the proposed audit approach.

A24. In discussing the planned use of their work with the internal audit function as a basis for coordinating the respective activities, it may be useful to address the following:

A25. Coordination between the external auditor and the internal audit function is effective when, for example:

A26. ISA (NZ) 200²² discusses the importance of the auditor planning and performing the audit with professional scepticism, including being alert to information that brings into question the reliability of documents and responses to enquiries to be used as audit evidence. Accordingly, communication with the internal audit function throughout the engagement may provide opportunities for internal auditors to bring matters that may affect the work of the external auditor to the external auditor’s attention.²³ The external auditor is then able to take such information into account in the external auditor’s identification and assessment of risks of material misstatement. In addition, if such information may be indicative of a heightened risk of a material misstatement of the financial statements or may be regarding any actual, suspected or alleged fraud, the external auditor can take this into account in the external auditor’s identification of risk of material misstatement due to fraud in accordance with ISA (NZ) 240.²⁴

Procedures to Determine the Adequacy of Work of the Internal Audit Function (Ref: Para. 23– 24)

A27. The external auditor’s audit procedures on the body of work of the internal audit function as a whole that the external auditor plans to use provide a basis for evaluating the overall quality of the function’s work and the objectivity with which it has been performed.

A28. The procedures the external auditor may perform to evaluate the quality of the work performed and the conclusions reached by the internal audit function, in addition to reperformance in accordance with paragraph 24, include the following:

A29. The more judgement involved, the higher the assessed risk of material misstatement, the less the internal audit function’s organisational status and relevant policies and procedures adequately support the objectivity of the internal auditors, or the lower the level of competence of the internal audit function, the more audit procedures are needed to be performed by the external auditor on the overall body of work of the function to support the decision to use the work of the function in obtaining sufficient appropriate audit evidence on which to base the audit opinion.

A30. For purposes of this ISA (NZ), reperformance involves the external auditor’s independent execution of procedures to validate the conclusions reached by the internal audit function. This objective may be accomplished by examining items already examined by the internal audit function, or where it is not possible to do so, the same objective may also be accomplished by examining sufficient other similar items not actually examined by the internal audit function. Reperformance provides more persuasive evidence regarding the adequacy of the work of the internal audit function compared to other procedures the external auditor may perform in paragraph A28. While it is not necessary for the external auditor to do reperformance in each area of work of the internal audit function that is being used, some reperformance is required on the body of work of the internal audit function as a whole that the external auditor plans to use in accordance with paragraph 24. The external auditor is more likely to focus reperformance in those areas where more judgement was exercised by the internal audit function in planning, performing and evaluating the results of the audit procedures and in areas of higher risk of material misstatement.

A31. In jurisdictions where the external auditor is prohibited by law or regulation from using internal auditors to provide direct assistance, it is relevant in the circumstances of a group audit, for the group auditor to consider whether the prohibition also extends to component auditors and, if so, to address this in the communication to the component auditors.²⁵

A32. As stated in paragraph A7 of this ISA (NZ), objectivity refers to the ability to perform the proposed work without allowing bias, conflict of interest or undue influence of others to override professional judgements. In evaluating the existence and significance of threats to the objectivity of an internal auditor, the following factors may be relevant:

A33. There may also be some circumstances in which the significance of the threats to the objectivity of an internal auditor is such that there are no safeguards that could reduce them to an acceptable level. For example, because the adequacy of safeguards is influenced by the significance of the work in the context of the audit, paragraph 30 (a) and (b) prohibits the use of internal auditors to provide direct assistance in relation to performing procedures that involve making significant judgements in the audit or that relate to higher assessed risks of material misstatement where the judgement required in performing the relevant audit procedures or evaluating the audit evidence gathered is more than limited. This would also be the case where the work involved creates a self- review threat, which is why internal auditors are prohibited from performing procedures in the circumstances described in paragraph 30 (c) and (d).

A34. In evaluating the level of competence of an internal auditor, many of the factors in paragraph A8 of this ISA (NZ) may also be relevant, applied in the context of individual internal auditors and the work to which they may be assigned.

A35. Paragraphs A15-A22 of this ISA (NZ) provide relevant guidance in determining the nature and extent of work that may be assigned to internal auditors.

A36. In determining the nature of work that may be assigned to internal auditors, the external auditor is careful to limit such work to those areas that would be appropriate to be assigned. Examples of activities and tasks that would not be appropriate to use internal auditors to provide direct assistance include the following:

A37. Similarly, since in accordance with ISA (NZ) 505²⁸ the external auditor is required to maintain control over external confirmation requests and evaluate the results of external confirmation procedures, it would not be appropriate to assign these responsibilities to internal auditors. However, internal auditors may assist in assembling information necessary for the external auditor to resolve exceptions in confirmation responses.

A38. The amount of judgement involved and the risk of material misstatement are also relevant in determining the work that may be assigned to internal auditors providing direct assistance. For example, in circumstances where the valuation of accounts receivable is assessed as an area of higher risk, the external auditor could assign the checking of the accuracy of the aging to an internal auditor providing direct assistance. However, because the evaluation of the adequacy of the provision based on the aging would involve more than limited judgement, it would not be appropriate to assign that latter procedure to an internal auditor providing direct assistance.

A39. Notwithstanding the direction, supervision and review by the external auditor, excessive use of internal auditors to provide direct assistance may affect perceptions regarding the independence of the external audit engagement.

A40. As individuals in the internal audit function are not independent of the entity as is required of the external auditor when expressing an opinion on financial statements, the external auditor’s direction, supervision and review of the work performed by internal auditors providing direct assistance will generally be of a different nature and more extensive than if members of the engagement team perform the work.

A41. In directing the internal auditors, the external auditor may for example, remind the internal auditors to bring accounting and auditing issues identified during the audit to the attention of the external auditor. In reviewing the work performed by the internal auditors, the external auditor’s considerations include whether the evidence obtained is sufficient and appropriate in the circumstances, and that it supports the conclusions reached.