Welcome to "Using the Work of Others"!

In the world of Advanced Audit and Assurance (AAA), an auditor cannot be an expert in every single discipline, nor does an audit team need to re-perform every routine process from scratch. A client may have an established internal audit department, complex specialized assets requiring external valuation, or an outsourced payroll function.

Under syllabus section D(4), we examine three distinct sources of outside work: Internal Auditors (ISA 610 (Revised)), an Auditor’s Expert (ISA 620), and Outsourced Functions / Service Organisations (ISA 402). Let's break down each area step by step!

1. Using the Work of Internal Auditors (ISA 610 (Revised))

An entity's Internal Audit (IA) department is part of its internal control system. ISA 610 (Revised) provides the framework for determining whether, to what extent, and in which areas the external auditor can use the work of internal auditors.

A. Evaluating the Internal Audit Function (The Three Pillars)

Before using internal audit work or obtaining direct assistance, the external auditor must evaluate:

1. Objectivity: Does the organizational status of IA support impartiality? Objectivity is strongest when IA reports directly to those charged with governance (such as the Audit Committee) rather than management (e.g., the Finance Director), and when internal auditors have no operational conflicts of interest.
2. Competence: Do internal auditors hold appropriate professional qualifications, technical training, and experience?
3. Systematic and Disciplined Approach: Does the function apply documented audit plans, standardized work programmes, supervision, review, and quality control procedures?

B. Two Ways of Using Internal Audit

1. Using work already performed: The external auditor relies on reports and procedures already carried out by IA (e.g., testing of internal controls or physical inventory counts). The external auditor must review IA working papers and reperform a sample of procedures to confirm their adequacy.
2. Direct Assistance: Internal auditors perform specific procedures under the direct direction, supervision, and review of the external auditor. Note: Direct assistance is prohibited in some jurisdictions, and written agreements must be obtained from both the entity and the internal auditors regarding confidentiality and instruction.

C. Prohibitions and Red Flags

The external auditor shall not use the internal audit function if:

  • The function lacks sufficient objectivity, competence, or a systematic and disciplined approach.
  • The planned work involves significant professional judgement (e.g., going concern evaluation, valuation of complex accounting estimates).
  • The assessed risk of material misstatement is high.
  • For direct assistance: the internal auditor has been involved in the operational work being audited or has personal conflicts.

Sole Responsibility Principle:
The external auditor has sole responsibility for the audit opinion expressed. That responsibility is never reduced by using the work of internal auditors.

2. Using the Work of an Auditor’s Expert (ISA 620)

When expertise in a field other than accounting or auditing is necessary to obtain sufficient appropriate audit evidence, the auditor considers engaging an Auditor’s Expert (e.g., property valuers, actuaries, legal specialists, or environmental engineers).

Note: An expert hired by the client's management is a Management's Expert (evaluated under ISA 500 / ISA 540 (Revised)), not an Auditor's Expert under ISA 620.

A. Evaluating the Expert (The C-C-O Framework)

The external auditor must evaluate:

1. Competence: Professional certifications, membership of relevant professional bodies, and industry reputation.
2. Capability: Availability of time, technical resources, and staff to perform the assignment.
3. Objectivity: Freedom from financial interests, personal relationships, or business ties to the client entity.

B. Agreement with the Expert

The auditor must agree in writing on the terms of the engagement, covering:

  • The nature, scope, and objectives of the expert's work.
  • The respective roles and responsibilities of the auditor and the expert.
  • The nature, timing, and extent of communication and reports.
  • Confidentiality requirements.

C. Evaluating the Adequacy of the Expert's Work

The auditor cannot accept an expert's report uncritically. The auditor must assess:

  • The reasonableness of assumptions and methods used, including their consistency with prior periods and accounting standards.
  • The relevance, completeness, and accuracy of source data provided to the expert.
  • The consistency of the expert’s findings with other audit evidence gathered.

3. Outsourced Functions and Service Organisations (ISA 402)

Many entities outsource functions such as payroll processing, cloud-hosted IT systems, asset management, or receivable collections to third-party service organisations. Because the outsourced function forms part of the entity's information system and internal control, the auditor must understand its impact under ISA 402.

A. Understanding the Outsourced Service

The auditor evaluates the nature and significance of the outsourced services to the client's financial reporting, including:

  • The materiality of transactions processed by the service organisation.
  • The degree of interaction between the client's internal controls and the service organisation's controls.
  • Whether the client maintains effective user controls over the outsourced data (e.g., authorizing payroll changes, reconciling payroll reports to general ledger balances).

B. Service Auditor Reports: Type 1 vs. Type 2

When client controls alone do not provide sufficient evidence, the auditor often reviews a third-party assurance report issued by a service auditor under ISAE 3402:

- Type 1 Report (Report on description and design of controls): Describes the service organisation's system and confirms whether controls were suitably designed to achieve specified control objectives as of a specific date. It does not test operating effectiveness, so it cannot support an assessment of low control risk.
- Type 2 Report (Report on description, design, and operating effectiveness): In addition to design, it includes tests of the operating effectiveness of controls throughout a specified period. The external auditor can use this report as audit evidence that internal controls operated effectively.

C. Procedures When Reports Are Unavailable

If neither adequate client-level controls nor a Type 2 report is available, the auditor must:

  • Contact the service organisation through the client to request specific information or access.
  • Request that a service auditor perform procedures or tests of controls.
  • Visit the service organisation directly to perform tests of controls and substantive procedures.
  • Assess whether a scope limitation exists if sufficient evidence cannot be obtained, considering modifications to the auditor’s report under ISA 705 (Revised).

4. Comparison: The Three Categories of "Others"

Internal Auditors (ISA 610 (Revised)): Internal employees or outsourced team testing internal controls and operations; evaluated on Objectivity, Competence, and Systematic approach.
Auditor's Expert (ISA 620): Independent specialist in non-accounting/auditing fields; evaluated on Competence, Capability, and Objectivity (C-C-O).
Service Organisations (ISA 402): External providers executing operational or financial processes (e.g., payroll); evaluated via user controls and Type 1 / Type 2 service auditor reports.

5. Memory Aids & Exam Mnemonics

To remember what to evaluate for an Internal Auditor, recall "O-C-S":

  • Objectivity (Reporting line to Audit Committee?)
  • Competence (Qualifications and experience?)
  • Systematic Approach (Documented plans and quality procedures?)

To remember the evaluation criteria for an Auditor's Expert, recall "C-C-O":

  • Competence (Professional credentials)
  • Capability (Resources and capacity)
  • Objectivity (Independence from client)

To distinguish service organisation reports under ISA 402:

  • Type 1: Point-in-time design description only (No testing of operating effectiveness).
  • Type 2: Design plus operating effectiveness tested over a period.

6. Common Student Mistakes to Avoid

1. Shared Responsibility Fallacy: Claiming that referring to an expert or internal auditor in an unmodified auditor's report relieves the auditor of liability. Correction: The external auditor retains sole responsibility and must not refer to the expert in an unmodified report unless required by law.
2. Conflating Management's and Auditor's Experts: Treating a specialist hired by the client (e.g., an actuary computing pension liabilities for management's financial statements) as an auditor's expert under ISA 620. Correction: That is management's expert, governed by ISA 500 / ISA 540 (Revised).
3. Relying on Type 1 Reports for Operating Effectiveness: Assuming a Type 1 report allows the auditor to reduce substantive testing. Correction: Only a Type 2 report tests operating effectiveness over time.
4. Using IA for High-Judgement Areas: Allowing internal auditors to audit high-risk accounting estimates. Correction: Significant judgements cannot be delegated to internal audit.

Summary Takeaway

- ISA 610 (Revised): Internal audit can provide work or direct assistance only when objective, competent, and systematic, and never for high-risk or subjective areas.
- ISA 620: Auditor's experts provide non-accounting expertise; auditors must evaluate C-C-O and critically assess data, methods, and assumptions.
- ISA 402: Outsourced functions (e.g., payroll) require understanding user controls and leveraging Type 1 / Type 2 service auditor reports.
- Responsibility: Regardless of who performed the work, the external auditor carries 100% responsibility for the audit opinion.