# SA 610: Using the Work of Internal Auditors
## What is the Internal Audit Function?
The internal audit function is an entity's own function that performs:
- Assurance activities — evaluating governance, risk management and internal controls
- Consulting activities — improving the effectiveness of these processes
### Common Internal Audit Activities
| Activity | Purpose |
|---|---|
| Evaluation of Internal Controls | Assess design and operating effectiveness |
| Examination of financial/operating information | Review accuracy and completeness |
| Review of operating activities | Assess efficiency and effectiveness |
| Compliance review | Check adherence to laws and regulations |
## What SA 610 Covers
SA 610 governs the external auditor's (EA's) responsibilities when deciding to use internal auditors in two ways:
| Mode | What it Means |
|---|---|
| Using the work of the IA function | EA relies on outputs/findings already produced by internal audit |
| Direct Assistance | EA uses internal auditors to perform specific procedures under EA's direction |
> Key Principle: The external auditor has sole and exclusive responsibility for the audit opinion. This responsibility is NOT reduced by using IA work or direct assistance.
## Objectives of the External Auditor
1. Determine usability — Can IA work be used / direct assistance taken? If so, in what areas and to what extent?
2. Assess adequacy — If using IA work, is it adequate for audit purposes?
3. Supervise properly — If using direct assistance, appropriately direct, supervise and review the internal auditors' work.
## How to Evaluate the Internal Audit Function
Before using IA work, the EA must assess the function on three dimensions:
### 1. Objectivity
The ability to perform tasks without bias, conflict of interest, or undue influence overriding professional judgement.
- Key factor: Does the IA function report to the Board/Audit Committee (high objectivity) or to operational management (lower objectivity)?
### 2. Level of Competence
The attainment and maintenance of knowledge and skills of the IA function as a whole — qualifications, training, and professional development.
### 3. Systematic and Disciplined Approach
Application of structured, documented methods for planning, performing, supervising, reviewing and documenting IA activities, including quality control.
> This distinguishes the IA function from informal monitoring activities performed by the entity.
## When the EA CANNOT Use IA Work
The EA shall not use IA work if:
| Condition | Issue |
|---|---|
| Inadequate objectivity | Organisational status or policies do not adequately support objectivity |
| Insufficient competence | The function lacks necessary knowledge and skills |
| No systematic approach | The function does not apply a disciplined approach including quality control |
## If the EA Plans to Use IA Work
The EA must:
1. Discuss planned use with IA to coordinate respective activities
2. Read IA reports and related findings
3. Perform sufficient audit procedures on the body of IA work to confirm its adequacy