Assessing effectiveness of communication among those charged with governance (TCWG), external auditors, internal auditors, and management
#### 2. Activities Relating to Risk Management
Identifying and evaluating significant risk exposures
Contributing to improvement of risk management and internal control (including financial reporting process)
Assisting in detection of fraud
#### 3. Activities Relating to Internal Control
Reviewing controls: evaluating their operation and recommending improvements
Examining financial and operating information: detailed testing of transactions, balances, and procedures
Reviewing operating activities: economy, efficiency, and effectiveness — including non-financial activities
Reviewing compliance: with laws, regulations, external requirements, and internal management policies
---
### Three Ways the External Auditor May Use Internal Audit
Way
Description
Key Condition
1. Risk Assessment Input
Obtain information relevant to assessments of risks of material misstatement (error or fraud)
No prohibition needed
2. Using Completed Work
Use work already performed by internal audit as partial substitution for evidence the external auditor would otherwise obtain directly
Must not be prohibited/restricted by law or regulation; requires appropriate evaluation
3. Direct Assistance
Use internal auditors to perform audit procedures under the external auditor's direction, supervision, and review
Must not be prohibited/restricted by law or regulation
### Scope of SA 610
SA 610 covers:
(a) Using the work of the internal audit function to obtain audit evidence
(b) Using internal auditors to provide direct assistance under the direction, supervision, and review of the external auditor
> In all cases, the external auditor retains sole responsibility for the audit opinion — internal audit work can supplement but never replace the external auditor's judgment.
Worked example
### Example 1
An external auditor is planning the audit of a manufacturing company. The internal audit team recently completed a review of inventory counting procedures. The external auditor reviews the internal audit report to understand the quality of inventory controls — this is use of internal audit for risk assessment purposes (Way 1), informing the external auditor's risk assessment without substituting direct evidence.
### Example 2
After evaluating the competency and objectivity of the internal audit function and finding it satisfactory, the external auditor decides to rely on the internal audit team's earlier testing of accounts payable transactions, reducing the external auditor's own sample from 60 items to 30. This is partial substitution (Way 2) — but only valid if not legally prohibited.
### Example 3
The external auditor asks the internal audit team to physically count stock at three branch warehouses, following a detailed audit programme prepared by the external auditor. The external auditor supervises and reviews all the work. This is direct assistance (Way 3) under SA 610.
⚠️ Common exam mistakes
Thinking the external auditor can always use internal audit work — SA 610 explicitly notes that both Ways 2 and 3 may be prohibited or restricted by law or regulation.
Assuming internal audit work can fully substitute for external audit procedures — it provides only partial substitution (Way 2); the external auditor remains solely responsible for the opinion.
Confusing the three ways of using internal audit work — Way 1 is for risk information only; Way 2 is using already-completed work as evidence; Way 3 is directing internal auditors to perform procedures on behalf of the external auditor.
Forgetting that direct assistance (Way 3) requires the external auditor to direct, supervise, AND review the internal auditors' work — delegating without oversight is not permitted.
Bare-Act text Scope (Para 1) and Paras on Using Internal Audit Work and Direct Assistance · SA 610 – Using the Work of Internal Auditors · click to expand
Standard on Auditing (SA) 610 deals with the external auditor's responsibilities if using the work of internal auditors. This includes (a) using the work of the internal audit function in obtaining audit evidence and (b) using internal auditors to provide direct assistance under the direction, supervision and review of the external auditor.
Unless prohibited, or restricted to some extent, by law or regulation, the external auditor, after appropriate evaluation, may decide to use work that has been performed by the internal audit function during the period in partial substitution for audit evidence to be obtained directly by the external auditor.
Unless prohibited, or restricted to some extent, by law or regulation, the external auditor may use internal auditors to perform audit procedures under the direction, supervision and review of the external auditor (referred to as 'direct assistance').
Now that you've read this — what's next?
Move from understanding → mastery in 3 clicks. Each option below picks up from this lesson's topic.