Using the work of internal auditors

Can internal auditors be used to provide direct assistance to the sustainability assurance practitioner for purposes of sustainability assurance engagements?  This article provides further background information relevant to learning outcome D2d(iv) in the Professional Diploma in Sustainability syllabus.

Sustainability assurance practitioners and internal auditors

Much of the work performed by a company’s internal audit function can overlap with the work conducted by the sustainability assurance practitioner, specifically in areas dealing with the assessment of control processes. It is likely that in carrying out detailed work evaluating and reviewing the company’s internal control framework, internal audit perform procedures on financial controls relevant to the assurance engagement. As such, the sustainability assurance practitioner, rather than duplicating these procedures, may be able to place reliance on the work carried out by the internal auditor. 

This article focuses on the provision of direct assistance by the internal auditors, which historically has been a very controversial issue. Internal auditors are the employees of the entity, which could result in threats to independence (either in fact or perceived) if direct assistance is provided by the internal auditors. On the other hand, the following benefits relating to provision of direct assistance by the internal auditors cannot be ignored:

• There will be a strengthened relationship between the assurance practitioner and internal auditors through a more effective dialogue
• With the knowledge of the internal auditors, the assurance practitioner can gain additional insights into the entity
• The assurance practitioner can use internal auditors who may have relevant expertise in particular areas, and
• The assurance team can focus on the more significant assurance issues.

Guidance on determining if it is appropriate for internal auditors to provide direct assistance

The assurance practitioner, in the course of discharging their responsibilities must decide if it is appropriate in the circumstances to use internal audit to provide direct assistance.

The sustainability assurance practitioner needs to assess the objectivity of the internal auditor. Objectivity is regarded as the ability to perform the tasks without allowing bias, conflict of interest or undue influence of others to override professional judgment. The following factors are relevant to the external auditor’s evaluation of objectivity:

The following situations are likely to support the objectivity of the internal auditors:

• The internal audit function reports to those charged with governance (eg the audit committee) rather than solely to management (eg the chief finance officer) 
• The internal audit function does not have managerial or operational duties that are outside of the internal audit function
• The internal auditors are members of relevant professional bodies obligating their compliance with relevant professional standards relating to objectivity.

Competence of the internal audit function is likely to be deemed satisfactory where it can be evidenced that the function as a whole operates at the level required to (i) enable assigned tasks to be performed diligently and (ii) in accordance with applicable professional standards. To make such evaluation, the assurance practitioner can take into consideration the following factors:

• Whether there are established policies for hiring, training and assigning internal auditors to internal audit engagements
• Whether the internal auditors have adequate technical training and proficiency in auditing (eg with relevant professional designation and experience)
• Whether the internal auditors possess the required knowledge relating to the entity’s financial reporting and the applicable financial reporting framework
• Whether the internal audit function possesses the necessary skills (for example, industry-specific knowledge) to perform work related to the entity’s financial statements.

If the assurance practitioner determines that internal auditors, can be used to provide direct assistance for purposes of the assurance engagement, the next decision to be made by the assurance practitioner is to determine the nature and extent of work that can be assigned to internal auditors.

This is a matter that requires the assurance practitioner to exercise professional judgment, due to the fact that extensive use of direct assistance could affect perceptions of the independence of the assurance practitioner.

The following activities are not expected to be assigned to internal auditors providing direct assistance:

• Assessing risks of material misstatements
• Evaluating the sufficiency of tests performed
• Evaluating significant accounting estimates, and
• Evaluating the adequacy of disclosures in the financial statements and other matters affecting the assurance report.

During the assurance engagement, the assurance practitioner has to:

• Direct, supervise and review the work performed by internal auditors on the engagement, bearing in mind that the internal auditors are not independent of the entity. It is therefore expected that such supervision and review will be of a different nature and more extensive than if members of the assurance engagement team perform the work.
• Remind the internal auditors to bring accounting and auditing issues identified during the engagement to the attention of the assurance practitioner.
• Check back to the underlying assurance evidence for some of the work performed by the internal auditors.
• Make sure the internal auditors have obtained sufficient appropriate audit evidence to support the conclusions based on that work.

 The assurance practitioner should document the following in the working papers:

• Evaluation of the existence and significance of the threats to the objectivity of the internal auditors and the level of competence of the internal auditors used to provide direct assistance
• The basis for the decision regarding the nature and extent of the work performed by the internal auditors
• Who reviewed the work performed and the date and extent of that review
• The written agreements obtained from an authorised representative of the entity and the internal auditors
• The working papers prepared by the internal auditors providing direct assistance on the assurance engagement.

Conclusion

The assurance practitioner has to exercise professional judgment when determining whether the internal auditors can be used to provide direct assistance in the assurance engagement of an entity. The most important principle is, in any circumstances, the assurance practitioner should be sufficiently involved in the engagement in order to provide assurance.

Adapted from an article written by Eric YW Leung, CUHK Business School, The Chinese University of Hong Kong, FCCA