Internal auditing is an increasingly useful and important function in business endeavors of all sizes. Generally performed by employees with adequate training, this work is suitable and rewarding work for medium- sized and smaller firms and frequently can be done at off-peak times. The authors present a review of recent pronouncements and of a joint study by the AICPA and the Canadian Institute on this topic.

An independent auditor makes several key decisions when engaged to audit an entity that has an internal auditor. SAS 9, The Effect of an Internal Audit Function on the Scope of the Independent Audit,(1) provides general guidance about: * Evaluating an internal auditor's competence, objectivity, and work performance; * Making arrangements with the internal auditor; and * Using an internal auditor to provide direct assistance on an audit.

SAS 9 indicates that an internal auditor's work may have a bearing on the nature, timing, and extent of the scope of the independent audit, but it cautions that an internal auditor's work should not be substituted for that of the independent auditor. The general nature of this guidance raises several practice questions. * When is an internal auditor's work being "substituted" for that of the independent auditor? * How should the independent auditor evaluate the objectivity, competence, and work performance of an internal auditor? * What effect does the objectivity, competence, and work performance have on considering an internal auditor's work? * How does the work of the internal auditor affect the audit? * What is the maximum acceptable extent of the effect of the internal auditor's work?

To supplement the guidance in SAS 9, a joint task force of the AICPA and the Canadian Institute of Chartered Accountants (CICA) developed an Auditing Procedure Study entitled "The Independent Auditor's Consideration of the Work of Internal Auditors" (the APS). The study's objectives are: 1) to inform independent auditors of the strides internal auditors have made in establishing themselves as a profession; 2) to describe how the independent auditor can evaluate an internal audit activity; 3) to identify ways in which the independent auditor can consider an internal auditor's work; and 4) to describe efficient coordination of the independent and internal auditors' work.

This article focuses on the portions of the APS that deal with how the independent auditor evaluates the internal auditor and the ways in which the independent auditor can give consideration to the internal auditor's work.

Many small- and medium-sized companies do not have a full time internal audit activity. In such cases, management of these companies should consider the part-time use of suitable employees to conduct certain internal audit activities. Management also should consider engaging CPA firms to perform internal audit activities on a contract basis. Several local and regional CPA firms have developed this as a new area of practice, that of providing internal audit services for small- and medium-sized companies.

While the APS did not specifically refer to the consideration of internal audit work performed by another CPA firm, the authors believe that the consideration of such work is possible within the study's recommendations and conclusions. CPAs interested in performing such services should view the content of this article from the perspective of an internal auditor.

Evaluating the Internal Audit Activity

SAS 9 states that if the independent auditor decides that an internal auditor's work may bear on audit scope, then the internal auditor's objectivity and competence should be considered and his or her work performance should be evaluated. The SAS also describes some relevant factors. However, no further guidance is provided about the nature of the evaluation of the internal auditor or how this evaluation might affect the audit.

Internal audit functions range in size from separate departments with a large number of auditors to a single auditor. These functions may vary considerably in their organizational status, the education and experience of their personnel, and policies and procedures regarding staffing, planning, supervision, documentation, and work review. Because of the variety of internal audit function characteristics, the APS points out that the independent auditor may evaluate the internal audit activity at one of two levels: the department level or the specific assignment level.

Department Evaluation

A department level evaluation is appropriate when the internal audit activity has an organizational status that permits the internal auditors to act independently of the individuals responsible for the activities under audit and has effective quality assurance policies and procedures. For example, the ideal organizational status requires that the director of internal audit report to a level of management senior enough to require cooperation from audited departments and ensure that the internal auditor's recommendations are adequately considered and implemented. A number of factors that affect the organizational status and quality assurance program of the internal auditor are shown in Exhibit 1. These factors are organized as a questionnaire in the APS.

Under the departmental evaluation approach, the independent auditor's tests of controls are aimed at the effectiveness of organizational status and quality assurance policies and procedures of the internal auditors. These tests provide a basis for evaluating the internal audit activity as a whole. If the policies and procedures operate effectively, the competence, objectivity and work performance of specific internal auditors ordinarily would not need to be evaluated.

Specific Assignment Evaluation

Many small internal audit departments, including one-person shops, have not found it necessary to develop formal quality assurance programs. In these situations, the independent auditor must take the other approach to the evaluation--the specific assignment approach. Under this approach the independent auditor evaluates for each relevant internal auditor work assignment, the objectivity, competence, and performance of the individual internal auditor performing that work. Such an approach allows the internal auditor's work to be considered even if deficiencies exist in the internal auditor's organizational status or quality assurance program, or when the department is too small to justify formal policies and procedures. In those situations, the independent auditor should consider the knowledge and experience of the internal auditor performing the assignments, as well as situational pressures or conflicts of interest that may affect that internal auditor's objectivity. For example, if an internal auditor is assigned to audit activities that he or she previously performed, the independent auditor should consider this conflict of interest in the evaluation of the internal auditor's objectivity for that assignment. By comparing the content of the internal auditor's working papers to his or her report, objectivity regarding specific assignments may also be evaluated.

CPAs in public practice performing internal auditing normally would have no difficulty meeting competence, objectivity and work performance standards. Adherence to professional and ethical standards would assure this, and it should be an essential part of the terms of their engagements. Of importance would be to whom the CPA was reporting and the nature of the work product.

Considering an Internal Auditor's Work

Another significant practice question concerns how the independent auditor gives consideration to an internal auditor's work. This question has gained importance with the issuance of SAS 55, Consideration of Internal Control Structure in a Financial Statement Audit. The APS specifies that the internal auditor may affect the independent audit by: * Influencing the independent auditor's assessment of the entity's control environment; * Providing evidence by independently performing tests of controls or substantive tests; and * Performing procedures that are planned and supervised by the independent auditor, e.g., providing direct assistance.

Exhibit 2 illustrates three ways that the internal auditor may affect the independent audit.

The Internal Auditor's Influence on Control Risk

SAS 55 states that one of the factors in an entity's control environment is "management's control methods for monitoring and following up on performance, including internal auditing." Thus, in assessing control risk the independent auditor should consider the effectiveness of the internal auditor.

If the internal auditor is objective and competent, he or she can provide significant overall control. An internal auditor's monitoring of activities can reduce the risk that management may override internal controls or that employees can circumvent them. Also, employees may be more conscientious about performing control policies and procedures because their work is being monitored. When breakdowns in internal control do occur, they may be detected on a more timely basis by an effective internal auditor. Consequently, an internal auditor may increase the effectiveness of an entity's control environment and contribute to a reduction in control risk.

Relationships that affect the internal auditor's objectivity may cause him or her to be less effective in assuring the reliability of information received by the board of directors and in preventing management override of internal control. The greater the competence of an internal auditor concerning the entity's business, the industry in which it operates, and factors that contribute to an effective internal control structure, the more effective the internal auditor can be as an element of the control environment.

Work Performed Independently

In many cases, the work of an internal auditor is useful to the independent auditor because it provides evidence about the design and operating effectiveness of control structure policies and procedures or it provides evidence about various account balances or transaction classes.

The APS points out that there are several factors that the independent auditor should consider in deciding the extent to which an internal auditor's independently performed work can affect the audit. The primary consideration is the risk of material misstatement in a particular financial statement assertion.

SAS 31, Evidential Matter, states that most of the independent auditor's work in forming an opinion on financial statements consists of obtaining and evaluating evidential matter concerning the assertions in the financial statements. These assertions are: 1) existence and occurrence; 2) completeness; 3) rights and obligations; 4) valuation or allocation; and 5) presentation and disclosure. The risk of material misstatement in financial statement assertions is affected by inherent risk and control risk, and the independent auditor designs substantive tests to restrict detection risk for the assertions to the appropriate level.

For lower risk financial statement assertions, the independent auditor may decide that the assessments of inherent risk and control risk together with the internal auditor's independently performed work restrict the risk of a material misstatement to an acceptably low level. In such circumstances, direct testing of the assertion or corroboration of the internal auditor's work may not be necessary.

For higher risk assertions, the independent auditor's assessments of inherent risk and control risk together with the internal auditor's independently performed work will not restrict the risk of material misstatement to a sufficiently low level. Examples of higher risk assertions might include existence and disclosure of related party transactions and contingencies, and valuation of assets involving significant accounting estimates. In auditing these assertions, the independent auditor gives consideration to the internal auditor's work, however, significant direct testing of the assertion will be done by the independent auditor.

The APS also concludes that the nature of the evidence about the assertion affects the extent to which an internal auditor's work can affect the audit. Some assertions involve a more subjective evaluation of audit evidence than other assertions. For example, evaluating evidence about the valuation assertion for most assets requires more judgment than evaluating evidence about the existence assertion for those assets. The more judgment involved in evaluating the evidence about an assertion, the more direct testing of the assertion the independent auditor must do.

The quality of an internal auditor's work also must be considered. Evaluating quality includes considering the competence and objectivity of the personnel performing the work, as discussed earlier, and a consideration of: * The design of the internal auditor's tests; * The sufficiency of the tests, including the extent, timing, and time period covered by the tests; and * The performance of the tests, including the method of sampling.

A significant impairment of internal auditor's objectivity affects the independent auditor's ability to significantly consider the internal audit work without testing it. This results from the possibility that the impairment may affect the validity of an internal auditor's findings and reports.

The independent auditor's evaluation of competence may have a similar effect. If an internal auditor lacks particular knowledge or skills required for effective work performance, the auditor should jointly perform all work with the internal auditor.

The independent auditor would not be justified in significantly considering any work inadequately performed independently by an internal auditor. However, this would not prevent the independent auditor from using an internal auditor to perform work that is planned and supervised by the independent auditor.

If the independently performed work of the internal auditors has a significant effect on the independent audit, the independent auditor should also test the work. These tests may be accomplished by either (a) examining some of the controls, transactions, or balances that the internal auditors examined, or (b) examining similar controls, transactions, or balances, but not those actually examined by the internal auditors.

The trade-off of the time required to perform the tests directly and the time required to test an internal auditor's work should also be considered. It should be noted that it is more efficient for the independent auditor to directly perform certain tests. As a general rule, detail tests of balances and transactions are time-consuming. Therefore, it is more likely to be efficient for these procedures to be performed by an internal auditor and evaluated by the independent auditor. Analytical procedures, on the other hand, are less time- consuming and may be more efficiently performed directly by the independent auditor.

The independently performed work of the CPA in public practice acting as an internal auditor could be very useful for the entity without its own internal audit department. If the work is properly coordinated with the reporting independent auditor, it will not only contribute to the control environment, but also will permit the reporting auditor to reduce work he or she would otherwise directly have to perform.

Work Planned and Supervised by the Independent Auditor

Work may also be performed by an internal auditor but planned and supervised by the independent auditor. In such circumstances, the independent auditor plans and designs the nature, timing, and extent of the audit procedures, assigns personnel to specific tasks, and decides on the type and extent of supervision. Therefore, there is ordinarily no need to re-perform the internal auditor's work. However, the independent auditor must adequately plan, supervise, and review that work.

Extent of the Effect of an Internal Auditor's Work

SAS 9 leaves the decision about the extent of the effect of the internal auditor's work almost entirely to the independent auditor's judgment. Although the APS does not put a quantifiable limit on this extent, it does establish a conceptual limit. The auditor is reminded that evidence obtained indirectly is not as persuasive as evidence obtained directly, and that he or she must have a reasonable basis for the opinion on the financial statements.

The responsibility to render an opinion on the financial statements rests solely with the independent auditor. That responsibility is not divisible and cannot be reduced by internal auditor involvement. This places an upper qualitative limit on the extent of the effect of the internal auditor's work. At some point, the independent auditor would not have sufficient direct evidence to support the audit opinion.

Coordination of Audit Work

The APS points out that coordination of the work of the internal and independent auditors is important. Coordination reduces the overlap of audit efforts and allows maximizing the extent to which an internal auditor's work may affect the audit. Effective communication between an independent and an internal auditor is essential to this process. Specifically, the independent auditor and the internal auditor should exchange all relevant information, including: * The planned work of the internal auditor for the relevant period; * Changes in the entity and new reporting or regulatory requirements that may affect the audit; * The independent auditor's general audit plan; * Tests that the independent auditor has determined should be performed primarily by the independent audit staff; * Availability of independent and internal auditors to perform the audit work, especially those with specialized knowledge and experience; * Recent audit reports; and * Relevant audit working papers.

When CPAs in public practice undertake internal audit work, it will be helpful for them to have an understanding of the work that can affect the independent audit. Communication and planning with the reporting independent auditor will be cost-effective and is of equal importance with the work being performed by full-time internal auditors.

Practice Examples

The APS includes practice examples that illustrate the effective and efficient consideration of an internal auditor's work. These examples assume that the independent auditor has evaluated the internal audit function and found it to possess a sufficient degree of objectivity and competence to justify maximum consideration of the internal auditor's work.

Considering an Internal Auditor's Work--The Benefits

One significant advantage to considering an internal auditor's work is that internal auditors often possess skills that are particularly useful for certain audit tasks. An internal auditor generally has a detailed knowledge of the organization's policies and procedures, its business, and the industry in which it operates. If the organization has an advanced electronic data processing (EDP) system, the internal auditor may possess specialized knowledge about auditing the EDP system. Such skills and knowledge can improve both audit efficiency and effectiveness.

It's a Matter of Efficiency

The primary motivation for considering an internal auditor's work is audit efficiency. Many of the tasks an internal auditor performs provide evidence that aids in achieving the objectives of the independent audit in a cost-effective manner. To minimize the amount of audit effort overlap, the independent auditor should consider as much of an internal auditor's work as possible, consistent with the requirements of professional standards.

The motivation of using a CPA in public practice to perform functions would, however, be more than a matter of efficiency. It would provide additional assurance to management and the board of directors about the internal control structure on an ongoing basis, while at the same time having the potential for reducing the work of the reporting independent auditor. Exhibit 1 and 2 Omitted (1)SAS 9 will be superseded by a revised SAS, The Auditor's Consideration of the Internal Audit Function in an Audit of Financial Statements. The revision is currently being exposed for comment.

O. Ray Whittington, PhD, CPA, is the Director of Auditing Research for the AICPA, on leave from San Diego State University. He is a CPA in Texas and California, and a member of many professional organizations and committees, including the Reliance on Internal Auditors Task Force of the AICPA. Dr. Whittington has authored many articles appearing in professional and academic journals. He is a consultant to the AICPA and his views do not necessarily reflect those of the AICPA. Alan J. Winters, PhD, CPA, is the Friends of Accounting--Donald H. Cramer Professor at the University of South Carolina. He was formerly Director of Auditing Research at the AICPA and served as Chairman of the task force that developed SAS 55. He is a member of the AICPA Accounting and Review Services Committee and has served as a member of the National Advisory Forum for Beta Alpha Psi. Dr. Winters has been associated with national and local CPA firms and has been a consultant to several accounting firms in the area of audit policy. He has developed many CPA courses and has published articles in many national professional journals.