IAASB proposed enhanced standard on using the work of Internal Auditors, revised to ISA 315 and ISA 610

On July 15, 2010, IAASB issued an Exposure Draft (ED) for the proposed revision of ISA 610, Using the Work of Internal Auditors. The standard is being revised in recognition of developments in the internal auditing environment as well as the evolving relationship between internal and external auditors. As a result of the revision of ISA 610, changes are also being proposed to ISA 315, Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment.

The IAASB's objective in revising ISA 315 and ISA 610 is to enhance the performance of external auditors by, (a) enabling them to better consider and leverage, as appropriate, the knowledge and findings of an entity's internal audit function in making risk assessments in the external audit, and (b) strengthening the framework for the evaluation and, where appropriate, use the work of internal auditors in obtaining audit evidence. The IAASB believes that the proposed revision will enhance the quality of audits internationally.

In determining whether the work of the Internal Audit function can be used, the IAASB proposes that the external auditor's initial assessment should be based on an evaluation of the internal audit function's degree of objectivity (as supported by its organization status, and relevant policies and procedures), level of competence and application of a systematic and disciplined approach, including quality control. The related requirements and guidance on factors to consider in making this evaluation have been updated to reflect developments in internal audit practice.

In some jurisdictions, internal auditors provide direct assistance to the external auditor through performance of audit procedures on the audit engagement under the direction, supervision, and review of the external auditor. Extant ISA 610 states explicitly that it does not deal with such instances. There is ambiguity about whether the fact that ISA 610 does not deal with direct assistance meant that the IAASB does not support its use, or whether it was simply not addressed in the scope of the ISA. However, national auditing standards of a number of jurisdictions allow for direct assistance, and it is common practice in many; while in others, it is not allowed. The IAASB concluded that continued ambiguity about its intent is not in the public's interest.

The IAASB believes, that, the proposed requirements will :

(a)  provide a framework for determining the nature and extent of the work of the internal audit function that can justifiably the used in the external audit; and

(b)  set out clear boundaries to guard against use of the work of the internal audit function in circumstances in which it would be inappropriate.

Comments for this ED are requested by November 15, 2010. Respondents are asked to submit their comments electronically through the IAASB website (www.iaasb.org), using the "Submit a Comment" link on the Exposure Draft and Consultation Papers page.

Comments can also be faxed to the attention of the IAASB Technical Director at +1 (212) 856-9420, or mailed to : Technical Director - International Auditing and Assurance Standards Board, 545 Fifth Avenue, 14th Floor, New York, New York 10017 USA.

Copies of the exposure draft may be downloaded free of charge from the IAASB website at www.iaasb.org, or just follow the download link in here : Proposed ISA 315 (Revised), Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and its Environment, and ISA 610 (Revised), Using the Work of Internal Auditors

WHY We Need to Know the Client's Business ?

Obtaining an understanding of the client’s business is key to an effective and efficient audit. It enables us not only to tailor our work to meet the individual facts and circumstances of each client, but also to carry out that work and to evaluate our findings in an informed manner. Our knowledge of the client’s business also helps us to develop and maintain a positive professional relationship with the client.

International Standards on Auditing (ISA) 315 states that the auditor should obtain an understanding of the entity and its environment, including its internal control, sufficient to identify and assess the risks of material misstatement of the financial statements whether due to fraud or error, and sufficient to design and perform further audit procedures.

Understanding the entity is an iterative process, continuing throughout the entire duration of the audit.

Prior the accepting an audit engagement, we should obtain a preliminary knowledge of the industry and of the ownership, management and operations of the entity to be audited.

Detailed information is required at the planning stage of our audit to enable us to plan our work adequately. We need to understand the nature of client’s business, its organization, its method of operation and the industry in which it is involved. This understanding enables us to appreciate which events and transactions are likely to have a significant effect on the financial statements.

Specifically, such an understanding helps us to :

• Identify the areas of high risk where we should concentrate our audit effort
• Maximize efficiency in other areas of audit significance
• Assess the potential for use of analytical procedures, by enabling us to identify the information which we can use to make predictions and comparisons
• Obtain an understanding of the internal control structure
• Assess the inherent and control risks in the key areas of audit significance
• Develop an audit strategy enabling us to obtain the necessary audit evidence in the most effective and efficient manner possible.

Knowing the client’s business helps us in a number of ways both during the conduct of the audit, and when we come to complete our work.

This includes, for example, helping us in :

• Recognising errors in the financial statements
• Asking the right questions and evaluating the reasonableness of the answers we receive
• Making judgements about the appropriateness of the client’s accounting principles, policies and procedures
• Identifying unusual or unexpected transactions and related party transactions
• Interpreting the results of audit tests and evaluating their effect
• Carrying out appropriate procedures to review events occurring after the balance sheet date
• Carrying out an overall review of the financial statements.

Knowledge of the client’s business and the industry in which it operates is essential also to the development of a positive relationship and it helps us as follows :

• In understanding the management’s philosophy and aspirations for the business
• Understanding the business strategy and plans
• Providing relevant and practical business advice to the client
• Identifying areas in which the client might benefit from other professional services which we provide.

ISA 315 states that :

• the auditor should obtain an understanding of relevant industry, regulatory, and other external factors including the applicable financial reporting framework
• the auditor should obtain an understanding of the nature of the entity
• the auditor should obtain an understanding of the entity's selection and application of accounting policies and consider whether they are appropriate for its business and consistent with the applicable financial reporting framework and accounting policies used in the relevant industry
• the auditor should obtain an understanding of the entity's objectives and strategies, and the related business risks that may result in material misstatement of the financial statements
• the auditor should obtain an understanding of the measurement and review of the entity's financial performance.

Each year, the auditor's understanding of the entity should be updated and details of significant changes documented (Hrd) ***