ACCA Applied Skills · Audit and Assurance

The scope of the internal audit function, outsourcing and internal audit assignments: formula sheet

Full chapter guide

Key formulas

Three areas of internal audit scope: Scope = risk management + governance + internal control; Use these three headings to structure any answer on the role of internal audit.
Value for money (the three Es): VFM = economy + efficiency + effectiveness; Economy is low cost for the right quality. Efficiency is the best output for the input. Effectiveness is achieving the objectives.
Who decides scope: Internal audit scope: set by management or those charged with governance. External audit scope: set by law and auditing standards; A key difference. The external auditor decides procedures independently of management.
Responsibility for opinion: External auditor's responsibility for the opinion is not reduced by using internal audit work; Applies whenever the external auditor uses internal audit work.
Cost-benefit test: Establish internal audit if benefits (better control, fraud deterrence, assurance) > costs (staff, systems, management time); A judgement rule, not a calculation. Always conclude with it.
Main factors checklist: Size, complexity, number of locations and staff, risk, regulation and governance, management attitude, other monitoring, change; Use as a memory list. Pick only those the scenario supports.
Governance code expectation: Companies without internal audit should review the need annually and explain the decision; This reflects typical governance code practice for listed companies. Do not say it is a legal duty for all companies.
Forms of internal audit resourcing: In-house = own employees; Outsourced = external provider does the work; Co-sourced = shared between both; Name the form you are discussing before you list points.
Key advantages (memory aid): Skills, Flexibility, Cost, Independence/objectivity, Fresh view; Advantages are not guaranteed. Link each to the scenario.
Key disadvantages (memory aid): Knowledge, Control, Commitment, Confidentiality, Cost, Independence threat; Raise the self-review threat if the external auditor is the provider.
Management responsibility: Management stays responsible for internal control, even when internal audit is outsourced; Responsibility cannot be outsourced.
Three Es of value for money: VFM = Economy + Efficiency + Effectiveness; Economy = lowest cost for the right quality of inputs. Efficiency = best output from inputs. Effectiveness = objectives achieved.
Efficiency (general idea): Efficiency = Output ÷ Input; Compare with a target or a past period. A rise means more output per unit of input.
Assignment answer structure: Type → Objective → Work to perform → Findings → Recommendation; Use this order to keep a written answer clear and complete.
Assignment types to remember: Operational, VFM, Financial, IT, Compliance, Fraud investigation; Be ready to match each type to a scenario.
Evaluation criteria for reliance: Objectivity + Competence + Systematic and disciplined approach; If any of the three is weak, reliance is limited or ruled out. Always address all three.
Reporting line principle: Head of internal audit → audit committee (functionally); management (administratively); Functional reporting to the committee protects independence. If no audit committee exists, the board or a non-executive director is the alternative.
ISA 610 reliance steps: Evaluate function → decide extent of use → discuss and agree with internal audit → test the work; The external auditor keeps sole responsibility for the opinion.
Level of reliance guide: Higher risk and higher judgement → less reliance; lower risk and less judgement → more reliance; This is a guide to apply to the scenario, not a fixed rule.
Direct assistance: Internal auditors may help under the external auditor's direction, supervision and review; Not allowed where the work involves significant judgement or high risk; applies only where law allows it.

Quick revision

Internal audit evaluates and improves risk management, control and governance.
Internal audit objectives are set by management or those charged with governance; external audit objectives are set by law and standards.
Internal auditors report to management or the audit committee; external auditors report to shareholders.
Need for internal audit rises with size, complexity, regulation and risk.
Lack of an internal audit function does not by itself prevent the audit of financial statements.
Outsourcing can bring expertise and flexibility but may weaken company knowledge and control.
Value for money work looks at economy, efficiency and effectiveness.
Economy is low cost for the quality, efficiency is output per input, effectiveness is achieving objectives.
Operational reviews look at processes; compliance reviews check adherence to laws and policies.
Reporting to the audit committee supports independence.
Evaluate any internal audit function for objectivity, competence and due professional care.
Always link each point to the scenario facts.

Common mistakes

Saying internal audit is a legal requirement for all companies. Fix: Remember that internal audit is a choice made by the organisation. Only external audit may be required by law, depending on size and rules.
Describing internal audit only as checking the accounts. Fix: Include operational work, value for money, compliance, risk management and fraud investigation, as well as financial controls.
Saying every company must have internal audit Fix: State that it is generally optional. Need depends on cost and benefit, apart from some regulated or governance code situations.
Listing factors without using the scenario Fix: Tie every factor to a fact, for example 'the group has twelve sites, so management cannot supervise directly'.
Listing generic points with no link to the scenario. Fix: Add a scenario fact to every point, such as the company's size or lack of IT skills.
Saying outsourcing is always cheaper. Fix: Say it may reduce fixed costs, but fees can be high, especially for specialist work or if the contract is poorly managed.
Mixing up economy, efficiency and effectiveness. Fix: Link each to a question: economy asks 'what did inputs cost?', efficiency asks 'how much output per input?', effectiveness asks 'were objectives met?'.
Treating internal audit like external audit and talking about giving an opinion on the financial statements. Fix: Remember internal audit work is set by management and covers any area. Its reports go to management and the audit committee, not to shareholders as an opinion.
Saying internal auditors are fully independent of the company. Fix: Say internal audit is part of the organisation, so independence is relative. Focus on objectivity and the safeguards that protect it.
Recommending that internal audit report to the finance director. Fix: The finance director runs the area being reviewed. Recommend functional reporting to the audit committee.

Exam tips

Always organise answers around risk management, governance and internal control. It shows structure and covers the core scope.
In comparison questions, give both sides of each difference in the same sentence to earn the mark.
Use scenario details such as company size, sector and existing controls to make points specific.
In objective questions, watch for options that give internal audit the external auditor's duties, such as signing the audit opinion. They are wrong.
Remember that scope is decided by management, so say so when asked who sets it.
Always use the scenario facts. A generic list earns few marks.
Give both sides where the scenario allows, then conclude.
Mention cost and alternatives such as outsourcing or an audit committee to show judgement.