ACCA Applied Skills · Audit and Assurance

The work of others: formula sheet

Full chapter guide

Key formulas

Assessment criteria: Objectivity + Competence + Systematic and disciplined approach; All must be satisfied before the auditor uses the work. Failing one means do not use it.
Responsibility rule: Sole responsibility for the audit opinion rests with the external auditor; Use of internal audit work never reduces or shares this responsibility.
Extent of use: Higher judgement or higher assessed risk → less use of internal audit work; Significant risks, estimates and key judgements need more direct external auditor work.
Evaluating specific work: Adequate work? Conclusions appropriate? Reports consistent with results? Unusual matters properly resolved?; Test some of the work used by re-performing or examining similar items.
Direct assistance conditions: Not prohibited by law + objectivity and competence assessed + written agreement + direction, supervision and review; Internal auditors must follow the external auditor's instructions and management must not interfere.
Definition of an auditor's expert: Auditor's expert = individual or organisation with expertise in a field other than accounting or auditing, whose work is used by the auditor to help obtain sufficient appropriate audit evidence; Can be internal (firm's own specialist) or external (hired by the firm).
Three evaluation factors: Competence + Capabilities + Objectivity; Competence is the nature and level of expertise. Capabilities is the ability to use that competence in the engagement circumstances. Objectivity is the risk of bias, conflict of interest or undue influence.
Information on competence and objectivity: Sources: personal experience of earlier work, discussions with the expert, discussions with other auditors, knowledge of qualifications and membership of a professional body, published papers or books, the expert's quality control policies; Useful checklist for written answers.
Matters to agree with the expert: Nature, scope and objectives of work; roles and responsibilities; nature, timing and extent of communication; need for the expert to observe confidentiality; Should be agreed in writing where appropriate.
Evaluating the work: Relevance and reasonableness of findings and conclusions; consistency with other evidence; assumptions and methods used; source data (relevance, completeness, accuracy); If the work is inadequate, agree further work with the expert or perform other procedures.
Responsibility rule: Responsibility for the audit opinion stays solely with the auditor; Do not refer to the expert in an unmodified report.
Type 1 report: Type 1 = description of system + design and implementation of controls at a point in time; No testing of operating effectiveness. It cannot support reduced substantive testing based on controls working.
Type 2 report: Type 2 = Type 1 content + tests of operating effectiveness over a period; Can be used as evidence that controls operated effectively, if the period and controls are relevant.
Roles: User entity = client; user auditor = you; service organisation = provider; service auditor = provider's auditor; Use these terms exactly in written answers.
Responsibility: User auditor's responsibility for the opinion is not reduced by outsourcing; Do not refer to the service auditor in the audit report on the user entity's statements.
Responsibility principle: Group auditor's responsibility for the opinion = 100% (not reduced by using component auditors); Do not refer to the component auditor in an unmodified report. Say the group auditor is solely responsible.
Assessing a component auditor: Competence + Independence + Ethical and framework understanding + Oversight; Use this as a checklist when asked what you consider before relying on another auditor.
Component work by significance: Significant component → audit of its financial information (or specified procedures for significant risks). Other components → analytical procedures or limited procedures; Work is scaled to size and risk. Component materiality is set lower than group materiality.
Opening balances (ISA 510): Opening balances evidence = Review of prior year audit / predecessor work + own procedures; Predecessor's clean opinion is not sufficient by itself. If evidence is lacking, consider a qualified opinion or disclaimer.

Quick revision

You keep sole responsibility for the audit opinion, whoever else did work.
Assess any other party on competence, capabilities and objectivity before using their work.
Internal audit work is useful only if it is adequate for your purpose and you have evaluated it.
The more judgement involved in an area, the less you can rely on internal audit work.
Direct assistance from internal auditors is restricted by the level of risk and their objectivity.
An auditor's expert may be management's or your own; the evaluation differs in scope and objectivity.
Agree the expert's scope, work, roles and reporting in writing.
Evaluate the expert's findings, assumptions, methods and source data for reasonableness.
A type 1 report covers design at a date; a type 2 report covers design and operating effectiveness over a period.
A user auditor needs to understand how the service organisation's controls affect the financial statements.
For groups, the group auditor decides the involvement needed in component auditors' work.
Do not refer to the expert or another auditor in an unmodified opinion.

Common mistakes

Saying the external auditor can pass responsibility to internal audit Fix: State that the external auditor has sole responsibility for the opinion, however much work is used.
Only discussing competence and forgetting objectivity Fix: Always write all three headings: objectivity, competence, systematic and disciplined approach.
Treating the client's own valuer or actuary as an auditor's expert and applying ISA 620. Fix: Ask who engaged them. If management did, it is a management's expert and you evaluate their work as audit evidence under ISA 500. If the audit firm did, ISA 620 applies.
Saying the auditor can pass responsibility to the expert. Fix: State clearly that the auditor alone is responsible for the opinion and that an unmodified report must not refer to the expert.
Saying the auditor has no responsibility because the function is outsourced. Fix: State that the user auditor remains fully responsible for the opinion and must obtain sufficient appropriate evidence.
Treating a Type 1 report as proof that controls operated effectively. Fix: Type 1 covers design and implementation at a date only. Only Type 2 tests operating effectiveness over a period.
Saying responsibility passes to the component auditor. Fix: Always state that the group auditor remains solely responsible for the group opinion.
Relying on a component auditor without assessing them. Fix: List competence, independence, ethical understanding and oversight, and apply each to the scenario.

Exam tips

Use the headings objectivity, competence and systematic approach in every answer. They anchor the marks.
Read reporting lines closely in scenarios. A function reporting to the finance director is a classic objectivity trap.
Match the area to the risk. Routine and low-risk areas suit internal audit. Judgemental and significant-risk areas need less reliance and more external auditor work, and direct assistance is not allowed for significant judgements.
Always add that the external auditor keeps sole responsibility for the opinion. It is an easy mark.
In OT questions, one failed criterion is enough to rule out reliance.
Always check who engaged the expert first. Auditor engaged means ISA 620. Management engaged means a management's expert, treated as audit evidence.
Write competence, capabilities and objectivity as separate headings, with a scenario-based point under each. This is where marks sit.
Do not forget to evaluate the expert's work. Name assumptions, methods and source data.