Using the work of others: formula sheet

Key formulas

Definition of an auditor's expert

Auditor's expert = individual or organisation with expertise outside accounting and auditing, whose work the auditor uses as audit evidence

Can be internal or external to the audit firm. Engaged by the auditor, not by management.

Evaluation of the expert

Competence + Capabilities + Objectivity

Competence is about qualifications and experience. Capabilities is about time, resources and ability. Objectivity is about threats to bias and conflicts of interest.

Agreed matters in writing

Nature, scope and objectives of work; roles and responsibilities; nature, timing and extent of communication; confidentiality

Written agreement is the safest form. It avoids disputes about what the expert was asked to do.

Evaluating adequacy of work

Relevance and reasonableness of findings + assumptions and methods + source data

Check consistency with other audit evidence and whether the work addresses the assertion you are testing.

Responsibility rule

Auditor's responsibility for the opinion is not reduced by using an expert

Do not refer to the expert in an unmodified report, unless required by law or regulation.

ISA 500 evaluation of a management's expert

Competence + Capabilities + Objectivity of expert, then Appropriateness of work (data, assumptions, methods, findings)

Both the person and the work must be assessed. Passing the first does not remove the need for the second.

Type 1 report

Description of system + design suitability at a point in time

Does not give evidence that controls operated effectively. It helps you understand and assess risk.

Type 2 report

Description of system + design suitability + operating effectiveness over a period

Can support a control reliance strategy if the period, controls and test results are relevant.

Reliance decision under ISA 402

Understand services, then assess risk, then Type 2 report OR direct tests at the service organisation OR substantive procedures at the user entity

If you cannot get sufficient appropriate evidence, consider the effect on your opinion.

Bridging the gap

Report period end to year end = gap, needing additional evidence

Use complementary user entity controls, inquiries and updated evidence for the gap.

Responsibility rule

Group engagement partner = overall responsibility for the group opinion and for direction, supervision and performance of the group audit (not reduced by use of component auditors)

The report must not refer to the component auditor unless law or regulation requires it, and even then responsibility stays with you.

Evaluating a component auditor

Ethics and independence + competence and capability + ability to be involved + oversight environment

Use this as a checklist. If concerns remain unresolved, perform the work yourself or use another auditor.

Group planning order

Understand group and environment → assess group risks → decide scope of work at components → set component performance materiality → direct and communicate → evaluate

Risk drives scope, not size alone.

Materiality layers

Component performance materiality (determined by the group engagement team) must be lower than group performance materiality

The group team determines component performance materiality and communicates it to the component auditor together with the threshold above which misstatements are not clearly trivial.

Which standard applies

Component auditor → ISA 600; internal auditor → ISA 610 (Revised 2013); auditor's expert → ISA 620

A quick way to answer the ISA 600 versus ISA 620 comparison.

Quick revision

• You have sole responsibility for the audit opinion, and relying on others does not reduce it, subject to what law or regulation requires.
• Before using internal audit, assess objectivity, competence and whether it applies a systematic, disciplined approach.
• If you use the internal audit function's work, you must evaluate whether it is adequate for the audit's purposes and perform audit procedures on the body of work as a whole. Re-performance is one example of such a procedure.
• For significant risks and highly judgemental areas, plan to do more of the work directly and limit your reliance on internal audit.
• Direct assistance means internal auditors work under your direction. It needs supervision, review and written agreement from management and the internal auditors. Law or regulation may prohibit it in some jurisdictions.
• For an auditor's expert, consider competence, capabilities and objectivity, and agree scope and roles in writing.
• Evaluate the expert's assumptions, methods and source data, and the adequacy of their findings.
• For management's expert, evaluate their competence, capabilities and objectivity, obtain an understanding of their work, and evaluate the appropriateness of that work as audit evidence (ISA 500).
• For service organisations, understand the services and their effect on the client's controls, then consider a Type 1 or Type 2 report.
• A Type 1 report covers the description and design of controls at a specific date. A Type 2 report covers the description, design and operating effectiveness over a period.
• For a group audit, the group engagement partner is responsible for the direction, supervision and review of the work on components.
• Give component auditors clear instructions, agree materiality and communicate on risks and findings.

Common mistakes

• Applying ISA 620 to an expert engaged by management. Fix: Check who engaged the expert. If management did, treat the work as evidence on an estimate and evaluate it under ISA 500 and ISA 540.
• Saying the auditor can transfer responsibility to the expert. Fix: State clearly that the auditor remains solely responsible for the opinion, whatever the expert concludes.
• Treating a Type 1 report as proof that controls operated effectively. Fix: Link Type 1 to design at a date and Type 2 to operating effectiveness over a period. Only Type 2 supports reliance on operation.
• Saying the auditor can rely on a Type 2 report without checking the period or scope. Fix: Check that the period overlaps the year end sufficiently, that the relevant controls were tested and what exceptions were reported. Plan for the gap period.
• Saying the component auditor shares responsibility for the group opinion. Fix: State clearly that the group engagement partner has overall responsibility for the group opinion and for direction, supervision and performance of the group audit. Component auditors are not mentioned in the opinion.
• Treating a component auditor as an auditor's expert and citing ISA 620. Fix: A component auditor does audit procedures on a component, so ISA 600 applies. ISA 620 is for specialists in a field other than accounting or auditing.

Exam tips

• Start every answer by deciding whether the expert is the auditor's or management's. It shows you can apply the standard and sets up the right procedures.
• Apply competence, capabilities and objectivity to named facts in the scenario. Generic lists earn few marks.
• For objectivity, always name the threat and a safeguard. Do not stop at identifying the problem.
• For professional skills marks, show scepticism: challenge the valuation's assumptions and say what you would do if the evidence is inadequate.
• Remember that responsibility stays with the auditor. A short sentence to this effect often earns a mark.
• Name the standard and the type of expert or report early. It shows the marker you have identified the issue.
• Always link to the scenario: objectivity threats, report dates, report type and exceptions are usually planted facts.
• For professional skills marks, give a clear recommendation, such as whether to rely on the report or test directly, and justify it commercially.