Audit and Assurance · The work of others

Using the Work of Internal Auditors under ISA 610

Updated 11 October 2026 · Fact-checked

ISA 610 lets the external auditor use the internal audit function's work only after assessing its objectivity, competence and use of a systematic, disciplined approach. The auditor then decides how much to rely on it, plans its use, and reviews it. The external auditor keeps sole responsibility for the opinion.

Understand Using the Work of Internal Auditors

Internal auditors work for the entity. They review controls, risks and operations. External auditors give an opinion on the financial statements. Their work sometimes overlaps, so the external auditor may use internal audit work to save time and cost.

The key point is responsibility. The external auditor alone is responsible for the audit opinion. Using internal audit work does not reduce that responsibility. So the auditor must first decide whether using the work is appropriate at all.

ISA 610 asks you to assess the internal audit function on three areas:

Objectivity: its organisational status, who it reports to, and whether management can restrict or influence it.
Competence: its resources, training, qualifications and experience.
Systematic and disciplined approach: whether it plans, supervises, reviews and documents its work, with quality control.

If the function is not objective or competent, or lacks a systematic approach, the auditor cannot use its work. If it passes, the auditor then takes a separate step. This is to plan how the work will be used and to consider whether it is likely to be adequate for the audit. The more judgement involved and the higher the risk, the less the auditor should rely on it. For significant risks, use less.

ISA 610 also covers direct assistance: internal auditors working under the external auditor's direction, supervision and review. Direct assistance is not allowed where law or regulation prohibits it, or where the internal auditors' objectivity or competence is not sufficient. The auditor needs written agreement from an authorised representative of the entity. It must permit the internal auditors to follow the auditor's instructions and say the entity will not interfere with their work for the auditor. The auditor also needs written agreement from the internal auditors that they will follow the auditor's instructions and keep matters confidential.

The auditor must not use internal auditors to provide direct assistance on procedures that involve making significant judgements, or that relate to higher assessed risks of material misstatement where the judgement needed in performing the procedures is more than limited. The auditor must also consider the extent of the internal auditors' prior involvement when assigning work.

Key rules to remember

Assessment criteria: Objectivity + Competence + Systematic and disciplined approach; All must be satisfied before the auditor uses the work. Failing one means do not use it.
Responsibility rule: Sole responsibility for the audit opinion rests with the external auditor; Use of internal audit work never reduces or shares this responsibility.
Extent of use: Higher judgement or higher assessed risk → less use of internal audit work; Significant risks, estimates and key judgements need more direct external auditor work.
Evaluating specific work: Adequate work? Conclusions appropriate? Reports consistent with results? Unusual matters properly resolved?; Test some of the work used by re-performing or examining similar items.
Direct assistance conditions: Not prohibited by law + objectivity and competence assessed + written agreement + direction, supervision and review; Internal auditors must follow the external auditor's instructions and management must not interfere.

How to solve Using the Work of Internal Auditors questions

Use this order for any scenario asking whether, and how, the external auditor can use internal audit.

1Read the scenario and note the facts on reporting lines, staff, methods and the area of work to be used.
2Assess objectivity: who the function reports to, whether management can restrict it, and whether it is independent of the areas it reviews.
3Assess competence: size of team, qualifications, training, experience and resources.
4Assess whether it uses a systematic, disciplined approach: planning, supervision, review, documentation and quality control.
5Decide the conclusion: if any criterion fails, do not use the work. If all pass, consider which areas to use.
6Consider the nature of the area: judgemental or high-risk areas need less reliance and more external auditor work.
7Explain how to use the work: discuss with internal audit, direct, supervise and review it, and test some of it by re-performing.
8State that the external auditor keeps full responsibility for the opinion.

Quickest way: The O-C-S check

When to use it: Use it for short Section A or OT case questions asking whether the auditor can rely on internal audit.

Look for an objectivity fact, such as reporting to the finance director or to the audit committee.
Look for a competence fact, such as qualifications and team experience.
Look for a systematic approach fact, such as documented working papers and review.
One weak criterion means the work cannot be used, even if the others are strong.
If asked about extent, choose less use for judgemental or high-risk areas.

Common mistakes in Using the Work of Internal Auditors

Saying the external auditor can pass responsibility to internal audit
Students think relying on work means sharing the blame.
Fix: State that the external auditor has sole responsibility for the opinion, however much work is used.
Only discussing competence and forgetting objectivity
Competence is easier to spot in a scenario.
Fix: Always write all three headings: objectivity, competence, systematic and disciplined approach.
Confusing using the work with direct assistance
Both involve internal auditors helping with the audit.
Fix: Using the work means relying on work done independently. Direct assistance means internal auditors work under the external auditor's direction, supervision and review.
Giving internal auditors high-risk or judgemental areas
Students focus on saving time and cost.
Fix: Allocate routine, low-risk areas to internal audit. Keep significant risks and key judgements with the external audit team.
Listing differences between internal and external audit when asked about reliance
The topics sit close together in the syllabus.
Fix: Answer the requirement set. Reliance questions need assessment and use of the work, not a general comparison.
Forgetting to review the work
Students think a good assessment is enough.
Fix: Say the auditor must evaluate and test the work, for example by re-performing a sample of it.

Worked examples

Example 1

Kestrel Co's internal audit department has six staff, mostly qualified accountants. It reports to the finance director, who sets its programme and reviews its findings before they go to the board. Its work is planned, documented and reviewed by the head of internal audit. The external auditor wants to use its inventory count work. Advise whether the work can be used. (6 marks)

Show the solution

Objectivity: reporting to the finance director, who also sets the programme and reviews findings, threatens objectivity. Management can influence what is reviewed and reported.
Competence: six staff, mostly qualified accountants, indicates adequate competence, although experience and training should be confirmed.
Systematic approach: work is planned, documented and reviewed, which is positive.
Conclusion: objectivity is not satisfied. Without objectivity the external auditor should not use the work.
Alternative: ask whether the function could report to the audit committee or non-executive directors. If so, reassess.
Meanwhile the external auditor should do its own inventory work, as responsibility for the opinion is theirs alone.

Answer: The external auditor should not use the work as it stands because objectivity is weakened by the finance director's control. Competence and systematic approach appear acceptable. The auditor should perform its own inventory testing unless reporting lines are improved.

Example 2

Delta Co is a large group with a respected internal audit function that reports to the audit committee. The external auditor has assessed it as objective, competent and systematic. The auditor plans to use its work in three areas: testing controls over payroll, attending routine inventory counts at small warehouses, and valuing a complex derivative. Explain which areas are suitable and how the work should be managed. (6 marks)

Show the solution

Payroll controls testing: suitable for using the function's work, provided the auditor's own risk assessment shows payroll to be lower risk and the judgement involved to be low. If payroll were assessed as higher risk, less reliance would be placed on the work.
Routine counts at small warehouses: suitable for using the function's work, provided the auditor's risk assessment shows these counts to be lower risk and low judgement. If the assessment shows otherwise, the auditor should rely on the work less.
Derivative valuation: complex, judgemental and high risk. Reliance on internal audit work should be limited, and the external auditor should do most of the work itself, perhaps with an expert. Internal auditors should not give direct assistance on it because it involves significant judgements.
Management of the work: agree scope and timing with internal audit and discuss the work to be used.
Review and test: evaluate the work used, re-perform or examine a sample, and check conclusions are supported.
If the auditor instead used internal auditors for direct assistance on the lower-risk areas, it would need written agreement from an authorised representative of the entity and from the internal auditors, and would direct, supervise and review their work. It would also consider their prior involvement in the areas.
Responsibility: the external auditor remains solely responsible for the opinion.

Answer: Payroll controls testing and routine inventory counts are suitable areas in which to use internal audit work, provided the auditor's risk assessment shows them to be lower risk and low judgement, and subject to evaluation and testing. The derivative valuation needs much less reliance on internal audit and mostly external auditor work because of its complexity and risk, and it should not be given to internal auditors as direct assistance. The external auditor keeps full responsibility.

Exam tips

Use the headings objectivity, competence and systematic approach in every answer. They anchor the marks.
Read reporting lines closely in scenarios. A function reporting to the finance director is a classic objectivity trap.
Match the area to the risk. Routine and low-risk areas suit internal audit. Judgemental and significant-risk areas need less reliance and more external auditor work, and direct assistance is not allowed for significant judgements.
Always add that the external auditor keeps sole responsibility for the opinion. It is an easy mark.
In OT questions, one failed criterion is enough to rule out reliance.

Using the Work of Internal Auditors in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Using the Work of Internal Auditors: frequently asked questions

Can the external auditor rely on internal audit work without any checks?

No. The auditor must first assess objectivity, competence and a systematic approach. Then the auditor must evaluate the specific work, for example by re-performing some of it.

What is direct assistance under ISA 610?

It is where internal auditors help the external audit team under the external auditor's direction, supervision and review. It is not allowed where law prohibits it. The auditor needs written agreement from an authorised representative of the entity and from the internal auditors. The auditor must not use them for procedures involving significant judgements, or for higher assessed risks where the judgement needed is more than limited.

Does using internal audit reduce the external auditor's responsibility?

No. The external auditor has sole responsibility for the audit opinion. Using internal audit work only affects the nature, timing and extent of the auditor's own procedures.

How do internal and external audit differ?

Internal audit serves management and the board and has a wide scope set by the entity. External audit gives an independent opinion on the financial statements to the shareholders. For reliance questions, focus on assessment and use, not the full comparison.