Advanced Audit and Assurance (International) · Using the work of others

Using the Work of Internal Auditors under ISA 610

Updated 11 October 2026

ISA 610 (Revised 2013) tells external auditors when they may use internal audit work. You first decide whether the function is likely to be relevant. You then evaluate its objectivity, competence and systematic, disciplined approach. If these hold, you can use its work or direct assistance, but you alone remain responsible for the opinion.

Understand Using the Work of Internal Auditors (ISA 610)

Many large entities have an internal audit function. Its work may overlap with your audit. Using it can save time and cost. But the internal auditors are part of the entity, so you cannot simply accept what they report.

ISA 610 gives you a test. First, decide whether the function's work is likely to be relevant to your audit. Then decide whether it is adequate for your purposes. You do this by evaluating three things: the objectivity of the function, the competence of its staff, and whether it applies a systematic and disciplined approach, including quality control.

There are two ways to use internal audit. You can use their work, for example by relying on their tests of controls. Or you can use internal auditors to give direct assistance, where they work under your direction and supervision on your audit procedures. Direct assistance is only allowed where law or regulation does not prohibit it. You must also evaluate the existence and significance of threats to the internal auditors' objectivity, and their level of competence. If threats cannot be eliminated or reduced to an acceptable level by safeguards, or if the internal auditors lack sufficient competence, you must not use direct assistance.

The key point is responsibility. You are solely responsible for the audit opinion, and that responsibility is not reduced by using internal audit. The more judgement involved, the higher the assessed risk, and the less you should rely on others. You must also tell those charged with governance how you plan to use the function and the extent of direct assistance.

In AAA, questions are scenario based. You must apply the criteria to the facts given, such as reporting lines, staff qualifications or lack of documented procedures, and reach a reasoned conclusion on whether and how far to rely.

Key rules to remember

Overall test for using the work: Use the work only if: (1) the work is likely relevant, and (2) the function is adequate: objectivity + competence + systematic and disciplined approach; Evaluate all three factors. A weakness in one limits or stops reliance.
Direct assistance conditions: Direct assistance allowed only if: not prohibited by law or regulation, AND threats to objectivity are eliminated or reduced to an acceptable level by safeguards, AND internal auditors have sufficient competence, AND work is directed, supervised and reviewed by you; You evaluate the threats to objectivity and the level of competence. If threats cannot be eliminated or reduced to an acceptable level by safeguards, or the internal auditors lack sufficient competence, do not use direct assistance.
Judgement rule for extent of use: Higher judgement and higher assessed risk → less use of internal audit work; Applies to areas such as significant risks, estimates and fraud-related matters, where more of the work should be done by you.
Evaluating the specific work: Evaluate the specific work: sufficient evidence, appropriate conclusions, consistent reports, and perform audit procedures on the body of work as a whole; Your procedures on the work may include re-performing some of it. The extent depends on risk and judgement.
Responsibility: External auditor sole responsibility for the opinion; not reduced by using internal audit; The auditor's report shall not refer to the work of the internal audit function unless law or regulation requires it. Even then, the reference does not reduce your responsibility for the opinion.

How to solve Using the Work of Internal Auditors (ISA 610) questions

Use this method for any question on using internal audit work or direct assistance.

1Read the requirement. Decide if it asks about the evaluation, the type of use, the limits, or the procedures to perform.
2Decide whether the function is likely relevant. Link its activities to your audit objectives and risks.
3Evaluate objectivity using facts from the scenario: reporting lines, access to the audit committee, management influence, and any threats to independence.
4Evaluate competence: qualifications, training, experience and resources of the staff.
5Evaluate whether it applies a systematic and disciplined approach: planning, supervision, review, documentation and quality control.
6Conclude on whether to use work, direct assistance, both, or neither. Match the extent of use to the risk and judgement involved.
7Describe how you evaluate the specific work: review, test and re-perform a sample, and check that conclusions are supported.
8Close with responsibility and communication: you remain solely responsible, direct and supervise assistance, and inform those charged with governance.

Quickest way: The O-C-S-L method

When to use it: Use when you have little time and the scenario gives facts about an internal audit department.

O: Objectivity. Who does internal audit report to? Is it free from management influence?
C: Competence. Are staff qualified, trained and experienced?
S: Systematic. Is there planning, review, documentation and quality control?
L: Limits. High risk and high judgement areas stay with you. You keep sole responsibility.
Write one point for each, tied to a fact in the scenario, then give a clear conclusion.

Common mistakes in Using the Work of Internal Auditors (ISA 610)

Saying the external auditor can pass responsibility to internal audit.
Students think reliance means sharing the work and the blame.
Fix: State that the external auditor has sole responsibility for the opinion, and that using internal audit does not reduce it.
Listing the three criteria without applying them to the scenario.
Students memorise the headings and stop there.
Fix: Use each scenario fact. For example, a head of internal audit reporting to the finance director weakens objectivity. Say why it matters.
Confusing using the work of internal audit with direct assistance.
Both involve internal auditors contributing to the audit.
Fix: Remember that direct assistance means internal auditors work under your direction, supervision and review. Using their work means you evaluate what they have already done.
Allowing internal audit to do work on significant risks or judgemental areas.
Students focus on saving time and cost.
Fix: Say that the higher the judgement and risk, the less you rely. Keep significant risks, estimates and fraud-related areas with the external audit team.
Forgetting to evaluate and test the internal audit work.
Students stop once the function is judged adequate.
Fix: Add that you must evaluate the specific work and perform audit procedures on it as a whole, which may include re-performing some of it. The extent of testing rises with risk and judgement.
Ignoring law and regulation and communication with those charged with governance.
These points feel minor compared with the three criteria.
Fix: Mention that direct assistance may be prohibited by law or regulation, and that you tell those charged with governance about the planned use.

Worked examples

Example 1

Greenfield Ltd has an internal audit department of four staff. The head of internal audit reports to the finance director and is also involved in designing new accounting controls. Two staff are qualified accountants with several years of experience. Audit work is not formally planned, and reviews of work are not documented. Evaluate whether you can use the work of internal audit. (10 marks)

Show the solution

Relevance: assume the function tests inventory and purchasing controls, which relate to your audit risks. This makes the work potentially relevant, so a full evaluation is needed.
Objectivity: the head reports to the finance director, not to the audit committee or board. This reduces organisational status and increases the risk of management influence. Designing controls creates a self-review threat, because internal audit would later test controls it designed.
Competence: two of four staff are qualified accountants with experience, which is positive. The other two staff have no stated qualifications, so competence is unclear for them. You would need to learn more about training and experience.
Systematic and disciplined approach: work is not planned and reviews are not documented. This suggests weak quality control. You cannot rely on conclusions that cannot be supported by documentation.
Conclusion: the function fails the criteria. There is a threat to objectivity and there is no systematic and disciplined approach, so you should not use its work or direct assistance. You should perform your own audit procedures on the inventory and purchasing areas.
Responsibility: you stay solely responsible for the opinion, and your own procedures must provide the evidence you need.

Answer: You should not use the work of internal audit, and you should not use direct assistance. Objectivity is weakened by the reporting line and the self-review threat. There is no systematic and disciplined approach, even though some staff are competent. The function fails the criteria, so you perform your own procedures and keep sole responsibility for the opinion.

Example 2

During planning for Meridian Plc, internal audit offers to perform the year-end inventory counts at remote warehouses and to test the valuation of a complex derivative. Internal audit is objective, competent and applies a systematic approach. Discuss how far you could use internal audit in each area. (8 marks)

Show the solution

Start from the finding that the function meets the three criteria. Using its work or direct assistance is therefore possible, unless law or regulation prohibits it. ISA 610 does not allow direct assistance for procedures that involve significant judgement, that relate to higher assessed risks of material misstatement, or that relate to work with which the internal auditors have been involved and which has been or will be reported to management or those charged with governance.
Inventory counts: how you use internal audit depends on whose procedures the counts are. If the counts are internal audit's own procedures and are reported to management, direct assistance is not allowed for that work. You may instead consider using their work, after evaluating it and performing audit procedures on it. If the counts are carried out under your direction for the audit, direct assistance may be possible, but only if you assess the risk of material misstatement for inventory at these warehouses as lower and the procedure involves limited judgement. Internal auditors would then attend counts under your direction, supervision and review. Your team should still attend the key locations and may re-perform a sample of test counts. If inventory is a higher-risk area, keep the counts with your team.
Derivative valuation: this involves a high level of judgement and is probably a significant risk. Direct assistance is prohibited for this kind of procedure, and the more judgement involved, the less reliance should be placed on others. This area should be done by your team, possibly with an auditor's expert under ISA 620.
Evaluation: whichever area is used, evaluate the work performed. Check evidence is sufficient, conclusions are appropriate and reports are consistent with the results. Perform audit procedures on the work, which may include re-performing some of it.
Communication: tell those charged with governance about the planned use and direct assistance. Remember you stay solely responsible for the opinion.

Answer: For the inventory counts, the answer depends on whose procedures they are. If they are internal audit's own counts reported to management, you may consider using their work after evaluating it, but not direct assistance. If the counts are done under your direction for the audit, direct assistance is possible only if inventory is lower risk and the judgement is limited, with your team supervising and reviewing. You must not use direct assistance for the derivative valuation because of the high judgement and risk. You keep sole responsibility and inform those charged with governance.

Exam tips

Always apply the three criteria to the scenario facts. A list of headings earns few marks.
Mention both objectivity and competence, but do not forget the systematic and disciplined approach. Many answers miss it.
Distinguish clearly between using the work and direct assistance, and state the extra conditions for direct assistance.
Link the extent of reliance to risk and judgement, and give an example of work you would keep for yourself.
Earn professional skills marks with a clear conclusion and a practical recommendation, for example limited use after re-performing a sample.

Practice questions from Using the work of others

Using the Work of Internal Auditors (ISA 610): frequently asked questions

Can an external auditor use internal auditors for direct assistance under ISA 610?

Yes, but only where law or regulation does not prohibit it. You must evaluate threats to objectivity and the level of competence. If threats cannot be eliminated or reduced to an acceptable level by safeguards, or competence is insufficient, you cannot use direct assistance. They work under your direction, supervision and review, and you stay solely responsible for the opinion.

What factors do you evaluate when assessing the internal audit function?

You evaluate objectivity, competence and whether the function applies a systematic and disciplined approach, including quality control. You also consider whether its work is likely to be relevant to your audit. A weakness in any one factor limits reliance.

Can the auditor refer to internal audit in the auditor's report?

Not normally. ISA 610 says the auditor's report shall not refer to the work of the internal audit function unless law or regulation requires it. Even where a reference is required, it does not reduce your responsibility for the opinion.

Which areas should the external auditor not delegate to internal audit?

Areas with high judgement and high assessed risk should be done mainly by you. Examples are significant risks, complex estimates and fraud-related matters. The higher the risk, the less you should use internal audit work.