Advanced Auditing, Assurance and Professional Ethics · Audit Planning, Strategy and Execution

SA 610 (Revised): Using the Work of Internal Auditors

Updated 5 October 2026 · Fact-checked

SA 610 (Revised) tells the external auditor when and how to use the internal audit function's work, or its staff as direct assistance. You first decide if the function is objective and competent and applies a systematic, disciplined approach. Then you evaluate its work, re-perform some of it, and keep sole responsibility for the opinion.

Understand SA 610 (Revised): Using the Work of Internal Auditors

An entity may have an internal audit function. It is a function that assesses, evaluates and monitors the entity's governance, risk management and internal control. SA 610 (Revised) asks one question: can you, the external auditor, use that function's work to reduce your own work?

There are two ways to use it. The first is using the work of the internal audit function: you take its findings, reports or tests as audit evidence. The second is direct assistance: internal auditors work under your direction, supervision and review on the external audit itself.

The key principle is that the external auditor has sole responsibility for the audit opinion. That responsibility is not reduced by using internal audit's work or direct assistance. Your report may refer to that use only if law or regulation requires it. If it does, the report must state that your responsibility for the opinion is not reduced.

Before you use the work, you must be satisfied about the function. Check its objectivity (organisational status, reporting lines, freedom from conflicts), its competence, and whether it applies a systematic and disciplined approach, including quality control. If any of these fails, you cannot use the work of the function.

Even if the function passes, you decide the planned nature and extent of use. This depends on the judgment involved, the assessed risk of material misstatement and how much the function's objectivity and competence can be relied on. The greater the judgment and the higher the assessed risk, the less you should use the function's work, and the more you must do directly yourself.

The absolute bar on significant judgments applies to direct assistance: internal auditors giving direct assistance must not make significant judgments for you.

Key rules to remember

Responsibility rule: Responsibility for the audit opinion = external auditor alone; Using internal audit work or direct assistance never reduces or shares it.
Threshold test for using the function's work: Objectivity + Competence + Systematic and disciplined approach (all three) → work may be used; If any one is missing, you do not use the function's work.
Direct assistance prohibition: If law or regulation prohibits direct assistance, or the objectivity or competence of the internal auditors is a significant concern that safeguards cannot reduce to an acceptable level → do not use direct assistance. Otherwise, before using it, obtain written agreement from the entity's authorised representative and from the internal auditors, and communicate with those charged with governance.; You assess the threats to objectivity and the level of competence, and whether safeguards can reduce the concern to an acceptable level. The authorised representative agrees in writing that the internal auditors may follow your instructions and that the entity will not intervene in their work. The internal auditors agree in writing to keep matters confidential and follow your instructions. You also communicate with those charged with governance under SA 260 about the nature and extent of the planned use.
Judgment areas: Higher judgment and higher assessed risk → less use of internal audit work and more work done directly by you; This is a planning rule for using the function's work. The absolute bar on significant judgments applies to direct assistance.
Evaluating work used: Evaluate adequacy of work + Perform audit procedures on the work as a whole; This includes re-performing some of the work to check conclusions and evidence.
Direct assistance limit: Internal auditors must not make judgments on significant matters or perform procedures involving them; Examples are assessing significant risks, evaluating sufficiency of evidence and deciding on key estimates.

How to solve SA 610 (Revised): Using the Work of Internal Auditors questions

Use this method for any SA 610 case. Work from the gate tests to the conclusion, and tie each point to the facts.

1Identify which use is asked: using the work of the internal audit function, direct assistance, or both.
2Test the function: objectivity (status, reporting line, conflicts), competence (training, experience), and a systematic and disciplined approach (planning, supervision, documentation, quality control).
3State the result clearly. If any test fails, conclude you cannot use the work of the function.
4If the tests pass, decide the nature and extent of use, linking it to risk of material misstatement and the judgment involved. As judgment and assessed risk rise, use less of the function's work and perform more of the work yourself.
5For direct assistance, check whether law or regulation prohibits it, and whether the objectivity or competence of the internal auditors is a significant concern that safeguards cannot reduce to an acceptable level. If so, do not use direct assistance. Otherwise confirm the work is under your direction, supervision and review.
6Evaluate the work used: its quality, evidence, conclusions and consistency with reports. Re-perform a sample of it.
7For direct assistance, before using it, obtain written agreement from the entity's authorised representative that the internal auditors may follow your instructions and the entity will not intervene, and written agreement from the internal auditors that they will keep matters confidential and follow your instructions. Communicate with those charged with governance under SA 260 about the nature and extent of the planned use. In all cases, document your conclusions.
8Close with the principle: you remain solely responsible for the opinion. The report may refer to the use of internal audit work only where law or regulation requires it, and it must then state that this responsibility is not reduced.

Quickest way: Gate, limit, test, own

When to use it: Use this in case-scenario MCQs and short written answers where time is tight.

Gate: are objectivity, competence and a disciplined approach all present? One failure means no use.
Limit: as judgment and risk rise, use less of the function's work. For direct assistance, keep significant risks, significant judgments and key estimates for yourself.
Test: evaluate the work and re-perform some of it. For direct assistance, direct, supervise and review.
Own: say you alone are responsible for the opinion, and the report must not imply reduced responsibility.

Common mistakes in SA 610 (Revised): Using the Work of Internal Auditors

Saying the external auditor can share responsibility with internal auditors.
Students link use of internal audit to reliance and assume part of the responsibility moves across.
Fix: Always state that responsibility for the opinion stays solely with the external auditor, however much work is used.
Treating direct assistance and using the function's work as the same thing.
Both involve internal auditors contributing to the audit.
Fix: Direct assistance means they work under your direction, supervision and review. Using the function's work means relying on its own work product, which you evaluate.
Allowing internal auditors giving direct assistance to assess significant risks or conclude on key estimates.
Students focus on convenience and forget the judgment limit.
Fix: Significant judgments stay with you when you use direct assistance. Assign only routine or low-judgment procedures.
Listing only competence and skipping objectivity and the disciplined approach.
Students recall the competence test most easily.
Fix: Remember all three tests. An unobjective function, for example one reporting to the CFO whose area it audits, fails even if staff are skilled.
Using the work without evaluating or re-performing any of it.
A good function seems to remove the need for checking.
Fix: Always evaluate the work and perform procedures on it, including re-performance, before relying on it.
Referring to internal audit work in the auditor's report on your own initiative to show reliance.
Students think disclosure gives comfort or transparency.
Fix: Refer to the use of internal audit work or direct assistance in the report only if law or regulation requires it. When it does, the report must state that your responsibility for the opinion is not reduced.

Worked examples

Example 1

Case: You are the statutory auditor of Meridian Ltd. The internal audit function reports to the Chief Financial Officer, who also approves its budget and the audit plan. Its staff are qualified and experienced, and its work is well documented. The CFO has asked you to rely on its inventory testing to reduce your own procedures. Can you use the work of the function?

Show the solution

Identify the use: this is using the work of the internal audit function, not direct assistance.
Objectivity: the function reports to the CFO, who approves its budget and the audit plan. This weakens its organisational status and objectivity, especially for areas the CFO manages. The objectivity test fails.
Competence: the staff are qualified and experienced, so this test is met.
Disciplined approach: documentation is good, but the case gives no evidence of planning, supervision and quality control. You need not resolve this, because the objectivity test has already failed.
Conclusion: the three tests are mandatory conditions, and all must be met. Objectivity is not adequately assured, so you cannot use the work of the function.

Answer: You cannot use the work of the function. It reports to the CFO, who approves its plan and budget, which weakens its organisational status and objectivity. The objectivity test fails, and competence alone is not enough. You must perform your own inventory procedures, and you remain solely responsible for the opinion.

Example 2

Case: For Sundar Traders Ltd, the internal audit function is objective and competent and follows a disciplined approach. You plan to use two internal auditors as direct assistance. You want them to (a) count inventory at three warehouses under your supervision, and (b) conclude on the valuation of a complex derivative, a significant risk. Advise which tasks can be assigned.

Show the solution

Check pre-conditions for direct assistance: no law or regulation prohibiting it is mentioned, and there is no significant concern about the objectivity or competence of the internal auditors. Direct assistance is possible.
Task (a): inventory counts are routine, low-judgment procedures. They can be assigned if you direct, supervise and review the work.
Task (b): valuation of a complex derivative is a significant risk with high judgment. Internal auditors giving direct assistance must not make judgments on significant matters.
So you must perform or conclude on (b) yourself. You may use them only for limited, low-judgment support, such as gathering data.
Remember that you stay solely responsible, and you review the work performed and the evidence obtained.

Answer: Assign task (a) under your direction, supervision and review. Do not assign task (b) to the internal auditors for conclusion, because it involves a significant risk and high judgment. You remain solely responsible for the audit opinion.

Exam tips

In case scenarios, test the function against all three gates in order: objectivity, competence, disciplined approach. Quote the fact that fails or passes.
Always add one line that responsibility for the opinion rests solely with the external auditor. Examiners expect it.
Distinguish clearly between using the function's work and direct assistance. Mixed cases often test both.
For judgment-limit questions, identify significant risks and key estimates. Say that with direct assistance these stay with you, and that with the function's work you reduce use as judgment and risk rise.
Write answers in provision, facts and conclusion form. Keep each part to a sentence or two.

Practice questions from Audit Planning, Strategy and Execution

SA 610 (Revised): Using the Work of Internal Auditors in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

SA 610 (Revised): Using the Work of Internal Auditors: frequently asked questions

What is the difference between using internal audit's work and direct assistance under SA 610?

Using the function's work means you rely on work the function did for its own purposes, after you evaluate it. Direct assistance means internal auditors perform procedures on your audit under your direction, supervision and review. In both cases you stay solely responsible for the opinion.

When can an external auditor not use the work of the internal audit function?

You cannot use it if the function lacks objectivity, lacks competence, or does not apply a systematic and disciplined approach, including quality control. If any one of these fails, the work cannot be used.

Can the auditor refer to internal audit's work in the audit report?

Only where law or regulation requires a reference. In that case, the report must state that your responsibility for the opinion is not reduced by the use of the work. This applies whether you used the function's work or direct assistance.

Which areas should the auditor keep for himself or herself?

When using the function's work, the greater the judgment and the higher the assessed risk, the less you use that work and the more you do directly. With direct assistance, internal auditors must not make judgments on significant matters, so those stay with you.