Advanced Auditing, Assurance and Professional Ethics · Internal Audit

Internal Audit Co-ordination with Statutory Auditor (SA 610)

Updated 5 October 2026 · Fact-checked

Under SA 610 (Revised), the statutory auditor may use internal audit work only after evaluating the function's objectivity, competence and systematic, disciplined approach. The auditor then decides the planned use, discusses it with the internal auditors, reads and re-tests part of the work, and keeps sole responsibility for the audit opinion. It is never a reduction of that responsibility.

Understand Internal Audit Co-ordination with Statutory Auditor

The statutory auditor and the internal auditor look at the same entity for different reasons. The internal audit function serves management and those charged with governance. The statutory auditor forms an opinion on the financial statements. Their work overlaps, mainly in controls and transaction testing, so co-ordination saves effort and avoids gaps.

SA 610 (Revised) covers two uses of internal audit. The first is using the work of the internal audit function (for example, its testing of controls or substantive procedures). The second is using internal auditors for direct assistance, where they work under the external auditor's direction and supervision. SA 610 does not apply if the entity has no internal audit function. If a function exists, the auditor first determines whether its work is likely to be adequate and relevant to the audit before deciding to use it. If the work is not relevant, the auditor does not use it.

The key idea is that the external auditor alone owns the opinion. In an unmodified opinion, the auditor should not refer to the work of the internal audit function or to direct assistance, because the reference might imply a modified opinion or that responsibility is reduced or shared. Where law or regulation requires the auditor to make such a reference, the report must state that this does not reduce the auditor's responsibility for the opinion. If the auditor uses the work, the audit documentation must show the evaluation and the procedures performed.

The auditor first decides whether the function's work can be used at all. This depends on three factors: the objectivity of the function (its organisational status and policies safeguarding independence), its competence (resources, training, professional standards), and whether it applies a systematic and disciplined approach, including quality control. If any one of these is not adequate, the auditor cannot use the work.

If they are adequate, the auditor decides how much to use. The greater the judgment involved in planning, performing and evaluating the work, and the higher the assessed risk of material misstatement, the less the auditor plans to use the work and the more he does himself. These are qualitative considerations, not a calculation. Significant risks, and areas of high judgment, call for more of the auditor's own work. Internal financial controls are an example of where the two functions often work together. For companies, the auditor reports on internal financial controls over financial reporting where the Companies Act, 2013 requires it, and internal audit testing of controls can support that work, subject to the evaluation above.

Key rules to remember

Three evaluation factors: Use of IA work requires: Objectivity + Competence + Systematic and disciplined approach; If any one is not adequate, the auditor should not use the work of the internal audit function.
Factors affecting planned use: Extent of use depends on: judgment involved in the work + assessed risk of material misstatement; These are qualitative considerations, not a calculation. Where judgment and assessed risk are higher, the auditor plans to use less of the internal audit work and does more of the procedures himself. This applies especially to significant risks.
Responsibility rule: Responsibility for the audit opinion = statutory auditor alone; Use of the work does not reduce the auditor's responsibility. In an unmodified opinion, do not refer to the work of the internal audit function or direct assistance in the auditor's report, as it might imply a modified opinion or shared responsibility. If law or regulation requires a reference, the report must state that it does not reduce the auditor's responsibility.
Procedures on work used: Evaluate quality + Test the work used (re-perform or examine similar items); Also discuss the planned use with the function, and read its reports on the work to be used.
Direct assistance: Internal auditors under auditor's direction, supervision and review; Check applicable law permits it, and get written agreement that they follow the auditor's instructions and keep matters confidential. Evaluate the existence and significance of threats to their objectivity and the level of competence of the individual internal auditors. Do not use them for work involving significant judgments, or for work related to internal audit work already used or involving decisions the internal audit function made.

How to solve Internal Audit Co-ordination with Statutory Auditor questions

Use this order for any question on using internal auditors' work, whether it is a case MCQ or a written answer.

1Identify what is being used: the work of the internal audit function, or direct assistance from internal auditors.
2Check that an internal audit function exists. If it does not, SA 610 does not apply. If it exists, decide whether its work is likely to be adequate and relevant to the audit.
3State the three evaluation factors and test the facts against each: objectivity, competence, systematic and disciplined approach.
4If any factor fails, conclude the work cannot be used and say the auditor must perform the procedures himself.
5If the factors are met, judge the nature and extent of use by the level of judgment involved and the assessed risk of material misstatement.
6Add the required procedures: discuss with the function, read its reports, and test a sample of the work used.
7Cover responsibility and communication: the auditor alone owns the opinion, and the use is documented and not referred to in the report.
8Link to internal financial controls if the question mentions them, and give a clear conclusion.

Quickest way: Three-factor test, then risk, then responsibility

When to use it: Case MCQs and short written answers where you have little time.

Scan the case for facts on independence (who the function reports to), staff skills and a documented approach.
If any fact is negative, pick the option that says the work cannot be used.
If all are positive, check the area: significant risk or high judgment means limited use.
Pick the option stating that responsibility for the opinion stays with the statutory auditor.

Common mistakes in Internal Audit Co-ordination with Statutory Auditor

Saying the auditor can rely on internal audit work fully if it is competent.
Students remember competence but forget the other two factors and the risk-based limit.
Fix: Always list all three factors and then state that extent of use depends on judgment and risk.
Writing that the internal auditor shares responsibility for the audit opinion.
Co-ordination is confused with joint responsibility.
Fix: State clearly that the statutory auditor has sole responsibility and the report does not refer to internal auditors' work.
Treating work of the function and direct assistance as the same.
Both involve internal auditors and appear in the same standard.
Fix: Remember that direct assistance means internal auditors work under the auditor's direction, supervision and review. The auditor evaluates the threats to their objectivity and their individual competence, and cannot use them for work involving significant judgments or work related to the internal audit function's own work used.
Skipping the auditor's own testing of the work used.
Students think evaluation of the function is enough.
Fix: Add that the auditor evaluates and tests the specific work used, for example by re-performing a sample.
Applying SA 610 when no internal audit function exists, or using the work without first checking it is adequate and relevant.
Students apply the standard mechanically and blur applicability with the auditor's decision to use the work.
Fix: Check first whether a function exists. If it does, determine whether its work is likely to be adequate and relevant before deciding to use it.

Worked examples

Example 1

Case: X Ltd's internal audit function reports to the Chief Financial Officer, who also decides its budget and the internal auditors' promotions. The CFO often asks internal audit to change findings on the finance department. The statutory auditor wants to use its testing of receivables controls. Can the auditor use this work?

Show the solution

The work of the internal audit function is being considered.
Objectivity: the function reports to the CFO, who controls its budget and promotions and influences findings. Its organisational status and safeguards for independence are weak.
Since objectivity is not adequate, the auditor cannot use the work, whatever the competence or approach.
The auditor must perform the control testing on receivables himself and keep responsibility for the opinion.

Answer: No. The function lacks adequate objectivity, so the statutory auditor should not use its work and must perform the procedures directly.

Example 2

Case: Y Ltd's internal audit function reports to the audit committee, has qualified staff and documented, supervised procedures. The statutory auditor assesses a significant risk of revenue recognition fraud and also wants to use internal audit's inventory count observations at low-value branches. Advise on use and procedures.

Show the solution

The three factors appear met: reporting to the audit committee supports objectivity, qualified staff support competence, and documented supervised procedures show a systematic approach.
Revenue recognition is a presumed fraud risk under SA 240 and is a significant risk here. Where significant risks are involved, the auditor should use less of the internal audit work and perform more of the procedures himself. Revenue is therefore not a good area to rely on internal audit.
Inventory counts at low-value branches involve lower risk and less judgment, so greater use is possible.
Procedures: discuss the planned use with the function, read its reports on the work, and test some of the work, for example by re-performing a sample of counts.
Responsibility stays with the statutory auditor, document the evaluation, and do not refer to internal audit in the report.

Answer: Use internal audit work for low-risk branch inventory counts after evaluation and testing of a sample. For the significant revenue recognition risk, use less internal audit work and perform more of the procedures himself. The statutory auditor alone is responsible for the opinion.

Exam tips

Write the three factors by name every time. Examiners look for objectivity, competence and systematic and disciplined approach.
In case MCQs, look for who the function reports to; it usually signals the objectivity answer.
Close every answer with the sole-responsibility statement.
Distinguish between using the work of the function and direct assistance in written answers.
For internal financial controls questions, say internal audit testing can support the auditor but does not replace the auditor's own evaluation.

Practice questions from Internal Audit

Internal Audit Co-ordination with Statutory Auditor in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

CMA FoundationCo-ordination: Concept, Need and Techniques

Internal Audit Co-ordination with Statutory Auditor: frequently asked questions

What does SA 610 (Revised) deal with?

It deals with the statutory auditor's responsibilities when using the work of the internal audit function or when using internal auditors to give direct assistance. It also deals with how the auditor decides if such use is possible.

Can the statutory auditor mention the internal auditor's work in the audit report?

Not in an unmodified opinion. The auditor should not refer to the work of the internal audit function or direct assistance, because the reference might imply a modified opinion or that responsibility is reduced or shared. If law or regulation requires a reference, the report must state that it does not reduce the auditor's responsibility. The statutory auditor alone is responsible for the opinion expressed.

Does internal audit help with internal financial controls reporting?

It can. Internal audit testing of controls may provide evidence, if the auditor first evaluates the function and tests the work used. The auditor still forms his own conclusion on internal financial controls.

What if the entity has no internal audit function?

SA 610 does not apply in that case. The auditor performs all procedures himself.