Auditing and Ethics · Audit Evidence

Using Other Auditors, Internal Audit and Service Organisations (SA 600, SA 610, SA 402)

Updated 5 October 2026 · Fact-checked

An auditor may use the work of internal auditors (SA 610), other auditors (SA 600) or a service organisation's auditor reports (SA 402) as audit evidence. But the auditor stays solely responsible for the opinion. You assess competence, objectivity and quality, evaluate the work, and do your own procedures where needed.

Understand Using Other Auditors, Internal Audit and Service Organisations

Audit evidence does not always come from your own team. Sometimes other people have already done work that is useful to you. The client's internal audit department may have tested controls. Another firm may audit a branch or subsidiary. A service organisation, such as a payroll processor or a custodian, may run processes that affect the client's financial statements.

The core principle is the same for all three: you may use their work, but you cannot share or pass on responsibility for your opinion. Relying on others does not reduce your responsibility. So you must be satisfied that the work is good enough for your purpose.

SA 610 (Revised) Using the Work of Internal Auditors covers two things: using the internal audit function's work, and using internal auditors to give direct assistance. You first decide whether the work can be used. This depends on three criteria: the function's objectivity (its organisational status and policies), its technical competence, and whether it applies a systematic and disciplined approach (including quality control). You also consider whether the work is likely to be adequate for the purposes of your audit. If you use the work, you evaluate its quality and perform procedures on it. Direct assistance is not permitted if law or regulation prohibits it. Before using it, you must evaluate the existence and significance of threats to the internal auditors' objectivity and their level of competence. If the threats cannot be reduced to an acceptable level, or the internal auditors' competence is not sufficient, you cannot use direct assistance. Direct assistance must be directed, supervised and reviewed by you. You must not assign internal auditors work that involves making significant judgments in the audit, or that relates to higher assessed risks of material misstatement where the judgment needed is more than limited. You also cannot assign them decisions about the internal audit function's objectivity and competence or about the use of its work. Such judgment stays with you.

SA 600 (Revised) Special Considerations: Audits of Group Financial Statements (Including the Work of Component Auditors) deals with using other auditors in a group audit. It is effective for audits of financial statements for periods beginning on or after 1 April 2026. It uses the terms group engagement partner, group engagement team and component auditor. The group engagement team decides how much involvement it needs in the component auditor's work. It considers the component's significance, the risks of material misstatement, the component auditor's competence, independence and quality, and the group's structure. It then directs, supervises and reviews that work.

The older SA 600, Using the Work of Another Auditor, uses the terms principal auditor and other auditor. These terms may also appear in company law wording. Both sets of terms can appear in questions, and they describe the same two roles. Follow the terminology used in the question. If the question does not use either set, state the role clearly and use one set of terms consistently. In India, where a branch is audited by a person other than the company's auditor, Section 143(3)(c) of the Companies Act, 2013 requires the auditor's report to state whether the report on the accounts of that branch office has been sent to the auditor and how it has been dealt with. Apply the general SA principles for the exam.

SA 402 Audit Considerations Relating to an Entity Using a Service Organisation is written from the point of view of the user auditor. The user auditor obtains an understanding of the services used and their effect on internal control. The service auditor may issue a Type 1 report (design and implementation of controls at a date) or a Type 2 report (also tests operating effectiveness over a period). If you want to rely on controls at the service organisation, you may obtain a Type 2 report, perform tests of controls at the service organisation yourself, or use another auditor to perform those tests.

Key rules to remember

Overriding principle: Sole responsibility for the audit opinion rests with the auditor (group engagement partner / user auditor / the auditor using internal audit work); Using others' work does not reduce your responsibility. - **SA 610:** do not refer to the internal audit function's work in the auditor's report unless law or regulation requires it. Even where the reference is required, the report must indicate that it does not reduce your responsibility for the opinion. - **SA 402:** do not refer to the service auditor's work in an unmodified opinion unless law or regulation requires it. If reference is made in a modified opinion, the report must state that the reference does not reduce the user auditor's responsibility for the opinion. In India, the Companies Act, 2013 links two provisions on branch audit. Section 143(8) provides for the audit of branch accounts by the company auditor or another qualified person (the branch auditor). Section 143(3)(c) requires the auditor's report to state whether the report on the accounts of a branch office audited by a person other than the company's auditor has been sent to the auditor and how it has been dealt with.
SA 610: criteria to decide use of internal audit work: Objectivity + Technical competence + Systematic and disciplined approach (with quality control); If any criterion is weak, do not use the work, or use it only to a limited extent. Also consider whether the work is likely to be adequate for the purposes of the audit.
SA 610: procedures once work is used: Evaluate quality of work + Perform own procedures on it (re-performance or reviewing and testing a sample); The extent depends on the judgment involved and the assessed risk.
SA 610: limits on direct assistance: Direct assistance is not permitted where law or regulation prohibits it. Evaluate threats to objectivity and the level of competence before using it. If the threats cannot be reduced to an acceptable level, or competence is insufficient, do not use direct assistance. Do not assign internal auditors work that involves making significant judgments, work relating to higher assessed risks of material misstatement where the judgment required is more than limited, or decisions about the internal audit function's own objectivity and competence and the use of its work.; Limit the work assigned to what you can direct, supervise and review. The significant judgments and the decisions on the internal auditors' objectivity and competence stay with you.
SA 600 (Revised): factors for involvement in a component auditor's work: Group engagement team involvement = f(Significance of the component + Risks of material misstatement + Component auditor's competence, independence and quality + Group structure); These factors decide how much direction, supervision and review of the component auditor's work you need. The older terms 'principal auditor' and 'other auditor' describe the same roles as 'group engagement partner' and 'component auditor'. Follow the terms used in the question.
SA 402: report types: Type 1 = design and implementation at a date; Type 2 = design, implementation and operating effectiveness over a period; Type 1 alone gives no evidence of operating effectiveness.

How to solve Using Other Auditors, Internal Audit and Service Organisations questions

Use the same logic for any question on reliance: identify who did the work, decide whether it is usable, then add your own procedures and keep responsibility.

1Identify the type of work: internal audit (SA 610), another auditor (SA 600) or service organisation (SA 402).
2State the rule that the auditor stays solely responsible for the opinion.
3Apply the usability test from the relevant SA: objectivity, competence and quality for SA 610; competence, independence and significance for SA 600; type of report and understanding for SA 402.
4Link each fact in the case to a test. Say which fact is favourable and which is a concern.
5Decide the extent of reliance: full, partial or none, and state the procedures you add (review, re-performance, discussions, testing controls).
6Cover documentation and communication: record your conclusions, and consider reporting implications if you cannot get enough evidence.
7Write a clear conclusion in one line.

Quickest way: Three-column scan for MCQs and short answers

When to use it: Use this when a question has little time or is an MCQ. It also gives a skeleton for written answers worth a few marks.

Map the SA: internal audit = 610, other auditor = 600, service organisation = 402.
For MCQs, eliminate any option that says responsibility is shared or reduced by relying on others.
Eliminate options that say a Type 1 report proves controls operated effectively.
For written answers, use the format Provision - Facts - Conclusion: state the SA rule, apply case facts, then conclude.
Write the factors as bullet points so each one earns a step mark.
Finish with one line on the auditor's retained responsibility.

Common mistakes in Using Other Auditors, Internal Audit and Service Organisations

Saying the auditor can transfer responsibility to the internal auditor or other auditor.
Students think that relying on an expert's work means sharing the blame.
Fix: Always write that the auditor has sole responsibility for the opinion and that reliance does not reduce it.
Treating a Type 1 service auditor report as proof that controls worked all year.
The two report names look similar and students mix them up.
Fix: Remember: Type 1 is design and implementation at a date; Type 2 adds operating effectiveness over a period.
Using internal audit work without assessing objectivity and competence.
Students assume that any department doing audit work is reliable.
Fix: Start every SA 610 answer with the three criteria: objectivity, technical competence and a systematic and disciplined approach with quality control. Then say whether the work is likely adequate for the audit.
Confusing using internal audit work with direct assistance.
Both involve internal auditors, so the two ideas blur.
Fix: Using work means evaluating work already done by the function. Direct assistance means internal auditors work under your direction, supervision and review.
Mixing the roles of user auditor and service auditor in SA 402.
Both words contain 'auditor' and the roles are reversed from the client's perspective.
Fix: User auditor audits the entity using the service. Service auditor reports on the service organisation's controls.
Ignoring the terminology used in the question on other auditors.
Questions may use 'principal auditor' and 'other auditor' (older SA 600 and company law wording) or 'group engagement partner' and 'component auditor' (SA 600 (Revised), effective for audits of periods beginning on or after 1 April 2026). Students pick one set and force it on every question.
Fix: Follow the terms used in the question. Treat the two sets as names for the same two roles. If the question uses neither, name the roles clearly and stay consistent.
Giving a general answer without applying case facts.
Students recall the theory but skip the link to the scenario.
Fix: Quote the facts from the question, mark each as supporting or against reliance, then conclude.

Worked examples

Example 1

The internal audit department of Rajan Ltd reports to the CFO, whose division it also audits. The statutory auditor wants to rely on its inventory count work. Advise whether the auditor can rely on it.

Show the solution

Provision: under SA 610 the auditor first decides whether internal audit work can be used. The criteria are objectivity, technical competence, and a systematic and disciplined approach with quality control. The auditor also considers whether the work is likely to be adequate for the audit.
Facts: the function reports to the CFO and audits the CFO's own division. This is a threat to objectivity, as the organisational status and reporting lines affect independence. No information is given about competence or quality control.
The auditor should therefore seek more information on competence, policies and quality control, and consider whether safeguards exist, such as access to the audit committee.
If objectivity cannot be established, the auditor should not use the work, and should perform own procedures, such as attending the inventory count.
If used, the auditor must still evaluate and test the work, because the inventory is a significant area and judgment is involved. The auditor stays solely responsible.

Answer: The auditor cannot rely on the work as it stands, because objectivity is doubtful. It may be used only if objectivity, competence and quality are established, and then only after evaluation and own testing. Otherwise the auditor must perform own procedures.

Example 2

An auditor is auditing a company that outsources payroll to a service organisation. The auditor has received a Type 1 report of the service auditor and wants to reduce substantive testing of payroll expenses by relying on the controls. Comment.

Show the solution

Provision: under SA 402, the user auditor obtains an understanding of the services used and their effect on internal control, then assesses risk. A Type 1 report covers the design and implementation of controls at a specific date.
Facts: reliance to reduce substantive testing requires evidence that controls operated effectively over the period. A Type 1 report does not give this.
Options: the auditor can obtain a Type 2 report that covers a suitable period, or can test the relevant controls at the service organisation, or use another auditor to do so.
The user auditor also considers the service auditor's competence and independence, and whether the report period and controls match the audit needs.
If sufficient evidence is not obtained, the auditor must keep the planned level of substantive testing.

Answer: The auditor cannot reduce substantive procedures on the basis of a Type 1 report alone. A Type 2 report or direct testing of controls is needed. Otherwise the substantive testing of payroll should stay.

Exam tips

Start every answer with the line: the auditor has sole responsibility for the opinion. It is the safest mark.
Match each SA number with its topic. Examiners often test this in MCQs.
For SA 610, memorise the three criteria: objectivity, technical competence, and a systematic and disciplined approach with quality control. Then add whether the work is likely to be adequate for the audit. Use them as a checklist.
For SA 600, follow the terminology in the question: 'principal auditor' and 'other auditor', or 'group engagement partner' and 'component auditor'. They are names for the same roles. SA 600 (Revised) is effective for audits of periods beginning on or after 1 April 2026.
For SA 402, be ready to explain Type 1 and Type 2 in one line each, and say which allows reliance on operating effectiveness.
In case questions, use provision, facts and conclusion. Link every fact to a criterion or factor.

Practice questions from Audit Evidence

Using Other Auditors, Internal Audit and Service Organisations in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Using Other Auditors, Internal Audit and Service Organisations: frequently asked questions

Can an auditor rely on internal auditor work?

Yes, but only after assessing the internal audit function's objectivity, technical competence and systematic and disciplined approach with quality control. The auditor also considers whether the work is likely to be adequate for the audit. The auditor must then evaluate and test the work. The auditor remains solely responsible for the opinion.

What is the difference between Type 1 and Type 2 reports under SA 402?

A Type 1 report covers the description and design of controls and whether they were implemented at a date. A Type 2 report also tests whether the controls operated effectively over a period. Only Type 2 supports reliance on operating effectiveness.

Does using a component auditor reduce the group engagement partner's responsibility?

No. Under SA 600 (Revised), the group engagement partner decides how much involvement the group engagement team needs in the component auditor's work and stays responsible for the opinion on the group financial statements. Reliance only affects the audit procedures needed. In the older SA 600 wording, this was the principal auditor's position, and the same principle applies.

What is direct assistance under SA 610?

Direct assistance is the use of internal auditors to perform audit procedures under the external auditor's direction, supervision and review. It is not permitted if law or regulation prohibits it. Before using it, the auditor must evaluate threats to the internal auditors' objectivity and their level of competence. If the threats cannot be reduced to an acceptable level, or competence is insufficient, direct assistance cannot be used. The auditor must not assign work involving significant judgments, higher-risk work needing more than limited judgment, or decisions on the internal audit function's own objectivity and competence and the use of its work.