09 When assessing the internal auditors' competence, the auditor should obtain or update information from prior years about such factors as—

Educational level and professional experience of internal auditors.
Professional certification and continuing education.
Audit policies, programs, and procedures.
Practices regarding assignment of internal auditors.
Supervision and review of internal auditors' activities.
Quality of working-paper documentation, reports, and recommendations.
Evaluation of internal auditors' performance.
Objectivity of the Internal Auditors

.10 When assessing the internal auditors' objectivity, the auditor should obtain or update information from prior years about such factors as—
The organizational status of the internal auditor responsible for the internal audit function, including—Whether the internal auditor reports to an officer of sufficient status to ensure broad audit coverage and adequate consideration of, and action on, the findings and recommendations of the internal auditors.
Whether the internal auditor has direct access and reports regularly to the board of directors, the audit committee, or the owner-manager.
Whether the board of directors, the audit committee, or the owner-manager oversees employment decisions related to the internal auditor.
Policies to maintain internal auditors' objectivity about the areas audited, including—
Policies prohibiting internal auditors from auditing areas where relatives are employed in important or audit-sensitive positions.
Policies prohibiting internal auditors from auditing areas where they were recently assigned or are scheduled to be assigned on completion of responsibilities in the internal audit function.
Assessing Competence and Objectivity

.11 In assessing competence and objectivity, the auditor usually considers information obtained from previous experience with the internal audit function, from discussions with management personnel, and from a recent external quality review, if performed, of the internal audit function's activities. The auditor may also use professional internal auditing standards fn 4 as criteria in making the assessment. The auditor also considers the need to test the effectiveness of the factors described in paragraphs .09 and .10. The extent of such testing will vary in light of the intended effect of the internal auditors' work on the audit. If the auditor determines that the internal auditors are sufficiently competent and objective, the auditor should then consider how the internal auditors' work may affect the audit.

Effect of the Internal Auditors' Work on the Audit

.12 The internal auditors' work may affect the nature, timing, and extent of the audit, including—

Procedures the auditor performs when obtaining an understanding of the entity's internal control (paragraph .13).
Procedures the auditor performs when assessing risk (paragraphs .14 through .16).
Substantive procedures the auditor performs (paragraph .17).
When the work of the internal auditors is expected to affect the audit, the guidance in paragraphs .18 through .26 should be followed for considering the extent of the effect, coordinating audit work with internal auditors, and evaluating and testing the effectiveness of internal auditors' work.

Understanding of Internal Control

.13 The auditor obtains a sufficient understanding of the design of controls relevant to the audit of financial statements to plan the audit and to determine whether they have been placed in operation. Since a primary objective of many internal audit functions is to review, assess, and monitor controls, the procedures performed by the internal auditors in this area may provide useful information to the auditor. For example, internal auditors may develop a flowchart of a new computerized sales and receivables system. The auditor may review the flowchart to obtain information about the design of the related controls. In addition, the auditor may consider the results of procedures performed by the internal auditors on related controls to obtain information about whether the controls have been placed in operation. [Revised, February 1997, to reflect conforming changes necessary due to the issuance of Statement on Auditing Standards No. 78.]

Risk Assessment
.14 The auditor assesses the risk of material misstatement at both the financial-statement level and the account-balance or class-of-transaction level.

Financial-Statement Level

.15 At the financial-statement level, the auditor makes an overall assessment of the risk of material misstatement. When making this assessment, the auditor should recognize that certain controls may have a pervasive effect on many financial statement assertions. The control environment and accounting system often have a pervasive effect on a number of account balances and transaction classes and therefore can affect many assertions. The auditor's assessment of risk at the financial-statement level often affects the overall audit strategy. The entity's internal audit function may influence this overall assessment of risk as well as the auditor's resulting decisions concerning the nature, timing, and extent of auditing procedures to be performed. For example, if the internal auditors' plan includes relevant audit work at various locations, the auditor may coordinate work with the internal auditors (see paragraph .23) and reduce the number of the entity's locations at which the auditor would otherwise need to perform auditing procedures.

Account-Balance or Class-of-Transaction Level

.16 [The following paragraph is effective for audits of fiscal years ending on or after November 15, 2004, for accelerated filers, and on or after July 15, 2005, for all other issuers. See PCAOB Release No. 2004-008PDF.

For audits of fiscal years ending before November 15, 2004, for accelerated filers, and before July 15, 2005, for all other issuers, click here.]
At the account-balance or class-of-transaction level, the auditor performs procedures to obtain and evaluate evidential matter concerning management's assertions. The auditor assesses control risk for each of the relevant financial statement assertions related to all significant accounts and disclosures in the financial statements and performs tests of controls to support assessments below the maximum. When planning and performing tests of controls, the auditor may consider the results of procedures planned or performed by the internal auditors. For example, the internal auditors' scope may include tests of controls for the completeness of accounts payable. The results of internal auditors' tests may provide appropriate information about the effectiveness of controls and change the nature, timing, and extent of testing the auditor would otherwise need to perform.

Substantive Procedures

.17 Some procedures performed by the internal auditors may provide direct evidence about material misstatements in assertions about specific account balances or classes of transactions. For example, the internal auditors, as part of their work, may confirm certain accounts receivable and observe certain physical inventories. The results of these procedures can provide evidence the auditor may consider in restricting detection risk for the related assertions. Consequently, the auditor may be able to change the timing of the confirmation procedures, the number of accounts receivable to be confirmed, or the number of locations of physical inventories to be observed.

Extent of the Effect of the Internal Auditors' Work

.18 [The following paragraph is effective for audits of fiscal years beginning on or after December 15, 2010. See PCAOB Release No. 2010-004PDF. For audits of fiscal years beginning before December 15, 2010, click here]
Even though the internal auditors' work may affect the auditor's procedures, the auditor should perform procedures to obtain sufficient, appropriate evidential matter to support the auditor's report. Evidence obtained through the auditor's direct personal knowledge, including physical examination, observation, computation, and inspection, is generally more persuasive than information obtained indirectly. fn 5

.19 The responsibility to report on the financial statements rests solely with the auditor. Unlike the situation in which the auditor uses the work of other independent auditors, fn 6 this responsibility cannot be shared with the internal auditors. Because the auditor has the ultimate responsibility to express an opinion on the financial statements, judgments about assessments of inherent and control risks, the materiality of misstatements, the sufficiency of tests performed, the evaluation of significant accounting estimates, and other matters affecting the auditor's report should always be those of the auditor.

.20 In making judgments about the extent of the effect of the internal auditors' work on the auditor's procedures, the auditor considers—

The materiality of financial statement amounts—that is, account balances or classes of transactions.
The risk (consisting of inherent risk and control risk) of material misstatement of the assertions related to these financial statement amounts.
The degree of subjectivity involved in the evaluation of the audit evidence gathered in support of the assertions. fn 7
As the materiality of the financial statement amounts increases and either the risk of material misstatement or the degree of subjectivity increases, the need for the auditor to perform his or her own tests of the assertions increases. As these factors decrease, the need for the auditor to perform his or her own tests of the assertions decreases.

[Note deleted, effective for audits of fiscal years ending on or after November 15, 2007. See PCAOB Release 2007-005APDF. Click here to view the note.]