AUD CPA Exam: Identifying the Factors to Determine the Extent the Engagement Team Can Use the Work of Internal Auditors, IT Auditors, Etc.

Share This...

Introduction

Purpose of the Article

In this article, we’ll cover identifying the factors to determine the extent the engagement team can use the work of internal auditors, IT auditors, etc. Understanding the factors that determine when and how to rely on the work of internal auditors, IT auditors, and other specialists is crucial for the engagement team in any audit. These specialists often possess expertise in areas that are outside the scope of the auditor’s core competencies, such as complex IT systems, specific regulatory environments, or internal control frameworks. By effectively leveraging the work of these professionals, the engagement team can gain a deeper insight into key areas of the audit, improve efficiency, and ultimately enhance the quality of the audit.

However, this reliance is not without its challenges. The engagement team must carefully evaluate the competence, objectivity, and scope of the work performed by these specialists to ensure that it meets the rigorous standards required in an audit. Understanding when it is appropriate to rely on the work of internal auditors and other specialists—and to what extent—is essential for ensuring the audit’s overall integrity and compliance with auditing standards.

Relevance to the CPA Exam

For candidates preparing for the CPA exam, mastering the ability to identify and assess the work of internal auditors, IT auditors, and other specialists is essential. This knowledge is not only a key component of the exam but also a critical skill in the professional practice of auditing. The exam tests candidates on their understanding of how to incorporate the work of specialists into the audit process, which requires a firm grasp of the related professional standards and practical application.

Moreover, in real-world auditing scenarios, the ability to make informed decisions about using specialist work can significantly impact the efficiency and effectiveness of the audit. For example, understanding when to rely on IT auditors for systems-related controls can streamline the audit process and reduce redundancies. On the other hand, failing to properly assess the work of these specialists can lead to significant audit risks, including the risk of material misstatement.

This article aims to equip CPA candidates with the knowledge and understanding they need to effectively determine the extent to which they can rely on the work of internal auditors, IT auditors, and other specialists. This will not only prepare them for the CPA exam but also enhance their professional capabilities in the field of auditing.

Overview of Engagement Team Responsibilities

Role of the Engagement Team

The engagement team plays a pivotal role in the execution and completion of an audit. Comprised of auditors with varying levels of experience and expertise, the team is responsible for planning, performing, and completing the audit in accordance with applicable auditing standards. Key responsibilities of the engagement team include:

Planning the Audit: This involves understanding the entity’s business environment, assessing risks, and determining the scope of the audit. The engagement team must establish the audit strategy and develop an audit plan that addresses the identified risks.
Assessing Risks: The team evaluates the risk of material misstatement in the financial statements, both at the overall financial statement level and at the assertion level for individual accounts and disclosures. This risk assessment informs the nature, timing, and extent of audit procedures to be performed.
Performing Audit Procedures: The engagement team is responsible for carrying out audit procedures designed to gather sufficient and appropriate audit evidence. These procedures may include tests of controls, substantive tests of transactions, and analytical procedures.
Evaluating Audit Evidence: Once the audit procedures are completed, the engagement team must evaluate the evidence obtained to determine whether it is sufficient and appropriate to support the audit opinion.
Forming an Audit Opinion: Based on the audit evidence, the engagement team forms an opinion on whether the financial statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework.
Communication with Management: The team is also tasked with communicating audit findings, deficiencies in internal controls, and other significant matters to management and those charged with governance.

Given the complexity of many audits, the engagement team often encounters situations where specialized knowledge is required. This is where the work of internal auditors, IT auditors, and other specialists becomes essential.

Understanding the Need for Specialist Work

Audits increasingly involve areas that require specialized knowledge beyond the general expertise of the engagement team. As businesses become more complex, with sophisticated IT systems and intricate internal controls, the need for specialized skills in these areas has grown. Engagement teams may rely on the work of internal auditors, IT auditors, and other specialists for several reasons:

Complex IT Environments: Modern businesses often rely on complex IT systems to process financial transactions and maintain records. IT auditors, who possess expertise in evaluating the integrity and security of these systems, can provide invaluable insights into the effectiveness of IT controls, which are crucial to the accuracy and reliability of financial information.
Specialized Knowledge: Certain industries, such as healthcare, finance, and manufacturing, have unique regulatory requirements and operational complexities. Internal auditors and other specialists who are familiar with these industries can provide the engagement team with insights that are critical to understanding and assessing industry-specific risks.
Efficiency in Auditing: By leveraging the work of internal auditors who are already familiar with the entity’s operations and controls, the engagement team can perform a more efficient audit. Internal auditors often conduct continuous monitoring of controls throughout the year, which can reduce the amount of testing required by the engagement team.
Depth of Expertise: Internal auditors and specialists often possess deep expertise in areas such as compliance, fraud detection, and risk management. Their work can help the engagement team identify and assess risks that might not be apparent from a high-level review, thereby enhancing the overall quality of the audit.

Relying on the work of specialists allows the engagement team to focus on areas where their expertise is most needed, ensuring that the audit is both effective and efficient. However, this reliance must be carefully managed, with the engagement team evaluating the competence, objectivity, and scope of the work performed by these specialists to ensure it meets the necessary standards.

Key Factors to Consider When Using the Work of Others

Competence and Objectivity of Internal Auditors and Specialists

Competence

One of the most critical factors the engagement team must consider when deciding whether to rely on the work of internal auditors, IT auditors, and other specialists is their competence. Competence refers to the qualifications, experience, and training of these individuals and is crucial for ensuring that the work they perform is reliable and meets the necessary standards.

Qualifications: The engagement team should review the educational background and professional certifications of internal auditors and IT auditors. For instance, certifications like Certified Internal Auditor (CIA) or Certified Information Systems Auditor (CISA) are indicators of specialized knowledge and competence in their respective fields.
Experience: The engagement team should consider the experience level of the auditors or specialists, particularly their experience in the industry and the specific areas relevant to the audit. Experience in similar audit environments or with similar types of controls can provide additional assurance that their work is performed to a high standard.
Training: Ongoing professional training is essential for keeping skills and knowledge up-to-date, especially in rapidly evolving fields like IT auditing. The engagement team should assess whether the internal auditors and specialists have undergone recent and relevant training that enhances their ability to perform their work effectively.

Objectivity

In addition to competence, the objectivity of internal auditors and specialists is a critical consideration. Objectivity refers to the ability of these professionals to perform their work without bias or influence, which is essential for the integrity of the audit.

Independence: The engagement team should assess the independence of internal auditors from the areas they are auditing. If internal auditors are involved in operational decision-making or have close relationships with management, their objectivity could be compromised. This potential conflict of interest must be evaluated to determine whether their work can be relied upon.
Potential for Bias: The engagement team should consider any factors that might influence the internal auditors’ work, such as pressure from management or personal interests. Bias can affect the quality and reliability of the audit work, and the engagement team must assess whether such risks are present.

Scope of Work Performed

Relevance to the Audit

The engagement team must ensure that the work performed by internal auditors and other specialists is relevant to the audit’s objectives. The alignment of their work with the overall audit strategy is essential for its usefulness.

Audit Objectives: The work performed by internal auditors and specialists should directly relate to the areas of the financial statements that are material and relevant to the audit. For example, if the engagement team relies on IT auditors to assess IT general controls, those controls must be critical to the financial reporting process.
Specific Areas of Focus: The engagement team should evaluate whether the scope of the work performed by internal auditors covers all the relevant aspects of the audit, including key risk areas. Any gaps in coverage could necessitate additional audit procedures by the engagement team.

Extent of Testing

The thoroughness of the testing performed by internal auditors or specialists is another critical factor. The engagement team must assess whether the extent of testing performed is sufficient to meet the audit’s requirements.

Depth of Testing: The engagement team should evaluate the nature and extent of the testing conducted by internal auditors and specialists. This includes assessing whether they tested a sufficient sample size, covered all relevant controls, and conducted appropriate procedures.
Documentation and Evidence: The quality and completeness of the documentation supporting the testing performed are crucial. The engagement team should review the workpapers and reports to ensure that the evidence gathered is sufficient and appropriate for reliance.

Risk of Material Misstatement

Assessment of Risk

The engagement team must consider the level of risk associated with the areas covered by internal auditors and specialists and whether their work appropriately addresses these risks.

High-Risk Areas: In areas of high risk, such as revenue recognition or complex financial instruments, the engagement team should critically evaluate whether the work of internal auditors and specialists adequately addresses the risk of material misstatement. Additional audit procedures may be necessary if there is any doubt about the sufficiency of their work.
Residual Risk: The engagement team should consider any residual risk that remains after internal auditors and specialists have completed their work. This assessment helps determine whether further testing or additional procedures are needed to reduce the risk of material misstatement to an acceptable level.

Quality of Communication

Reporting and Communication

Effective communication is essential when the engagement team relies on the work of internal auditors, IT auditors, and other specialists. The clarity and completeness of their reporting are critical to the audit’s success.

Findings and Conclusions: The engagement team should review the reports provided by internal auditors and specialists to ensure that their findings and conclusions are clearly presented and supported by evidence. Any ambiguities or lack of detail could undermine the reliability of their work.
Timeliness of Reports: The engagement team should also consider the timeliness of the reports. Delays in receiving critical information can impact the audit timeline and the ability to make informed decisions based on the specialists’ work.

Coordination with the Engagement Team

Clear and ongoing communication between the engagement team and specialists is vital for ensuring that the audit is conducted smoothly and effectively.

Ongoing Dialogue: The engagement team should establish regular communication channels with internal auditors and specialists throughout the audit. This ongoing dialogue helps ensure that any issues are identified and addressed promptly, and that the specialists’ work aligns with the audit’s objectives.
Collaborative Approach: Collaboration between the engagement team and specialists is essential for integrating their work into the overall audit. The engagement team should actively involve specialists in planning and risk assessment discussions to ensure that their work is appropriately directed and coordinated with the audit’s goals.

By carefully considering these key factors, the engagement team can make informed decisions about the extent to which they can rely on the work of internal auditors, IT auditors, and other specialists. This ensures that the audit is both efficient and effective, and that it meets the high standards required by professional auditing standards.

Procedures for Evaluating the Work of Internal Auditors, IT Auditors, and Specialists

Reviewing Documentation

The first step in evaluating the work of internal auditors, IT auditors, and other specialists is to thoroughly review the documentation they provide. This includes workpapers, reports, and any other supporting documents that outline the work performed, the procedures followed, and the conclusions reached.

Step 1: Obtain Relevant Documents: The engagement team should request and obtain all relevant workpapers, reports, and supporting documentation from the internal auditors and specialists. These documents should provide a clear and detailed record of the work performed and the findings.
Step 2: Evaluate Completeness and Accuracy: The engagement team should carefully review the documentation to ensure it is complete and accurate. This involves verifying that all relevant areas have been covered, that the work performed aligns with the audit’s objectives, and that the conclusions drawn are supported by sufficient and appropriate evidence.
Step 3: Assess Compliance with Standards: The documentation should be reviewed to ensure that the work performed by internal auditors and specialists complies with applicable professional standards. This includes checking whether the procedures followed are consistent with the requirements of auditing standards and the entity’s internal policies.
Step 4: Identify Areas Requiring Further Review: During the review, the engagement team should identify any areas where the documentation is unclear, incomplete, or raises questions about the adequacy of the work performed. These areas may require additional inquiries or further testing.

Re-performance of Work

In some cases, the engagement team may need to re-perform a sample of the work conducted by internal auditors or specialists to validate its accuracy and reliability. Re-performance provides an additional level of assurance that the work can be relied upon.

When to Re-perform Work: The engagement team should consider re-performing work when there are significant risks associated with the areas covered by the specialists, when the work involves complex or judgmental areas, or when there are concerns about the competence or objectivity of the specialists.
How to Re-perform Work: To re-perform the work, the engagement team should select a representative sample of the transactions, controls, or areas tested by the internal auditors or specialists. The team should then independently perform the same procedures and compare the results to those documented by the specialists. Any discrepancies should be investigated and resolved.
Documenting Re-performance: The results of the re-performance should be documented in the engagement team’s workpapers, including any differences identified and how they were addressed. This documentation is crucial for demonstrating that the engagement team has adequately evaluated the work of the specialists.

Testing Controls

Testing controls is a critical procedure when evaluating the work of IT auditors, particularly in areas involving IT systems and data processing. IT controls are often complex and integral to the financial reporting process, making their effective operation essential.

Importance of IT Controls: IT controls play a significant role in ensuring the integrity, accuracy, and completeness of financial data. As such, the engagement team must carefully evaluate the effectiveness of these controls, particularly those reviewed by IT auditors.
Approach to Testing Controls: The engagement team should review the IT auditors’ work to determine which controls were tested, the scope of the testing, and the results. The team may need to perform additional testing on key controls to confirm their effectiveness, especially if the IT environment is complex or if the controls are critical to the financial reporting process.
Focus on Key Controls: The engagement team should focus on testing key controls that have a direct impact on financial reporting. This includes access controls, change management controls, data integrity controls, and automated controls embedded in financial systems. If these controls are not operating effectively, there could be a higher risk of material misstatement.

Inquiry and Observation

In addition to reviewing documentation and re-performing work, the engagement team should conduct inquiries and observations as part of the evaluation process. These procedures help to verify the accuracy and completeness of the work performed by internal auditors and specialists.

Conducting Inquiries: The engagement team should hold discussions with internal auditors, IT auditors, and other specialists to gain a deeper understanding of the work they performed. Inquiries should focus on understanding the procedures followed, the rationale behind key judgments, and any challenges encountered during the audit.
Observation of Procedures: Observing the work performed by internal auditors and specialists can provide valuable insights into their processes and methodologies. This may involve sitting in on testing procedures, reviewing how data is processed and analyzed, or observing how controls are implemented in real time.
Assessing the Reliability of Responses: When conducting inquiries and observations, the engagement team should critically assess the responses and behaviors of the specialists. This includes evaluating whether the specialists demonstrate a thorough understanding of their work, whether their explanations are consistent with the documentation, and whether they exhibit professional skepticism in their procedures.
Documentation of Inquiries and Observations: The engagement team should document the inquiries made, the responses received, and any observations conducted. This documentation is essential for supporting the engagement team’s conclusions regarding the reliability of the specialists’ work.

By following these procedures, the engagement team can effectively evaluate the work of internal auditors, IT auditors, and other specialists, ensuring that their contributions to the audit are reliable and meet the necessary standards. This thorough evaluation process is crucial for maintaining the integrity of the audit and for forming a sound audit opinion.

Practical Considerations and Challenges

Limitations of Using Specialist Work

While the use of specialist work can greatly enhance the efficiency and effectiveness of an audit, there are certain limitations and situations where it may not be appropriate to rely on such work. Understanding these limitations is crucial for the engagement team to ensure the audit’s integrity.

High-Risk Areas: In areas where the risk of material misstatement is particularly high, the engagement team may determine that it is not appropriate to rely solely on the work of internal auditors or specialists. High-risk areas may require additional audit procedures or more direct involvement from the engagement team to ensure that all significant risks are adequately addressed.
Lack of Competence or Objectivity: If there are concerns about the competence or objectivity of the internal auditors or specialists, the engagement team should be cautious in relying on their work. Situations where specialists lack the necessary qualifications, experience, or independence may render their work unreliable, necessitating further audit procedures by the engagement team.
Inadequate Scope or Testing: If the scope of the work performed by specialists does not align with the audit’s objectives or if the extent of testing is insufficient, the engagement team may need to perform additional procedures. This is particularly important when the work performed by specialists does not fully cover the material areas of the audit.
Regulatory Requirements: In certain regulated industries, there may be specific requirements that limit the extent to which an auditor can rely on the work of internal auditors or other specialists. The engagement team must be aware of these regulatory limitations and ensure that their audit approach complies with all applicable regulations.

Dealing with Discrepancies

During the evaluation of specialist work, the engagement team may encounter discrepancies or issues that need to be addressed. Handling these situations effectively is essential to maintaining the quality of the audit.

Identifying Discrepancies: The engagement team should carefully review the work of internal auditors and specialists to identify any inconsistencies, errors, or gaps in the documentation or testing. Discrepancies may include differences in findings, unsupported conclusions, or incomplete testing.
In-depth Analysis: Once a discrepancy is identified, the engagement team should perform an in-depth analysis to determine its nature and significance. This may involve re-performing certain procedures, reviewing additional documentation, or conducting further inquiries with the specialists.
Collaboration with Specialists: The engagement team should engage in a constructive dialogue with the specialists to understand the reasons behind any discrepancies. This collaborative approach can help clarify misunderstandings, resolve issues, and ensure that the audit’s objectives are met.
Documenting and Resolving Issues: Any discrepancies and the steps taken to address them should be thoroughly documented in the engagement team’s workpapers. If the issues cannot be resolved, the engagement team may need to perform additional audit procedures or expand the scope of their testing to mitigate any potential risks.

Regulatory and Ethical Considerations

The use of specialist work in an audit is governed by various professional standards and ethical guidelines. The engagement team must be diligent in considering these regulations to ensure that the audit is conducted in accordance with the highest ethical and professional standards.

Professional Standards: The engagement team must adhere to the relevant auditing standards, such as those issued by the AICPA, PCAOB, or IAASB, when using the work of specialists. These standards provide guidance on how to evaluate and incorporate specialist work into the audit, including requirements for assessing competence, objectivity, and the scope of work.
Ethical Guidelines: Auditors are bound by ethical principles such as integrity, objectivity, and professional skepticism. When using specialist work, the engagement team must ensure that these ethical principles are upheld. For instance, they should avoid any undue reliance on specialist work that could compromise their independence or lead to biased audit conclusions.
Regulatory Compliance: In addition to professional standards, auditors must also comply with industry-specific regulations and legal requirements. This includes understanding any restrictions on the use of specialist work and ensuring that all audit procedures are in line with applicable laws and regulations.
Transparency and Disclosure: When relying on specialist work, the engagement team must ensure that their audit report clearly discloses the nature and extent of the reliance. Transparency is essential for maintaining the credibility of the audit and ensuring that stakeholders are fully informed about the audit process.

By carefully considering these practical challenges and adhering to regulatory and ethical guidelines, the engagement team can effectively manage the use of specialist work in an audit. This ensures that the audit is conducted with the highest standards of quality and integrity, ultimately leading to a more reliable and accurate audit opinion.

Example Scenarios

Low-Risk Engagement

In a low-risk engagement, the nature of the entity’s operations and the strength of its internal controls may allow the engagement team to rely more heavily on the work of internal auditors. Here’s an example scenario where this approach is appropriate:

Scenario:

A mid-sized manufacturing company, XYZ Corp, has a well-established internal audit function that conducts regular reviews of the company’s internal controls, particularly around inventory management and fixed asset controls. The internal audit team is highly competent, with several members holding professional certifications such as CIA (Certified Internal Auditor) and CISA (Certified Information Systems Auditor). They are also independent of management, reporting directly to the audit committee.

The engagement team has assessed the risk of material misstatement related to inventory and fixed assets as low, based on the company’s stable financial performance, effective internal controls, and the absence of significant changes in operations or accounting policies. Given these factors, the engagement team decides to rely heavily on the work of the internal auditors.

Action Taken:

The engagement team reviews the internal auditors’ workpapers, which include detailed testing of inventory counts, valuation methods, and fixed asset depreciation. The internal auditors have documented their procedures thoroughly and provided clear, well-supported conclusions. The engagement team conducts a limited re-performance of key controls tested by the internal auditors and finds their work to be reliable.

Conclusion:

Given the low-risk nature of the engagement, the strong competence and independence of the internal auditors, and the thoroughness of their work, the engagement team determines that it is appropriate to rely heavily on the internal auditors’ work. This reliance allows the engagement team to streamline their audit procedures, focusing on other areas where risks may be higher.

High-Risk Engagement

In a high-risk engagement, the complexity of the entity’s operations or specific risks may require the engagement team to perform additional audit procedures, even when specialists have been involved. Here’s an example scenario where this approach is necessary:

Scenario:

ABC Bank is a large financial institution with complex operations, including significant exposure to derivative financial instruments. The bank has an in-house team of IT auditors and risk management specialists who regularly assess the effectiveness of controls over the bank’s trading and risk management systems. However, due to the high risk associated with derivatives and the potential for significant financial impact, the engagement team has assessed the risk of material misstatement in this area as high.

The internal IT auditors have conducted extensive testing of the bank’s trading systems, focusing on access controls, system integrity, and transaction processing accuracy. They have also reviewed the bank’s valuation models for derivatives, ensuring that they comply with regulatory requirements and accounting standards.

Action Taken:

Despite the comprehensive work performed by the IT auditors, the engagement team decides to perform additional procedures to address the high risk of material misstatement. This includes independently testing a sample of derivative transactions for accuracy, re-performing key calculations related to derivative valuations, and reviewing the assumptions and inputs used in the bank’s valuation models.

The engagement team also evaluates the adequacy of the IT controls tested by the internal auditors, particularly focusing on any areas where control weaknesses or exceptions were identified. Additionally, they conduct interviews with key personnel involved in the bank’s risk management and trading operations to gain further insights into potential risks.

Conclusion:

Given the high-risk nature of ABC Bank’s derivative operations, the engagement team concludes that relying solely on the work of the IT auditors would not be sufficient to mitigate the risk of material misstatement. Therefore, they perform additional audit procedures to ensure that the financial statements accurately reflect the bank’s derivative exposures. This approach provides the necessary assurance that the audit opinion is well-founded, despite the inherent risks in the engagement.

These example scenarios illustrate how the engagement team’s approach can vary significantly depending on the level of risk associated with the audit. In low-risk engagements, it may be appropriate to rely heavily on the work of internal auditors, while in high-risk engagements, additional procedures are often necessary to ensure that all significant risks are adequately addressed.

Conclusion

Summary of Key Points

In this article, we have explored the critical factors and procedures that the engagement team must consider when determining the extent to rely on the work of internal auditors, IT auditors, and other specialists during an audit. The key points covered include:

Competence and Objectivity: The importance of evaluating the qualifications, experience, and independence of internal auditors and specialists to ensure their work is reliable and free from bias. Competence and objectivity are foundational to deciding whether their work can be incorporated into the audit.
Scope of Work Performed: Ensuring that the work performed by specialists is relevant to the audit objectives and that the extent of testing is sufficient to address the audit’s needs. The alignment of the specialists’ work with the audit plan is crucial for its effectiveness.
Risk of Material Misstatement: Assessing the level of risk in the areas covered by specialists and determining whether additional procedures are required. High-risk areas often necessitate further scrutiny and additional audit procedures, even when specialists have been involved.
Quality of Communication: The importance of clear and effective communication between the engagement team and specialists. This includes reviewing the thoroughness of specialists’ reporting and maintaining ongoing dialogue to ensure that all parties are aligned with the audit objectives.
Procedures for Evaluation: The steps the engagement team should take to evaluate the work of specialists, including reviewing documentation, re-performing work, testing controls, and conducting inquiries and observations. These procedures help to ensure that the specialists’ contributions are both reliable and relevant to the audit.
Practical Considerations: Recognizing the limitations of relying on specialist work, dealing with discrepancies, and adhering to regulatory and ethical standards. These considerations are essential for maintaining the integrity and quality of the audit.

Importance for CPA Practice

Understanding how to determine the extent to rely on the work of internal auditors, IT auditors, and other specialists is not only vital for success on the CPA exam but also for practical application in professional auditing. This knowledge equips future CPAs with the skills to:

Enhance Audit Quality: By effectively evaluating and integrating the work of specialists, auditors can enhance the quality and reliability of their audits. This is particularly important in complex audits where specialist expertise is required to address specific risks.
Increase Efficiency: Proper reliance on the work of competent and objective specialists can streamline the audit process, allowing auditors to focus their efforts on areas where their expertise is most needed. This leads to a more efficient and cost-effective audit.
Ensure Compliance with Standards: Understanding the professional standards and ethical guidelines governing the use of specialist work helps auditors maintain compliance with regulatory requirements and uphold the integrity of the audit.
Prepare for Real-World Challenges: The scenarios and considerations discussed in this article provide practical insights that can be directly applied in real-world audit situations. This prepares CPA candidates not only for their exams but also for their future roles as professional auditors.

In conclusion, mastering the ability to assess and rely on the work of internal auditors and specialists is a critical component of the audit process. It ensures that audits are conducted with the highest standards of quality and integrity, ultimately leading to more accurate and reliable financial reporting. This knowledge is indispensable for those pursuing the CPA designation and for their success in the field of auditing.