Document ID: chunk:federal_register_of_legislation:F2023C01133:reg:7:p11
Version: federal_register_of_legislation:F2023C01133
Segment Type: reg
Provision Reference: reg 7 (pt 11/17)
Character Range: 35047–38112

its activities distinguishes the activities of the internal audit function from other monitoring controls that may be performed within the entity.

A11.         Factors that may affect the external auditor's determination of whether the internal audit function applies a systematic and disciplined approach include the following:

           * The existence, adequacy and use of documented internal audit procedures or guidance covering such areas as risk assessments, work programs, documentation and reporting, the nature and extent of which is commensurate with the size and circumstances of an entity.

           * Whether the internal audit function has appropriate quality control policies and procedures, for example, policies and procedures that would be applicable to an internal audit function (such as those relating to leadership, human resources and engagement performance) or quality control requirements in standards set by the relevant professional bodies for internal auditors.  Such bodies may also establish other appropriate requirements such as conducting periodic external quality assessments.

Circumstances When Work of the Internal Audit Function Cannot Be Used  (Ref: Para. 16)

A12.         The external auditor's evaluation of whether the internal audit function's organisational status and relevant policies and procedures adequately support the objectivity of the internal auditors, the level of competence of the internal audit function, and whether it applies a systematic and disciplined approach may indicate that the risks to the quality of the work of the function are too significant and therefore it is not appropriate to use any of the work of the function as audit evidence.

A13.         Consideration of the factors in paragraphs A7, A8 and A11 of this Auditing Standard individually and in aggregate is important because an individual factor is often not sufficient to conclude that the work of the internal audit function cannot be used for purposes of the audit.  For example, the internal audit function's organisational status is particularly important in evaluating threats to the objectivity of the internal auditors.  If the internal audit function reports to management, this would be considered a significant threat to the function's objectivity unless other factors such as those described in paragraph A7 of this Auditing Standard collectively provide sufficient safeguards to reduce the threat to an acceptable level.

A14.         In addition, the relevant ethical requirements[16],[*] state that a self‑review threat is created when the external auditor accepts an engagement to provide internal audit services to an audit client, and the results of those services will be used in conducting the audit.  This is because of the possibility that the engagement team will use the results of the internal audit service without properly evaluating those results or without exercising the same level of professional scepticism as would be exercised when the internal audit work is performed by individuals who are