Document ID: chunk:federal_register_of_legislation:F2023C01133:reg:7:p8
Version: federal_register_of_legislation:F2023C01133
Segment Type: reg
Provision Reference: reg 7 (pt 8/17)
Character Range: 26487–29518

measure, classify and report financial and operating information, and to make specific enquiry into individual items, including detailed testing of transactions, balances and procedures.

           * Review of operating activities.  The internal audit function may be assigned to review the economy, efficiency and effectiveness of operating activities, including non‑financial activities of an entity.

           * Review of compliance with laws and regulations.  The internal audit function may be assigned to review compliance with laws, regulations and other external requirements, and with management policies and directives and other internal requirements.

A2.             Activities similar to those performed by an internal audit function may be conducted by functions with other titles within an entity.  Some or all of the activities of an internal audit function may also be outsourced to a third‑party service provider.  Neither the title of the function, nor whether it is performed by the entity or a third‑party service provider, are sole determinants of whether or not the external auditor can use the work of the function.  Rather, it is the nature of the activities; the extent to which the internal audit function's organisational status and relevant policies and procedures support the objectivity of the internal auditors; competence; and systematic and disciplined approach of the function that are relevant.  References in this Auditing Standard to the work of the internal audit function include relevant activities of other functions or third‑party providers that have these characteristics.

A3.             In addition, those in the entity with operational and managerial duties and responsibilities outside of the internal audit function would ordinarily face threats to their objectivity that would preclude them from being treated as part of an internal audit function for the purpose of this Auditing Standard, although they may perform controls that can be tested in accordance with ASA 330.[12]  For this reason, monitoring controls performed by an owner‑manager would not be considered equivalent to an internal audit function.

A4.             While the objectives of an entity's internal audit function and the external auditor differ, the function may perform audit procedures similar to those performed by the external auditor in an audit of a financial report.  If so, the external auditor may make use of the function for purposes of the audit in one or more of the following ways:

           * To obtain information that is relevant to the external auditor's assessments of the risks of material misstatement due to error or fraud.  In this regard, ASA 315[13] requires the external auditor to obtain an understanding of the nature of the internal audit function's responsibilities, its status within the organisation, and the activities performed, or to be performed, and make enquiries of appropriate individuals within the internal audit function (if the entity has such a function);