ISA 610: Using the Work of Internal Auditors

ISA 610 (Revised 2013), Using the Work of Internal Auditors, governs how the external auditor relates to the entity's internal audit function — an appraisal activity established by the entity to examine, evaluate, and monitor internal control, whose objectives and scope are set by management or those charged with governance. The standard covers two distinct uses. First, using the work of the internal audit function to obtain audit evidence: the external auditor takes work the function has already performed — its testing of controls, its documentation, its findings — and uses it as part of the audit evidence, after evaluation. Second, using internal auditors to provide direct assistance: internal auditors perform audit procedures under the direction, supervision, and review of the external auditor — essentially extending the engagement team temporarily. The two uses have different requirements, different risks, and different limits, and the standard keeps them carefully separate. For practitioners, ISA 610 structures the internal-audit working papers — the function evaluation, the use decision, the procedures on the work, the direct-assistance controls. For students, the two-uses distinction is the examinable foundation. For the UAE company with an internal audit function — common in banks, insurers, listed companies, and larger groups — ISA 610 determines whether the external auditor can rely on your internal audit work, and under what conditions. (For the internal audit function's own role and responsibilities, see the site's internal auditor coverage; this page is the external auditor's standard for using it.)

Paragraph 8 states the non-negotiable: the external auditor has sole responsibility for the audit opinion expressed, and that responsibility is not reduced by the auditor's use of the work of the internal audit function or by direct assistance. The auditor's report makes no reference to the internal audit function — unlike the old group-audit practice of mentioning other auditors, there is no ISA 610 equivalent. The principle shapes everything else: because responsibility cannot be shared, the evaluation must be rigorous, the use must be limited, and the auditor must do enough direct work to own the conclusion. The objectives (paragraph 11) operationalize this: to determine whether the work of the function can be used for purposes of the audit and the areas and extent of such use; to determine whether internal auditors can be used to provide direct assistance and the nature and extent of such assistance; and, having decided to use the work or assistance, to determine whether it is adequate for the audit's purposes. For practitioners, the sole-responsibility paragraph is the file's governing premise — every use decision is documented as consistent with it. For students, paragraph 8 is the standard's most quotable sentence: sole responsibility, undiminished. For the company, the practical meaning: the external auditor will never simply accept internal audit's conclusions — the evaluation, the reperformance, and the direct work are mandatory regardless of how good your internal audit function is.

Paragraph 15 requires the auditor, before deciding to use the function's work, to evaluate three attributes. Objectivity: the organizational status of the function and relevant policies — does it report to those charged with governance or to the CFO whose controls it audits? Are there policies preventing it from auditing areas where it has operational responsibility, or where its objectivity is threatened? Technical competence: whether internal auditors have adequate technical training and proficiency — qualifications, experience, continuing development. Systematic and disciplined approach, including quality control: whether the function's activities are planned, performed, supervised, reviewed, and documented to a quality-controlled standard — the application material points to frameworks like the IIA's International Standards as indicators. The auditor also evaluates whether the function's work is relevant to the audit — its scope, the assertions it addresses — and whether it is adequately documented to allow evaluation. Where the function lacks objectivity (reports to the finance director it audits), lacks competence, or works informally without quality control, its work cannot be used — the evaluation is a gate, not a formality. For practitioners, the evaluation working paper addresses each attribute with evidence — the charter, the reporting lines, the qualifications, the methodology documentation. For students, paragraph 15's three attributes are the examination core: objectivity, competence, systematic disciplined approach. For the company, the evaluation is a blueprint for internal audit quality: independent reporting lines (to the audit committee, not management), qualified staff, and a documented quality-controlled methodology are what make the function's work usable — and usable work reduces external audit duplication.

Having evaluated the function, the auditor determines whether, where, and to what extent to use its work — and the standard calibrates the use inversely to risk and judgment. The application material's sliding scale: the more judgment involved in planning and performing the audit procedures, the less the auditor uses the function's work; the higher the assessed risk of material misstatement, the less the use; the lower the function's objectivity and competence, the less the use. Significant risks (ISA 315) and areas of significant auditor judgment — the standard is explicit — are performed directly by the external auditor, not delegated to internal audit's work. Paragraphs 19 to 24 set the procedures where the work is used: discuss the planned use with the function and coordinate; read the function's reports to understand the nature and extent of procedures performed and the findings; and perform sufficient audit procedures on the body of work as a whole to determine its adequacy — including reperformance of some of the work the function performed. Reperformance is the key discipline: the auditor independently re-executes a portion of the function's procedures to test their quality. For practitioners, the use-decision working paper shows the evaluation, the areas selected, the extent rationale (tied to judgment and risk), and the reperformance performed. For students, the inverse-calibration principle and the reperformance requirement are the examination points. For the company, the message: internal audit's control testing and compliance work is the most usable; its work on judgmental, high-risk areas will be re-done externally regardless.

Paragraphs 25 to 33 govern the second use: internal auditors providing direct assistance — performing audit procedures under the external auditor's direction, supervision, and review. Paragraph 18 sets the preconditions: the use must not be prohibited by law or regulation (some jurisdictions restrict it); the auditor must communicate the planned nature and extent of direct assistance with those charged with governance; and the auditor must evaluate the existence and significance of threats to the internal auditors' objectivity and whether safeguards can reduce them to an acceptable level — considering the internal auditors' organizational status, their specific roles, and the policies in place. Direct assistance is more sensitive than using the function's work because the internal auditors act as part of the engagement team: their objectivity threats (they audit colleagues, they may later be evaluated on what they find) require explicit safeguards. The application material notes that direct assistance is not used in areas of significant judgment or significant risks — the same boundary as the first use, more strictly applied. For practitioners, the direct-assistance file section includes the legal-permissibility check, the TCWG communication, the objectivity-threat evaluation, and the safeguards. For students, paragraph 18's three preconditions are the examination content for direct assistance. For the company, direct assistance means your internal auditors working under the external auditor's direction — requiring their availability, their cooperation, and governance awareness that the arrangement exists.

Where direct assistance is used, paragraphs 25 to 33 impose engagement-team disciplines. The auditor obtains written acknowledgment from the internal auditors of their responsibilities — that they will follow the external auditor's instructions and bring significant matters to attention. The external auditor directs, supervises, and reviews the work: instructing the internal auditors on the procedures, reviewing their work for adequacy, and remaining responsible for the conclusions. The auditor tests some of the work performed by the internal auditors — reperformance again, because assistance does not dilute the evidence standard. And the auditor evaluates whether the objectives of the procedures were achieved and whether the work is adequate for the audit's purposes. The direction-supervision-review triad mirrors ISA 220 (Revised)'s engagement-team management: internal auditors providing direct assistance are, for the purpose of the procedures, treated with the same oversight as engagement team members — with the added objectivity safeguards. For practitioners, the direct-assistance working papers show the instructions, the supervision, the review, and the testing of the work — the full oversight trail. For students, the written-acknowledgment and oversight requirements are the procedural examination points. The practical boundary worth restating: direct assistance is typically used for lower-judgment procedures — inventory count attendance, control testing support, document retrieval and initial vouching — never for the significant risks and judgments the external auditor must perform directly.

The standard's limits deserve a consolidated statement because they are where ISA 610 engagements most often go wrong. The auditor does not use the function's work or direct assistance: in areas involving significant auditor judgment; for assessed significant risks; where the function's objectivity or competence is inadequate; where direct assistance is prohibited by law or regulation; or to an extent that would leave the auditor without sufficient direct evidence to own the opinion. The application material frames the aggregate judgment: the external auditor's use of the function's work, combined across the audit, must still leave the auditor sufficiently involved in the audit — the auditor cannot outsource the audit to internal audit and sign the opinion. Documentation (paragraphs 36-37) records the evaluation, the use decisions, the procedures performed on the work, the direct-assistance arrangements and oversight, and the conclusions on adequacy. For practitioners, the aggregate-involvement assessment is the file's closing judgment on ISA 610: considering everything used, is the auditor's own evidence sufficient to support the opinion? For the UAE company, the consolidated message: a strong internal audit function — independent, competent, quality-controlled — earns real audit efficiency through ISA 610, because the external auditor can use its control testing and lower-judgment work with limited reperformance. A weak one earns nothing: the external auditor re-performs everything. Investment in internal audit quality pays for itself in external audit efficiency — but it never buys the opinion, which stays solely the external auditor's.

For the UAE company with an internal audit function, ISA 610 is the standard that converts internal audit quality into external audit efficiency. Strengthen the three evaluated attributes: secure the function's objectivity — a charter establishing reporting to the audit committee (not the CFO), policies managing objectivity threats, rotation off audits of former operational areas; build technical competence — qualified auditors, relevant training, familiarity with the frameworks the external auditor tests; and operate systematically — an audit methodology with planning, supervision, review, documentation, and quality control, aligned with recognized internal auditing standards. Coordinate with the external auditor early: share the internal audit plan, discuss which work might be usable, align timing so the function's control testing precedes the external auditor's reliance decisions. Make internal auditors available for direct assistance where the auditor requests it, with governance awareness of the arrangement. And calibrate expectations honestly: internal audit's work on routine controls and compliance will be used and reperformed in part; its work on judgmental, high-risk areas will not — the external auditor performs those directly, as the standard requires. For groups, the function can also support ISA 600's component-work needs. ISA 610's bargain is straightforward: the external auditor owns the opinion absolutely, but rewards a strong internal audit function with less duplication. Build the function the standard describes, and the audit gets faster without getting weaker.