Hazel O’Sullivan
Project Director
The Auditing Practices Board Limited
5th Floor
Aldwych House
71-91 Aldwych
London WC2B 4HN
Sent by email to: h.osullivan@frc-apb.org.uk
15 June 2009
Dear Ms O’Sullivan,
Revised draft Ethical Standards for auditors
We are delighted to have the opportunity to respond to the draft ethical standards for external
auditors. The Institute believes that the ongoing evolution of the ethical standards will add to
the effectiveness of external audit and thereby enhance public confidence in the financial
reporting of public interest entities. We support and welcome all developments that will
improve the key components of good governance.
The comments of the Institute of Internal Auditors – UK and Ireland have been developed
through consultation with our members and we recognise that they may be placed on public
record.
We have looked at all of the questions set out in the exposure draft but would like to
concentrate upon Section 3, question 8 as this relates directly to the professional practice of
internal auditing and the interests of our members.
We support your objective in providing further guidance to external auditors on how they can
best maintain their independence and, therefore, the quality of their opinion on the financial
statements. However, we are concerned about the implications of your proposed approach
for allowing personnel from the internal audit function to carry out external audit procedures.
In addition, although at times it may be convenient to the organisation, we have reservations
about the true value of diverting scarce internal audit resource to support the external audit
process. We believe that, if external audit regards internal audit only as a convenient
resource that they can draw upon whenever the need arises, this will weaken governance
within organisations and create a number of practical problems. We provide further detail in
the attached appendix.
Yours Sincerely
Philip Ratcliffe
President
The Institute of Internal Auditors – UK and Ireland Ltd
13 Abbeville Mews, 88 Clapham Park Road, London SW4 7BX
tel 020 7498 0101 fax 020 7978 2492 email info@iia.org.uk
Registered in England and Wales No.1474735
www.iia.org.uk
Response from the Institute of Internal Auditors – UK and Ireland
Revised draft Ethical Standards for auditors
Introduction
The Institute of Internal Auditors (IIA) is the only body focused exclusively on internal auditing
and we are passionate about supporting, promoting and training the professionals who work
in it.
We have been leading the profession of internal auditing for over 60 years. Our International
Standards and Code of Ethics unite a global community of 165,000 internal auditors in 165
countries.
The IIA plays an active role in the public arena, building awareness of internal auditing,
promoting members’ interests and challenging organisations to reach the highest standards
of corporate governance.
We are committed to enhancing the recognition and professionalism of internal audit in the
UK and in Ireland. To that end, we are consulting with our members and other stakeholders
about the award of Chartered status, which will acknowledge qualified internal auditing
professionals as experts in their field, offering a clear differentiator between internal audit
professionals and others.
Detailed comments on:
Section 3
Internal Audit staff working directly for the audit team
Question 8 Do you support the approach of the APB toward internal audit
staff working directly for the audit team?
We agree that, if it is an accepted practice that internal auditors should assist the external
auditor, it is reasonable for you to provide guidance to the external auditors on how to
manage these instances. This provides consistency with other standards relevant to external
auditors, eg the International Standards on Auditing (UK and Ireland) 610; and is consistent
with other international practices, eg the PCAOB Auditing Standard No 5 (page 9, paragraph
17).
Disagree with fundamental practice of diverting internal audit resource
However, we have some fundamental concerns with the practice itself. Clearly, there are
some circumstances where it is practical and useful for the organisation to have its internal
audit activity devote some of its resources to supporting the delivery of the external audit
opinion; but we suggest that those should be an exception not a rule. In our view, external
audit should not regard internal audit as a convenient resource that they can draw upon
whenever the need arises. Internal audit has a distinct and valuable role within the
governance structure. If it diverts its resources to supporting the external audit effort, then it
is reducing the work it can do in support of senior management and the board. This weakens
governance as a whole and creates a number of practical problems.
Internal audit helps an organisation accomplish its objectives by bringing a systematic,
disciplined approach to evaluate and improve the effectiveness of risk management, control
and governance processes. Internal audit has a broad remit, covering all risks in an
organisation, not just those related to financial reporting. It is a service to both management
and to the board, especially the audit committee, assisting those individuals in fulfilling their
15 June 2009
-2–
Response from the Institute of Internal Auditors – UK and Ireland
Revised draft Ethical Standards for auditors
responsibilities to the company as a whole. Assigning internal auditors to external audit
diverts resources away from these duties, reducing the amount of assurance available to
managers and directors on the broader risks facing the organisation, weakening an aspect of
governance.
The International Standards for the Professional Practice of Internal Auditing recognise that it
is beneficial to the organisation if the assurance providers maintain good relationships and
seek to avoid duplication of work, where possible. To this end, in paragraph 3.1, The APB
correctly recognises there are two situations where internal and external audit interact:
(i)
External audit relies upon work undertaken by internal audit, or;
(ii)
External audit agrees that internal audit should perform work and then places
reliance on it.
However, these two scenarios are vastly different from internal audit working ‘directly’ for
external audit.
In (i) external audit has little influence over internal audit objectives, scope, approach, quality
of resources. Instead, it is for external audit to satisfy themselves that the internal audit work
was performed to appropriate standards and forms appropriate and reliable evidence to
support the external audit opinion. Where the external audit relies upon the work of internal
audit there are parallels to relying upon the client's internal controls or the report of an
external expert engaged by the client. The onus is on external audit to form an assessment
on the quality of internal audit work and then determine the extent to which they can rely on
it. Independence, as far as it relates to internal audit is a very remote issue.
In (ii) external audit is forming an opinion based on an agreement that internal audit should
perform work and then place reliance upon it. This will be particularly beneficial in those
organisations where internal audit have a strategy weighted on financial risks and controls,
and can therefore prove cost effective. In this case, internal audit is much closer to the
external audit firm and independence issues are far more relevant, especially where a
significant proportion of the internal audit resource is engaged in external audit activity.
However, internal audit remains independent in the sense that the external audit manager is
not supervising the work performed.
Both (i) and (ii) are essentially about coordination and cooperation. Internal and external
audit have the broad purpose of serving the organisation by helping to ensure the highest
standards of regularity and propriety, and in promoting efficient, effective and economic use
of resource. Good co-operation maximises the benefits from working together in areas where
there is an overlap. It is a two-way process involving the alignment of strategies, not the
transfer and management of internal audit staff. The principle is about mutual benefit and not
one set of auditors working for the other.
15 June 2009
-3–
Response from the Institute of Internal Auditors – UK and Ireland
Revised draft Ethical Standards for auditors
Practical issues with proposed approach
Given that the practice exists, we anticipate some practical issues with your approach:
•
Whatever the wording of the addendum to ES2, the fact remains that, if the internal
auditors are an in house team, they are employees of another organisation. The
terms required in the revised ISA (UK and Ireland) 610 may pose a conflict of interest
to the individual at the same time that it solves the independence issues of the
external auditor. The internal auditors concerned may wish to obtain written
confirmation from the organisation that their employer is happy to waive any terms
related to confidentiality, etc.
•
If another service provider, particularly an accounting firm, provides the internal audit
service, the APB should consider whether there would be a need for guidelines on
how the working relationship should operate, including how to address potential
liability issues.
•
In relation to the points above the APB should also consider how the external auditors
should explain the impact upon their audit fee. For example, there should be some
requirement to show either the external audit costs saved by internal audit
assistance, or to add the cost of internal audit assistance to the total cost of the
external audit. This could be included in the communication at 17-1 (d).
•
If it were to go ahead, there should be a formal agreement in place between the Head
of Internal Audit, or those responsible for governance in the organisation, and the
external audit partner to confirm the role that internal audit would play, and to
reinforce that quality assurance and the responsibility for the overall audit opinion is
the responsibility of the external audit partner and not internal audit. This is in
addition to any written confirmation in 17-1 (a) and the potentially one-way
communication in 17-1 (d).
•
Your proposed wording for 17-1 includes the phrase, “in addition to the
considerations set out in paragraph 17”. Those considerations do not appear to
relate in any way to the situation in 17-1. The external audit partner should have
direct responsibility for the technical proficiency of all the external audit team, for the
evidence they accumulate, the conclusions they draw, the quality of their reports and
the disposition of the exceptions that they find. We recommend you delete that
phrase.
•
You include a bullet point stating that “the external auditor ensures that such
individuals are only involved in work where self-review or judgment is not an
important part of the audit procedure”. This appears to be extremely restrictive and to
mean that the particular skills and competencies of internal auditors will not be of use
in the work. Given this, it might be better to avoid the complications and use less vital
temporary staff if extra resources are needed.
- ENDS -
15 June 2009
-4–