Group audits, internal audit and experts

Identify whose work is being used

The auditor remains responsible for the opinion when other people contribute evidence. First identify their role: different standards govern component auditors, internal audit and specialists.

Concept sources: ASA 600, paragraph 14; ASA 610, paragraph 14; ASA 620, paragraph 6; ASA 500, paragraph 5 — contributor roles compared in original wording.

Internal audit reports to management or governance within the entity's arrangements; the external auditor provides an independent opinion for the intended users. An internal function's access to the audit committee can support objectivity, but does not make it independent of the entity in the external-audit sense.

Apply the revised group-audit model in the guide

The supplied guide uses ISA 600 (Revised), issued in 2022 and effective for periods beginning on or after 15 December 2023. Its approach starts with risks in the group statements and determines where and how to obtain evidence. It applies beyond a parent with subsidiaries: branches, divisions and financial information included through an equity method or another consolidation process may be relevant.

The group engagement partner manages and achieves quality, sets expectations for the team and remains sufficiently involved throughout the engagement. Delegating procedures does not delegate ultimate responsibility. The group auditor takes responsibility for risk assessment, evaluates the contribution from component risk-assessment work, and addresses consolidation risks.

The guide's brief reference to “significant components” should be read alongside its revised approach. That old classification no longer determines the required group-audit work.

Concept sources: IAASB's April 2022 ISA 600 publication — revision and effective date; ASA 600, May 2022, paragraphs 2–16 and 30–38 — scope and responsibilities.

Concept sources: AUASB's June 2023 group-audit FAQs, question 6 — removal of the significant-component classification in the revision used by the guide.

Plan involvement and communicate throughout

Determine the components where work is required, the work that can be performed centrally, the resources needed and the involvement of component auditors. Consider their cooperation, competence, available time and compliance with relevant ethical and independence requirements. Membership of the same network does not remove the need for evaluation.

Give clear instructions covering scope, timing, significant risks, materiality and communication. Arrange timely exchanges about local findings, changes in risk, misstatements and obstacles; a final clearance message alone provides little opportunity to redirect work. Direct, supervise and review component work with particular attention to higher risks and significant judgements. Obtain more evidence if the work is inadequate.

Scepticism must survive distance, language differences, local cultural pressures and short deadlines. Investigate inconsistencies between component findings and group management's explanations. Document important communications and decisions so the file explains how the group conclusion was reached.

Concept sources: ASA 600, paragraphs 22–29, 45–48 and 59 — planning, component involvement, communication, evaluation and documentation.

Deal with access restrictions early

Restrictions may come from management, laws or circumstances outside management's control. Ask group management or governance to help remove them. For an equity-accounted investee, inspect information-access agreements, explore access through board representatives and evaluate information already available to the group or publicly available.

These routes are useful only if they provide sufficient appropriate evidence. An ownership percentage or inaccessible location does not lower the required assurance. Escalate unresolved restrictions, reconsider the reliability of management's explanations where relevant, and assess consequences for acceptance, continuation and the opinion. Legal constraints on withdrawal also matter.

Understand component performance materiality

Aggregation risk is the risk that misstatements which appear small separately become material together. Where group financial information is disaggregated across components for audit procedures, the group auditor determines component performance materiality below group performance materiality.

It is not a fixed allocation based on revenue, ownership or the number of entities. Consider the degree of disaggregation and the likely nature, frequency and size of misstatements. Amounts can differ between components. Specific disclosures or balances may need a lower level where smaller misstatements could influence users.

Concept sources: ASA 600, paragraphs 17–21, 35–36 and A116–A123 — access and component performance materiality; AUASB's June 2023 group-audit FAQs — supporting implementation guidance.

Evaluate internal audit before using its work

First decide whether the work is relevant. Then evaluate the function's objectivity, competence and systematic, disciplined approach, including quality control. Do not use its work if these essential conditions are absent. Where they are met, the extent of use still depends on the risk and judgement involved.

Use less internal-audit work and perform more work directly as risk or judgement increases, or support for objectivity or competence becomes weaker. The external auditor makes all significant audit judgements and remains sufficiently involved overall.

Discuss intended use with internal audit, read relevant reports and examine whether the work was properly performed and supports its conclusions. Perform sufficient procedures on the body of work, including some reperformance. A well-presented report is not a substitute for examining the evidence behind it.

Concept sources: ASA 610, December 2023, paragraphs 15–25 — eligibility, extent of use and evaluation of internal-audit work.

Keep the Australian direct-assistance rule clear

Using internal-audit work means evaluating work performed by the function. Direct assistance means internal auditors performing procedures under the external auditor's direction, supervision and review. ISA 610 contains conditions for direct assistance where it is permitted. Australian standards prohibit it.

ASA 610's prohibition also applies to direct assistance in an audit or review of a group component, including an overseas component, conducted under Australian Auditing Standards. It does not mean that every use of an overseas component's internal-audit work is prohibited.

Concept sources: ASA 610, Aus 1.2 and Aus 25.1; IAASB's ISA 610 (Revised 2013) publication — Australian prohibition and international distinction.

Use an auditor's expert with a defined purpose

Complex valuations, actuarial obligations or mineral reserves may require expertise beyond accounting and auditing. Consider the subject, assessed risk, importance of the work, previous experience with the expert and the firm's quality-management arrangements. Evaluate competence, capability and objectivity; for an external expert, enquire about interests and relationships that could create bias.

Understand enough of the field to set the scope and evaluate the result. Agree responsibilities, objectives, communication and confidentiality, in writing where appropriate. Evaluate findings against other evidence, significant assumptions and methods, and the relevance, completeness and accuracy of significant source data. If the work is inadequate, arrange further expert work or perform additional suitable procedures.

Assess management's expert as part of the evidence

ASA 500 requires evaluation of the expert's competence, capability and objectivity, an understanding of the work, and evaluation of its suitability as evidence for the relevant assertion. Qualifications and reputation help, but do not prove that this particular report is reliable. Consider conflicts, management influence, technical requirements, methods and assumptions; compare conclusions with other audit evidence and test relevant inputs.

Check that management has correctly reflected the report in the accounts. The auditor may need a separate expert to evaluate difficult specialist work. An unsupported report cannot become sufficient evidence merely because management commissioned it.

Concept sources: ASA 620, December 2022, paragraphs 7–13 — auditor's expert; ASA 500, December 2022, paragraph 8 and A45–A59 — management's expert.

Retain responsibility in the report

Using specialists or other auditors does not divide responsibility for the audit opinion. ASA 620 generally prohibits reference to an auditor's expert in an unmodified report unless law or regulation requires it. A required reference, or one relevant to explaining a modified opinion, must make clear that responsibility remains with the auditor. Management's specialist report likewise cannot serve as a disclaimer of the auditor's own responsibility.

Concept sources: ASA 620, paragraphs 3 and 14–15 — responsibility and reporting references.

Sources and further reading

• ASA 600, May 2022 — revised group-audit model used by the guide.
• AUASB group-audit FAQs, June 2023 — implementation support for that revision.
• ASA 610, December 2023 — internal-audit work and Australia's direct-assistance prohibition.
• ISA 610 (Revised 2013) — international treatment of direct assistance.
• ASA 620, December 2022 and ASA 500, December 2022 — distinguish the auditor's expert from management's expert.