Statement on Auditing Standards, Number 128: Using the Work of Internal Auditors

As a result of its Clarity Project, the Auditing Standards Board (ASB) has issued Statement on Auditing Standards (SAS) No. 128, Using the Work of Internal Auditors, to supersede SAS No. 65, The Auditor's Consideration of the Internal Audit Function in an Audit of Financial Statements (AICPA, Professional Standards, AU sec. 322 and AU-C sec. 610), and amend:

• SAS No. 122, Statements on Auditing Standards: Clarification and Recodification, section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (AICPA, Professional Standards, AU-C sec. 315);
• Various other sections in SAS No. 122 (AICPA, Professional Standards, AU-C secs. 200, 220, 230, 240, 260, 265, 300, 402, 500, 550, and 600); and
• Statement on Quality Control Standards No. 8, A Firm’s System of Quality Control (Redrafted) (AICPA, Professional Standards, QC sec. 10).

SAS No. 128 addresses the external auditor’s responsibilities when using the work of internal auditors if it includes (a) using the work of the internal audit function in obtaining audit evidence and (b) using internal auditors to provide direct assistance under the direction, supervision, and review of the external auditor.

Consistent with International Standard on Auditing (ISA) 610 (Revised 2013), SAS No. 128 introduces the concept of a systematic and disciplined approach, which is not included in SAS No. 65. Paragraph 13 of SAS No. 128 would require, among other things, as a prerequisite to being able to use the work of the internal audit function, that the external auditor evaluate the application by the internal audit function of a systematic and disciplined approach, including quality control. Paragraphs A12–A14 of SAS No. 128 provide application guidance with regard to the application of a systematic and disciplined approach. The ASB believes that relative to SAS No. 65, this requirement represents an additional and explicit evaluation that the external auditor would need to perform to conclude on the appropriateness of using the work of internal auditors.