A Good Practice Guide to Co-operation Between External and Internal Auditors

AUDITCOMMISSION

A good practice guide to co-operation betweeninternal and external auditors

It Takes Two

u The Audit Commission promotesproper stewardship of publicfinances and helps localauthorities and health servicebodies achieve economy,efficiency and effectiveness. It isconcerned to identify and spreadbest practice in auditing.

u Effective co-operation betweeninternal and external auditors isan example of good practice. Thisguide, for use by internal andexternal auditors, deals with howthey can work together.

u Internal and external auditorsfollow different priorities and areruled by different requirements,but follow similar principles andshare many aims. There is muchto be gained by good co-operation between them.

u Good co-operation means activeplanning, imaginative assessmentand a mutual exchange ofinformation. It benefits fromsupport from the top.

u Most internal and externalauditors co-operate to someextent, but the Audit Commissionhas found plenty of scope forimprovement. Sometimes there isno one at the audited body toencourage auditors to try harder.Management or the AuditCommittee have a role to playhere.

u The Audit Commission encouragesits appointed auditors to worktogether with internal auditors toachieve the best value for moneyfor the audited body.

good practiceguide

May 1996

How to use this guideIf your main interest is the benefitto be gained from co-operationbetween internal and externalauditors, read the first chapter ofthis guide on the concept of co-operation and its possible impact.You may also need to know thetechnical or regulatory basis for it,which is in the second chapterentitled Practicalities.

Chapter 2 also outlines the areasfor co-operation and gives somehelpful hints.

All auditors should read thechapters on Best practice andProblem solving. External auditorsimplementing or considering theManaged Audit should be fullyfamiliar with them.

The Checklist for action (insertedas a pull-out centre section) will behelpful to management and AuditCommittees who wish to identifytheir priorities and makeimprovements.

This guide focuses on co-operationbetween internal and externalaudit. It does not cover compulsoryor voluntary competitive testing ofthe internal audit service, the roleof the Audit Committee, ortransfers of staff between internaland external auditors. It has beenwritten for audits where theexternal auditors are appointed bythe Audit Commission, but theprinciples within it can be appliedmore widely.

Good Practice Guide It Takes Two

2

Contents

1 Concept and impact 3

2 Best practice: practicalities 6

3 Best practice: preparation 10

4 Best practice: procedures 21

5 Problem solving 26

Finally 30

Appendices

A Definition of the Managed Audit 31

B Understanding each other: the different obligations placed on internal and external auditors 32

C Control self assessment 33

Acknowledgements

This guide is based on research intoprofessional standards for internaland external auditors, publicationsconcerning co-operation betweeninternal and external auditors, andfield visits. The Audit Commissiongratefully acknowledges assistancefrom the internal and externalauditors of the following localgovernment and NHS bodies:

u Essex County Council

u Oxfordshire County Council

u Mid Sussex District Council

u Fareham Borough Council

u Leicestershire Health Authority

u Frenchay NHS Trust

u Epsom Healthcare NHS Trust

u Merton and Sutton HealthcareTrust

The Audit Commission also visited thefollowing bodies and is most gratefulto their internal and external auditorsfor the contribution they made to ourresearches:

u British Nuclear Fuels plc

u British Waterways Board

u London Electricity plc

u Royal Mail

The Audit Commission also thanksMollie Bickerstaff of KPMG and LynnHine of Coopers & Lybrand for theirwork in preparing this guide, and thevarious auditors and others, includingprofessional bodies, who reviewed theconsultation draft and gave us thebenefit of their views.

Internal and external audit havedifferent roles and different prioritiesbut there can be a lot of overlap inwhat they do and why they do it.Good co-operation between them willminimise duplication of effort andmaximise the benefits of workingtogether towards the same goals. Theconcept applies to all audits wherethere is an internal audit function,whether supplied by an in-houseteam, a consortium or another firm ofauditors. It is an integral part of theAudit Commissions Managed Audit .I

Auditors are familiar with it andshould already be doing it, but wehave found that there is scope forimprovement. Critical factors forsuccess, as illustrated in Exhibit 1, aresupport from management and theAudit Committee (where one exists),and the attitudes of the two auditors.

Successful implementation of bestpractice in co-operation may requireinput from management, internalaudit and external audit over a leadtime that could take more than oneyear. Improved co-operation bringsbenefits to management, internalaudit and external audit, as illustratedin Exhibit 2 (overleaf).

Exhibit 1Success factors for co-operation

3

1 Concept and impact

Factor Probable success Probable failure toachieve best practice

u are supportive u take little or nointerest

Internal audit

External audit u makes demands oninternal audit andgives little or nofeedback

u takes an active role inco-operating withexternal audit

Management and theAudit Committee

u is willing to makechanges to achievebest practice in co-operation

I

Readers who are not familiar with theManaged Audit will find a definition in

Appendix A to this guide. Furtherinformation can be found in the GoodPractice Guide to the Managed Audit,available on request from the Audit

Commission.

u just hands overwhatever isrequested byexternal audit

The effect on overall audit costs

Once co-operation has beenmaximised, some external audit timemay be released for other externalaudit work, such as more time for

local VFM projects tailored to suitspecific needs, or an increased focuson the prevention and detection offraud or error. Alternatively, it may berealised as a saving.

Exhibit 2Benefits


4

Management Internal audit External audit

A co-ordinated, efficient and effective total audit service. 3Independent assurance that the internal audit function meetsgood practice and complies with professional standards. Thisarises from a comprehensive evaluation of the function byexternal audit.

3 3

Improved management satisfaction with the internal andexternal audit services arising from better joint planning andcommunication.

3 3 3A potential release of external audit days which may be used toundertake other external audit work such as local VFM projectstailored to specific needs or an increased focus on theprevention and detection of fraud and error.

3 3

A forum for discussion of good practice techniques,approaches to systems-based testing and issues at the auditedbody.

3 3

The opportunity to implement a more effective audit focusedon key risk areas with no unnecessary duplication of effort. 3 3

The opportunity to implement the Audit Commission ManagedAudit and deliver the benefits to be derived from it. 3 3 3

The size of the audit and of theinternal audit resource will have aneffect on the potential for tangiblebenefits arising from improved co-operation. Small audits or limitedinternal audit resources meanproportionately less scope.

External audit time can only bereduced if the agreed plans for co-operation are met each year. Thisgenerally means that internal auditmust be able to complete their agreedplan of systems-based audits and begiven sufficient resources. Forexample, if internal audits work onad hoc queries, fraud investigations orother unplanned emergencies drivesout agreed systems work, externalaudit will have to do the essentialwork, at additional cost. In smallaudited bodies or cases whereinternal audit resource is very limited,it may not be possible to cope withunexpected demands on internalaudit time without dropping somework previously agreed with externalaudit.

Some audited bodies may decide toconsider increasing their investmentin internal audit in order for externalaudit to place maximum reliance ontheir work.

Co-operation between internal andexternal auditors still gives rise tosome basic questions frommanagement, as illustrated in Exhibit3. Auditors should make sure thatmanagement understands the issuesand the need to be supportive.

5

1 Concept and impact

Exhibit 3Answers to some common questions from management

Most internal and external auditorsare already co-operating but many could go further or do better. This guidemay help improve the benefits being derived from co-operation.

It shouldnt. Thats not what co-operation is about. Co-operation is about understanding where the twotypes of work overlap and eliminating unnecessary duplication.

Possibly. The external auditors may beable to spend less time on some areas of the audit, without an appreciableincrease in internal audit costs. You may wish to make use of any releasedtime on, say, local VFM projects.

Probably not, athough that depends onwhether you have an optimal level of internal audit resource in the firstplace. You will want to determine how to use internal audit resource so as toprovide a service that meets managements requirements most effectively.

Internal and external auditors carry out different functions, both of themuseful to management and the audited body. See Appendix B for the details.The law says you have to have external auditors, and good sense generallycompels you to have internal auditors too, although there may also be certainrules or regulations (eg, NHS requirements).

Why should my internal audit resource have to do the external auditorswork for them?

Will I be expected to get more internal auditors?

Why do I have to have two sets of auditors anyway?

Will it bring my overall audit costs down?

Is this something new? Why havent my auditors been doing it for years?

The first and most fundamentalpractical requirement is that internaland external auditors shouldunderstand the different obligationsplaced on the other auditors.Appendix B to this guide discusses themain points of similarity anddifference between what is requiredof internal and external audit.

The second practical requirement isthe existence of a well-run andappropriately resourced internal auditunit. This guide does not deal withhow to resource and run an internalaudit unit. Guidance on these mattersis available from, among others,CIPFA, the Institute of InternalAuditors, and the NHS Executive.

This chapter considers the areas ofaudit work where the external auditorwill normally consider relying oninternal audit. Reliance, and how theexternal auditor should approach it,are dealt with in the next chapter, onpreparation.

Opinion and non-opinion externalauditing

External auditors appointed by theAudit Commission must meet severaldifferent audit objectives, of whichgiving an opinion on the financialstatements is only one, normally themost significant. This is explained inmore detail in Appendix B. Theexternal auditor may rely on internalaudit work for many of the auditobjectives, as outlined below.

Review of internal control

The most common areas of co-operation will be the review ofinternal control. External auditors maydecide to rely on internal control aspart of their opinion audit work.External auditors appointed by theAudit Commission are also required togive an independent assessment ofthe adequacy of the audited bodysfinancial systems. In either case,external auditors need not carry outthe detailed work themselves if theyare able to rely instead on systemswork done by internal audit.

The review of internal control overfinancial systems is a well known areaof audit work, but there are manydifferent approaches to it. Effectiveco-operation between internal andexternal audit will benefit frommethods that are shared, or at leastwell understood, by both parties. ACIPFA guideI incorporating detailedcontrol matrices for seven systemsidentified as core to local authoritiesand the NHS will be helpful inachieving a widely sharedunderstanding and possibly acommon method.


6

2 Best practice: practicalities

I

Due for publication in 1996. ContactCIPFA, the Chartered Institute of PublicFinance and Accountancy, at 3 Robert

Street, London WC2N 6BH.

This chapterconsiders the areas ofaudit work where theexternal auditor will

normally considerrelying on internal

audit.

Computer audit work

There is some useful co-operation inthe use of computer-assisted audittechniques (CAATs, usually data fileinterrogation software). But,otherwise, we found little co-operation in practice on computeraudit work, which may result from arelative scarcity of computer auditskills among internal auditors. Wherethis is the case, management shouldconsider whether internal audit mightbenefit from joint projects with moreexperienced external computer auditstaff, or whether more formal trainingby external audit would be beneficial.

Final accounts work

Internal audit can assist external auditwith work on year end balances or onthe verification of assets. In somecases year end work is not withininternal audits ambit but where it isor can be accommodated then co-operation is possible.

Visits to establishments

In cases where there are many entitieswithin the audited body requiringaudit visits (eg, schools, GPfundholders, cash offices, socialservices units) it will often be sensiblefor internal audit to take the lionsshare of the necessary audit visits,since their greater familiarity with thebusiness being conducted and theiryear-round presence provide potentialefficiencies for the audited body.

Value for Money (VFM) auditing

VFM auditing is an area where overlapbetween internal and external audit ispossible but can be limited. Someinternal audit units have adopted theobjective of assisting management inthe pursuit of value for money, butsome do not have this objective andtherefore do not carry out work thatis equivalent to the VFM work beingdone by external audit. On the otherhand, there may be occasions wherean operational audit or a specialproject carried out by internal auditcan replace all or part of an externalaudit VFM project, or instances whena project taken to overview stage bythe external auditors can becompleted by an internal audit team.

Where internal audits objectives andthe scope of their responsibilitiesinclude VFM or the equivalent, theninternal and external audit shoulddiscuss whether any project or reviewcould be done on a co-operativebasis. In cases where work is beingdone jointly, the external auditors willneed to ensure that the study teammeets the Audit Commissionsrequirements as set out in the AnnualLetter of Guidance.I

The Audit Commission is consideringa different approach to theimplementation of VFM studies,currently known as study-implement-audit. Internal audit may have a roleto play in the implement stage.

7


I

The Annual Letter of Guidance is issuedby the end of October each year by the

Audit Commission to its appointedauditors.

VFM follow up

External audit is required toinvestigate the audited bodysprogress in implementing agreed VFMrecommendations from past yearsand in achieving agreed savings. Thisis an area where internal auditsgreater degree of presence on siteand closer knowledge of the auditedbody could mean they can deal withVFM follow up effectively. Bothauditors will be aware that it ismanagements responsibility to ownand to deliver the follow-up action.

Management arrangements

External audit is required to assessmanagements arrangements for theeconomic, efficient and effective useof resources. Internal auditors willoften be required to appraise theeconomy and efficiency with whichresources are employed (Institute ofInternal Auditors Standard 340).There is good potential for co-operation here too.

Fraud and corruption

Internal and external audit will bothhave audit objectives concerningfraud and corruption. In the case ofexternal audit, it is to give anindependent assessment of theaudited bodys arrangements forpreventing and detecting fraud andcorruption, while internal auditsobjectives will vary depending ontheir terms of reference and may bewider than those of external audit.For instance, the NHS Internal AuditManual requires internal audit to:

Review, appraise and report uponthe extent to which theTrust/Authoritys assets andinterests are accounted for andsafeguarded from loss of any kind,arising from:

u fraud and other offences;

u waste, extravagance,inefficient administration;

u poor value for money or other causes.

Internal audit may be seen as part ofmanagements arrangements in theprevention or detection of fraud andcorruption. External audit is obligedto follow guidance issued from timeto time by the Audit Commission.Internal and external audit shouldkeep each other fully informed oftheir plans and work in progress onthe prevention and detection of fraudand corruption, and should be able toco-operate. For instance, they shouldbe able to agree a joint programmefor cyclical coverage of selected auditareas. But external auditors willgenerally be expected to carry outsome work themselves in addition torelying on the work done by internalaudit.

Grant claims

The external auditor relying oninternal audit work on local authoritygrant claims will be expected to re-perform some of the internal auditwork concerned. This requirementstems from the risk inherent in grantclaims that management may have a

vested interest in falsifying suchclaims. The external auditor will beaware that internal audit, by itsnature, can never be whollyindependent of top management, andso is expected to take this or anequivalent precaution in exercisingthe external auditors responsibility tocertify grant claims. The extent andlevel of re-performance will be amatter for the external auditorsjudgement, having regard to anassessment of risk.

Performance indicators

External auditors appointed by theAudit Commission are required tosatisfy themselves that arrangementsput in place by management for thecollection, recording and publicationof certain performance indicators areadequate. This is another area whereco-operation with internal audit canbe considered.

Sharing the files

It will be sensible, where possible, forinternal audit and external audit toagree some means of sharing therelevant working paper andcorrespondence files withoutduplicating them, since duplicationintroduces an increased risk of thetwo copies becoming out of step.Ownership of the files may be anissue. External audit working papersbelong to the external auditor, whileinternal audit working papersultimately belong to the auditedbody. If the logistical or ownership


8

problems of file sharing areinsurmountable, then arranging freeaccess to each others files may be anacceptable alternative, and careshould be taken when relying on acopy of a document or working paperwhere the original could have beenupdated.

Joint reporting

Joint reporting may also be difficult toarrange, for practical reasons. Internalaudit are often required to reportpromptly to their Audit Committee (orequivalent governing body eg, analternative committee or the ChiefExecutive or Director of Finance) assoon as each project is complete.Internal audit will probably beworking to terms of reference for theproject that go beyond therequirements of external audit.Conversely, external audit willnormally be working to a differentaudit reporting timetable, focused onmemoranda to management to dealwith any matters arising from theirearly review work and the annualmanagement letter issued towardsthe end of the year. Where some formof joint reporting is arranged, oftenon systems evaluation, for instance,care should be taken not to blur thedifferent accountabilities of theinternal and external auditors.Auditors should consider jointreporting where it adds value for theaudited body.

Staff transfers

The short-term transfer orsecondment of staff can be useful inachieving a better understanding ofthe other auditors processes andpriorities. This is more often done bytransfer of an internal auditor to workwith the external auditors for a time,although transfers in the otherdirection, or swaps, can also takeplace.

Reliance on self assessment

Control self assessment (seeAppendix C) is a risk and an internalcontrol review technique that can beof benefit to the audited body but, byits nature, external audit may havedifficulty in establishing whether itmeets their requirements. Since theuse of control self assessment in localgovernment and the health service islimited as yet, external auditors whoencounter it in practice should consultthe Audit Commission and shouldconsider each case on its merits. Ifinternal audit and the audited bodyconcerned are finding control selfassessment (or any other form of selfassessment by management)sufficient to give assurance oninternal control, then the AuditCommission would wish its appointedauditors to work constructively withinternal audit to determine whether ameans of relying on it might befound.

9


Good co-operation is a multi-stageprocess that may take a number ofyears to develop. It can be initiated byeither party. This chapter describeshow to get ready and Chapter 4 dealswith the annual cycle.

Reliance by external audit oninternal audit

Key among the obligations placedupon external audit is therequirement to take responsibility formeeting the audit objectives in theCode of Audit Practice. Externalauditors are not allowed tosubcontract this responsibility. Theexternal auditor relies on work doneby internal audit but may not handover responsibility for it. The externalauditor achieves this by:

u an overall evaluation carried outby external audit from time totime to determine whetherinternal audit continues to meetrequired standards;

u an update review each year toconfirm the external auditorsunderstanding of the quality ofthe internal audit work beingdone on areas earmarked forreliance; and

u specific reviews by external auditof individual pieces of internalaudit work, carried out each year,which may include some re-performance, depending on thenature of the work and the resultsof the updated overall evaluation.

External audit may take into accountany other form of accreditationachieved by internal audit, such asreviews carried out by regulatorybodies or other agencies.

Other measures that can be takenfrom time to time include:

u training as needed in each othersaudit methodology for appraisinginternal control over financialsystems;

u rotational reviewing, whereinternal audit might review acertain system in most years withexternal audit carrying out thereview once, say, every third orfourth year (although somesignificant systems need to bereviewed each year); and

u arrangements for joint working onspecific projects with thepossibility of skills acquisition ortransference.


10

3 Best practice: preparation

The externalauditor relies on work

done by internalaudit but may not

hand overresponsibility for it.

A two-way process is best

The fact that external audit is relyingon internal audit, and needs to followan evaluation process before doingso, tends to make it seem a one-wayprocess. There is a temptation forexternal audit to make all thedemands and for internal audit to bereactive. But internal audit has manyadvantages, stemming from itspermanent presence on site andcloser knowledge of the audited body,and has much to contribute. An openapproach, with both parties playingtheir part actively in a joint auditprocess is best.

The joint audit process

There are eight main stages in thejoint audit process for external andinternal audit, includingcommunication. They are summarisedin Exhibit 4. Auditors will movethrough all of these stages, someevery year and others every few years.

11


CONSULTATION

EVALUATION

TRAINING

Annualcycle

REPORTINGRISK

ASSESSMENT

MONITORINGAND REVIEW

PLANNING

Every

few

years

COMM

UNICA

TION

Exhibit 4Procedures

Communication

Communication is fundamental indeveloping and maintaining good co-operation between auditors. It runsthrough the co-operation processfrom start to finish, and may beformal, informal or a combination ofboth. Good communication isgenuinely two-way so that issues arediscussed at the appropriate stages ofboth audit cycles, with formal notes

produced and further meetingsarranged throughout the year. Goodpractice examples are described inCase Studies 1 and 2.

Evaluation

Under Statement of AuditingStandard (SAS) 500.3 issued by theAPB,I external auditors shouldperform an evaluation of the internalaudit function if they consider that itmay be possible and desirable toplace reliance on internal auditswork. SAS 500 applies to AuditCommission audits. A full evaluationshould be carried out from time totime, and should be updated everyyear. Some audited bodies prefer afull evaluation at least every twoyears.

The evaluation should assess how wellinternal audit meet their objectivesand whether the service delivers valueto the audited body. There wouldgenerally be a full evaluation ofinternal audit in a period with anymajor change; for example, a changein key internal audit staff or theappointment of new internal auditors.In the NHS, for example, there hasbeen a recent change away from in-house provision of internal auditservices,II the difference being spreadfairly equally between consortia andfirms. These new providers will haveto be assessed.

This guide does not deal with any ofthe methodologies for evaluatinginternal audits performance. Themethod of evaluation is a matter forthe external auditor concerned, whowill be able to obtain advice from, forexample, CIPFA, the Institute ofInternal Auditors or any of the firmswhich specialise in this work.

The concept of a peer review will befamiliar to many internal auditors,and is included in the standardsissued by the Institute of InternalAuditors. Internal auditors may wishto consider whether they wouldprefer to have a review carried out bysomeone other than the currentexternal auditor, perhaps with widerexperience of the internal auditfunction, and whether the results ofthat review might be made availableto the external auditors.


12

I

The Auditing Practices Board (APB) wasestablished in 1991 by the Consultative

Committee of Accounting Bodies toadvance standards of auditing andprovide prescriptive, persuasive and

other guidance for the exercise of theauditors role.

II

Source: Audit Commission data for 1993/94 and 1994/95.

Case Study 1Effective communication

The internal and external audit at one entity have a written agreement to meeton a quarterly basis with set agendas for each meeting. These formal meetingsare accompanied by access to the other auditor, if needed, on an ongoingbasis throughout the year. The agendas for the quarterly meetings include:

February Confirmation of internal audit testing and results

May Discussion of external audit findings so far, internal audit progress and any external audit planning issues requiring internal audit liaison

September Informing internal audit of external audit results, and discussionof internal audit planning issues for the following year

December Discussion of internal audit progress and issues arising

Difficulties may arise if the internalauditors have any reason to supposethat the external auditors may bebidding against them in some futurecompetitive tender, whether forinternal audit services to the same oranother audited body. In suchcircumstances, it is for the partiesconcerned to come to anunderstanding, having regard to theirrespective professional requirements.The Audit Commissions view is thatthe interests of the audited bodyshould take precedence.

The results of the evaluation shouldbe discussed fully and openly withinternal audit, with a view to makingconstructive suggestions forimprovement where appropriate. Theresults should also normally be

presented to management and theAudit Committee, where one exists, aspart of the overall audit service.

External auditors should be aware thatsome internal audit consortia, agencysuppliers (NHS) or firms operate acrossa number of audited bodies. Externalauditors should consider whether itmay be satisfactory for one externalauditor to carry out the overallevaluation of the consortium andmake the results available to theexternal auditors of the other auditedbodies using the consortium.Appropriate terms of reference mayneed to be agreed, and suitableassurances exchanged, to cater for theliabilities that might arise.

Detailed reviews of the consortiaworking papers on particular auditedbodies should be completed by eachindividual external auditor. The resultsof the evaluation process should becommunicated to the internal auditor.They should also be reported tomanagement (s151 officers andappropriate non-executives in localgovernment and Audit Committees inthe NHS). A good practice example ofan evaluation can be seen in CaseStudy 3.

13


Case Study 3Evaluation of internal audit

One NHS body visited had appointed new internal auditors for the 1994/95financial year. External audit undertook an evaluation of the new internalaudit service to ensure that it complied with the mandatory standards of theNHS Internal Audit Manual, in respect of:

Objectives and scope Independence

Due professional care Staffing and training

Relationships Planning, controlling and recording

Evidence Evaluation of the internal control system

Reporting and follow up

The results of this evaluation were discussed in detail with the internal auditservice. This was followed up by comprehensive reporting of the agreedevaluation to management and to the Audit Committee. This reportingexplained each internal audit standard and the external auditors assessmentas to whether internal audit met the standard. An overall conclusion of theevaluation was also given by external audit.

Case Study 2Communicating the results of anevaluation

An auditing consortium that hasoften been evaluated by differentexternal auditors always asks theexternal auditors not to say in theirreports we cannot rely on internalaudit when what they mean is thecoverage achieved by internal auditin any year is insufficient to allowus to do less systems workourselves, or words to that effect.It is important to be clear whenwording the results of anevaluation, so as not to give anyfalse impressions.

Consultation

Consultation aims to determine themechanism through which internaland external audit will co-operate,and to set it up to run for a numberof years. Auditors should consult onthe standards and procedures for co-operation in the broad sequenceshown in Exhibit 5 which is discussed,stage by stage, in the rest of thischapter.


14

Exhibit 5Consultation

Communication

STANDARDS

Reporting

Systemsapproach

Sharingfiles

Documentation

Reviewmechanism

Timing ofcycles

Systemswork

PROCEDURES

Fraudwork

VFM work

ACTION PLAN

AGREEMENT

Action plan

Management and both sets ofauditors will initially need to agree anaction plan to implement therecommendations arising from theevaluation stage. All three partiesshould agree this action plan toensure:

u management buys to in allrecommendations with resourceimplications;

u internal audit accepts therecommendations made; and

u external audit is satisfied with theactions proposed by internal auditand management.

Alternatively, external audit maysimply be made aware of thereasoning behind the rejection of arecommendation. For example,external audit may haverecommended that the internal auditfunction employ more specialists butmanagement may decide that thereare insufficient benefits to justifyimplementing this recommendation.In this case, the auditors wouldnormally respond by consideringwhether productivity can be furtherenhanced.

Systems approach

Internal audit work on systems andinternal control is primarily intendedto ensure that the service deliveredmeets managements.needs. It willoften be wider in scope than externalaudit work on systems, which iscarried out to meet the auditobjectives set by the Code of AuditPractice. Consultation may thereforebe required to ensure that eachauditor understands the otherssystems-based audit approach. Co-operation between internal andexternal audit can be less timeconsuming when both sets ofauditors use similar systems-basedaudit approaches, making it quickerfor external audit to identify areaswhere they will be able to rely on thework of internal audit and to carryout the required reviews of internalaudit work. But external audit shouldbe capable of understanding andreviewing internal audits approach,even when it differs from their own.

In many cases, both sets of auditorsare probably already using similarapproaches to the identification ofsystems and auditable areas. Oneexample of a shared audit approachwas seen at a health authority, asshown in Case Study 4.

15


Case Study 4A shared audit approach

The external and internal auditservices at a health authority cametogether to discuss and draw upjoint testing plans and auditschedules for GP fundholderaudits. This has enabled externalaudit to achieve the AuditCommissions recommended three-year cycle, with reliance on internalaudit in the interim years.

Documentation

Another area of consultation may bethe standards of documentation to bemaintained on internal and externalaudit files in order for reliance to bemaximised. Both sets of auditors arerequired by professional standards torecord their work adequately, but mayfind it useful to discuss at a moredetailed level certain minimumstandards of documentation for bothsets of auditors to adopt; for example,whether source documentation is tobe copied to the audit file whenerrors are noted during detailedtesting. There are advantages anddisadvantages to adopting oneauditors methods of testing and

documentation, as shown in Exhibit 6.It is up to the auditors to decidewhich option is best in each case.

Good practice examples of co-ordination of documentation inundertaking systems work were seenat a local authority and a public utilitycompany. These are described in CaseStudy 5.

Sharing files

Auditors should also agree practicalarrangements for sharing relevantfiles and working papers. Theseconsultations may includearrangements for access to the files,photocopying the files wherenecessary, file storage and theretention policy to be used, and mayhave regard to ensuring that noinappropriate liabilities might arise.

Communication

Both auditors should consider andagree how communication betweenthem will work in practice. Oneexample of a good mechanism forcommunication was noted in CaseStudy 1 (page 12). Auditors may alsowish to set up other practicalcommunication arrangements such asarrangements for sharingaccommodation when the externalauditors are on site.


16

Exhibit 6Audit documentation

Advantages Disadvantages

External auditors method

u quick and easy for the externalauditor to assess each yearwhether the work has been donein accordance with the Code ofAudit Practice.

u training and support may beneeded for the internal auditteam.

Internal auditors method

u no initial delay in training. u the method may need to beadapted in some ways to meetthe external auditors needs.

u little or no change for the internalauditor.

u the external auditor has to domore work to understand andevaluate the internal auditorsmethods and results.

Reporting

Auditors may wish to agree astandard reporting format. The mainadvantage of a standard format isthat audit findings will be reported tomanagement in a consistent way by

both sets of auditors. There may bescope for management to take a partin developing a standard format, toensure the result is going to be usefulto management.

Timing of cycles

In order for co-operation betweenauditors to work most effectively,there should be consultation andagreement as to the timing of theiraudit cycles during the year. Prior toconsultation and discussion betweeninternal and external audit, the timingof the external regularity audit cycleduring the year may look likeExhibit 7.

The internal audit cycle normally runson a financial year basis. By April,

internal auditors will generally have aplan agreed with management for theyear ahead. External audit planningfor the financial year audit generallytakes place from November to Januaryin the financial year, followed by asystems audit at some point fromJanuary to April and a final accountsaudit in the summer following theyear end. External audit planning forthe following year will not take placeuntil approximately November, somenine or ten months after internalaudit planning for that same year. Theexternal audit management letter, anannual report on all audit activitiesthat must address all the auditobjectives, should be issued tomembers by 31 December.

17


Exhibit 7External audit cycle before discussions (excluding VFM audit)

Case Study 5Systems audit work documentation

External audit at one localauthority have shared their systemstesting and summarydocumentation with internal auditfor a number of years. Thisdocumentation has been adaptedslightly by internal audit to meettheir own needs. External auditfind it quick to review the work ofinternal audit as thedocumentation used bears a strongresemblance to their own.

The internal and external auditfunctions at a public utilitycompany visited have found apractical and easy way for internalaudit to document their work tofacilitate quick review by externalaudit. The internal audit functioncontinue to use their own standarddocumentation; however, all of thetests on which external audit seekto rely have been identified on theinternal audit programme by theuse of italic type. This was achievedby the internal and externalauditors jointly going through theinternal audit documentation toidentify tests of particularrelevance to external audit.

Systemsaudit

Planning

Finalaccounts

audit

Leve

l of

acti

vity

Time

For co-operation to work mosteffectively there needs to beconsultation as to the timing of theseaudit cycles and a readiness to adapt,where possible, to accommodate theneeds of the other auditor. Externalauditors should be aware of thetiming of the internal audit planningcycle. Good practice examples of thisadvancement of elements of theexternal audit planning process wereseen at a number of bodies. Anexample is shown in Case Study 6.

Other timing issues that may requireconsultation are the timing of internalaudit reviews and follow-up work onkey financial systems and the timingof the external auditors interimsystems audit. External auditors needto gain assurance as to the operationof key financial systems throughout


18

Case Study 6Planning

As soon as new internal auditorswere appointed in April 1994, theexternal auditors met with theinternal auditors to discuss internalaudit plans and how to maximiseco-operation between the two setsof auditors. This meant that theexternal auditors began to thinkabout the planning for their1994/95 audit before they hadcompleted their 1993/94 financialstatements audit. The externalauditors were able to implement aManaged Audit for 1994/95.

Case Study 7The consultation process

As a result of consultation oninternal audit plans at one auditedbody, the internal audit serviceagreed to reschedule their audit ofcreditor payments from April 1994to December 1994. This gaveexternal audit the opportunity toplace greater reliance on the workof internal audit with only threemonths of the financial year notcovered by the internal audit work.

The external and internal auditorsat another audited body haveagreed that internal audit work onsystems should take place later inthe financial year in future, andthat their selection of samplesshould be spread over the periodto date. This will give external auditgreater comfort in expressing anopinion on the financial statementsfor the year. External audit haveagreed that their interim audit canbe moved from January/February toafter March.

In another case, internal auditschedule their work in consultationwith external audit, to mutualbenefit. At least one audit isundertaken for the externalauditors each year. Internal auditsuggest the topic, and draw up anassignment brief which is signedoff by both auditors. The reportgoes to external audit and to theCounty Treasurer.

the financial year in order for them tobe able to reduce the level ofsubstantive testing they need toundertake. For this reason, externalauditors may wish to discuss withinternal audit the timing of internalaudit reviews of key financial systems.Examples of this consultation processare described in Case Study 7.

The results of consultations betweenauditors on the timing of audit cyclesmay give rise to an external auditcycle looking something like thatshown in Exhibit 8.

Fraud and corruption and VFMwork

External and internal auditconsultations may also extend tofraud and corruption and value formoney work. A number of exampleswere seen of joint internal andexternal audit fraud and corruptioncyclical programmes covering a periodof years. An example of good practiceis described in Case Study 8.

The auditors at an audited body haveshared the Audit Commission FraudManual. This manual was used byboth sets of auditors when they satdown to devise and agree a jointthree-year plan on fraud andcorruption work to be undertaken byeach set of auditors.

Systems work

The final matter that internal audit,external audit and management maywish to consider is the extent ofsystems work external audit believesthey should undertake. For example,the agreement in Case Study 1 (page12) clearly specifies the work thatexternal audit will undertake onsystems, assuming that internal audithave completed their agreed work.

Training

Consultation may indicate trainingrequirements both for internal andexternal audit so that they can ensurethey can perform their agreed areasof work. At one public utilitycompany, a training need wasidentified for the internal auditfunction in techniques for file designand cross referencing of workingpapers. In this instance, the externalaudit function carried out thistraining. In some cases there may be atraining need for external auditors in

19


Exhibit 8External audit cycle after discussions (excluding VFM audit)

Case Study 8Consultations on fraud andcorruption work

The auditors at an audited bodyhave shared the Audit CommissionFraud Manual. This manual wasused by both sets of auditors whenthey sat down to agree a jointthree year plan for audit work onthe prevention of fraud andcorruption.

SystemsauditPlanning

Finalaccounts

audit

Leve

l of

acti

vity

Time

undertaking effective reviews ofinternal audit work and in analyticalreview audit techniques. If theconsultation process has resulted inan agreement to adopt one methodfor systems audit work, there may bea training need for at least one set ofauditors to become familiar with anew approach.

Getting started

Auditors starting from square one, orclose to it, may find the summaryimplementation plan in Exhibit 9useful.

Conclusion

Best practice co-operation dependson sound set-up work which isupdated from time to time. It requirescontinuing attention to training andeffective communication. This chapterhas described the steps to be taken inorder to prepare for and maintain co-operation at its optimum level.


20

Exhibit 9An implementation plan

The internal and external auditors at a local authority agreed this action plan:

1Agree in principle with the Director of Finance. Copy toChief Executive and members. Produce draft protocolof external/internal coverage of accounting systems.

December1994

2 Agree internal audit programme for 95/96.February1995

3 Review internal audit standards achieved on 94/95work and feed back any areas for improvement.March1995

4

Produce an external audit plan for 95/96 audit workbased on agreed internal audit coverage and assumedstandards agreed following review of internal audit94/95 work. Agree the plan with internal audit.

September1995

5 Produce an agreed three-year cyclical plan for jointsystems coverage.January1996

6 Review internal audit performance in 95/96.March1996

7 Establish a programme for full implementation, ifpossible, from 96/97.March1996

Risk assessment

One of the earliest steps in the annualaudit cycles of each set of auditors isto review and update their riskassessment in accordance with theirown policies and procedures. Theinternal auditor considers whether anevent or action will adversely affectthe audited body. The external auditorconsiders the risk of giving aninappropriate audit opinion on thefinancial statements, and the riskassociated with each of the otherexternal audit objectives (seeAppendix B). In good practiceexamples, risk assessment is thedriving force behind both auditorsapproaches to their work.

For internal auditors, the result of therisk assessment process is usually theproduction of an Internal Audit NeedsAssessment. This is an appraisal of thesystems operated by the auditedbody, their relative risk, and thefrequency with which an internalaudit appraisal of them should bemade. This assessment encompassesthe compliance, operational andfinancial activities of the auditedbody. The external auditors riskassessment is generally restricted tothe financial systems, in accordancewith the Code of Audit Practice.

I

Internal and external auditors shouldshare the information contained intheir risk assessments in order toinform each others assessments.Differences may arise. For instance,external auditors may need torecognise that internal audit may rate

a system at a lower risk and thereforemay not need to test it as often as theexternal audit objectives mightrequire.

Planning

Next, each set of auditors will drawup their initial audit plans for the year.External auditors may be some nine orten months, or in extreme cases up toa year, behind internal audit indrawing up their plans for the samefinancial year. This disparity in thetiming of internal and external auditcycles needs to be actively managed.Internal and external audit need todiscuss each others plans tounderstand the proposed scope,timing and extent of audit work witha view to eliminating duplication ofeffort.

External auditors need to startthinking further ahead. By the timeexternal audit start planning, internalaudit are generally already over halfway into their audit year, with a goodview of progress and findings to dateand the likely outturn of internal auditactivity against the original plan. Boththese pieces of information will be ofuse to external audit planning inorder to determine the amount ofreliance on internal audit that theycan build into their plan and the likelysystems and substantive testing to becarried out. Exhibits 10 and 11(overleaf) give examples of theconsiderations auditors may havewhen reviewing each others plans.

21

4 Best practice: procedures

I

The Audit Commission is obliged, bylaw, to publish and maintain a Code ofAudit Practice that embodies the AuditCommissions view of best professionalpractice in the standards, procedures

and techniques to be adopted byauditors in discharging their functions.

Risk assessment isthe driving force

behind both auditorsapproaches to their

work.

Management and Audit Committeesshould seek to promote good jointplanning between internal andexternal audit. The NHS ExecutiveAudit Committee Handbook containssuggested questions for AuditCommittees when reviewing externalaudit plans. These include thequestion,What are the auditors doingto co-ordinate their work with theauthoritys/trusts Internal Auditors?

Performing work

The next stage is for both auditors toperform their agreed audit plan usingthe agreed approach anddocumentation methods. Internalaudit work for the year will start firstand internal auditors should continueto liaise and communicate withexternal auditors on the progress oftheir audits during the year. This willenable external audit to update theirplans to take account of internal auditprogress, findings andrecommendations.

u In a number of good practice sites,this ongoing liaison as work isperformed takes place by meansof quarterly meetings betweeninternal and external audit.

u In another example, liaisonarrangements were more informalwith external audit sharingaccommodation with internalaudit when on site.


22

Exhibit 10Reviewing INTERNAL audit plans

Timing could any adjustments bemade to the timing of internal orexternal audit proposed work tomaximise the potential forreliance?

Scope could any adjustments bemade to the areas of work selectedby internal audit to enablemaximum reliance to be placed ontheir work?

Extent could any adjustments bemade to the extent of internalaudit work; for example, fromreview to detailed testing, in orderfor reliance to be maximised?

Exhibit 11Reviewing EXTERNAL audit plans

Duplication is there anypotential duplication in the workproposed by external audit withwork we have already undertakenor are due to undertake?

Assistance are there any areas inwhich external audit are planningwork where we could assist withinour agreed resources and plan?

Omissions are there any areasexternal audit have overlookedwhich, due to my knowledge ofthe entity, one of us should bedoing some audit work on?

Both these mechanisms can workwell, provided the auditors concernedunderstand the underlying imperativeof good two way communication. Theextent of external audit systems workshould depend on the timing, scopeand extent of internal audit work oneach system. This may also be true forfraud and corruption work andpossibly value for money work. Inorder for external audit to rely on thespecific work of internal audit, theymust first take reasonable steps toensure that the work has been donein accordance with the requirementsof the Code. This is considered furtherin the next section on review. Havingundertaken their review of internalaudit work, external audit will drawup their own programme of systemsand substantive tests in order to gain

sufficient audit assurance to meettheir obligations under the Code. Onegood practice example of tailoring ofthe external audit systemsprogramme to take account of thework of internal audit is described inExhibit 12.

In order for external audit tomaximise their reliance on the workperformed by internal audit, they maydelay their interim systems audit untilafter internal audit have completed orsubstantially completed their financialsystems work. In one local authority,for example, the external auditsystems audit has been put back fromDecember to late January/earlyFebruary with plans for future systemsvisits to take place after the 31 Marchyear end. A public utility company hasseen a different effect from increasedreliance on internal audit work byexternal audit. External audit are nolonger perceived as undertaking theirwork in defined interim and finalaudit visits. Instead, an external auditpresence is seen at the audited bodythroughout the year, with externalaudit reviewing internal audit workand determining their own workprogrammes as and when internalaudit work is completed.

When external audit have undertakentheir work programmes for systemstesting, they should feed back theresults of their work to internal auditas well as to management. This maybe achieved in practice by providinginternal audit with copies of anyexternal audit systems reports tomanagement. This will ensure thatinternal audit are made aware of theresults of any external audit work thatmay have an impact on the internalaudit needs assessment for futureyears.

23


Exhibit 12External audit systems testing

Following a detailed review of thework performed by internal audit,the external audit workprogramme for systems andcontrols testing was limited to:

u summarising the work andfindings of internal audit;

u testing of a small number ofkey year end controls notcovered by internal audit dueto the timing of the internalaudit work; and

u a detailed analytical review.

Review

As noted above, external audit needto take reasonable steps to ensureinternal audit work is performed inaccordance with the requirements ofthe Code of Audit Practice. Theirreview of specific internal audit workwill consider whether the work hasbeen performed properly and has metthe standards agreed at theconsultation stage. The results of thereview will help external audit todetermine whether the overallevaluation of the internal audit serviceremains appropriate. The issuesexternal auditors take account of intheir review include the mattersshown in Exhibit 13.

A good practice example ofdocumentation of the external auditreview of internal audit work is

described in Exhibit 14. External auditshould ensure that the results of theirreview of internal audit work areformally communicated to theinternal auditors. This should furtherpromote two way communicationand enable the Chief Internal Auditorto take action on any points arisingwhere it may be needed.

Reporting

The final stage in each audit cycle isreporting. Internal auditors generallyproduce reports for each audit theyundertake, together with summaryreports on at least an annual basis.Internal auditors should keep externalaudit informed by sending them acopy of each final audit reportproduced. This good practice wasnoted at most of the sites visited. Inorder for internal audit to be


24

Exhibit 13Review considerations

u Was the work done by properly trained staff?

u Was the work of junior staff properly supervised and reviewed?

u Was sufficient appropriate audit evidence obtained?

u Are the conclusions reached appropriate in the circumstances?

u Is the internal audit report consistent with the results of the workperformed?

u Have all the exceptions or unusual matters reported by internal auditbeen properly resolved?

u What is the impact of internal audit findings on the external audit plan?

u Is there a need to test the work of internal audit to confirm itsadequacy?

appraised of external audit findings, anumber of external auditors copyinternal audit with all external auditreports produced for the auditedbody. One interesting example wherethis was achieved is shown in Exhibit15. The findings of external auditwork are a relevant source ofinformation for internal audit whenthey update their Internal Audit NeedsAssessment.

External auditors are expected toinclude appropriate reference toreliance on internal audit, theassessment of internal audit and theresults from their systems work in themanagement letter. All references tointernal audit should be discussedwith internal audit first as a matter ofcourtesy. This reporting process willfeed back into the overall evaluationof internal audit by external audit.

Conclusion

Best practice co-operation starts eachyear at the risk assessment stage, isan integral part of planning, and doesnot end until the opinion is given andthe management letter issued. Bythen, the next annual cycle willprobably have already begun and thecycle continues.

25


Exhibit 14Review of internal audit

The external auditors of one audited body complete a standard record ofassessment of internal audit work on each significant system. Thisassessment asks the following questions:

u Has internal audit work covered appropriate controls?

u Are methods of selection and samples chosen for testing adequate?

u Have appropriate tests been applied to key controls?

u Has testing been performed satisfactorily?

u Have correct conclusions been drawn from the work and, if appropriate,reported and action secured?

u Has the work been adequately recorded?

Exhibit 15External audit reporting

The Chief Internal Auditor at anaudited body co-ordinatesresponses to the external auditorsReport to Officers, and takes theopportunity to add value to thereport (but without assuming anoperational responsibility) by, forinstance, identifying any errors andsuggesting updates for actionalready taken by management. Thisensures that the internal auditfunction at the council are awareof the results andrecommendations arising from thework of external audit, and ishelpful to external audit since itadds to the quality of theiroutputs.


26

In theory, maximising co-operationbetween internal and external audithas much to commend it but, inpractice, it is not being achieved aswidely as appears possible. Manyauditors shy away from it, eitherbecause they see problems wherenone may exist or because no one iscompelling them to try harder. Thischapter summarises problems

encountered in practice and suggestshow they may be overcome. Once theproblems likely to arise in anyparticular case have been identifiedand addressed, then managementand audit committees should decidewhether there is a scope for a greaterdegree of co-operation betweeninternal and external audit.

Set out below are some questionsthat come up in practice, togetherwith our suggested response tosolving the problem. The problemslisted do not include issues alreadyaddressed and resolved in earlierchapters of this guide.

5 Problem solving

What happens when... Suggested response

External audit

The external audit evaluation of internal audit shows apoor result?

Management, internal audit and external audit need todiscuss and agree an action plan for improvements to bemade in the internal audit service.

Management may wish to draw up or revise theirspecification for internal audit to take account of theevaluation recommendations.

External audit do not give feedback on their evaluationof internal audit?

Reporting the results of the evaluation in the managementletter is too late. Good practice means prompt andconstructive feedback to management and internal audit ateach stage.

External audit only consider internal audit plans whenthey undertake their own planning and then seekamendments to the internal audit plans over halfwaythrough the internal audit year?

External audit should be aware of the timing of the internalaudit planning cycle. Internal auditors can help here byensuring that external audit receive copies of internal auditdraft plans.

The implications of suggested amendments to internal auditplans during the year should be considered by the ChiefInternal Auditor. Any issues that cannot easily be resolvedbetween auditors, or any requiring significant additionalinternal audit resource should be discussed withmanagement.

The consortium will wish to adopt the method and style ofsystems testing most suitable for an effective provision ofinternal audit services to their clients.

The external auditors should consider getting together, inconsultation with the consortium, to see if a method thatsuits the majority can be agreed.

The external auditors of a number of audited bodies eachwish an internal audit consortium to adopt their ownpreferred method of systems testing anddocumentation?

27

5 Problem solving

External audit

External audit request internal audit to perform work thatinternal audit are not happy with?

Internal audit should discuss the reasons for their concernswith the external auditors. Management and auditcommittees may need to become involved if any potentialextra work for internal audit is going to prohibit them fromundertaking their agreed plan.

External audit do not wish to share Audit CommissionTechnical Releases and other publications with internalaudit?

Auditors have always had the option of making TechnicalReleases available, where they consider it relevant andhelpful.

The Audit Commission will begin to make its TechnicalReleases available to audited bodies from April 1996.

External audits review of internal audit work indicates thatinsufficient work has been carried out or that the workdone has not been sufficiently recorded?

External audit should discuss their findings with the ChiefInternal Auditor and agree which auditor should undertakefurther work to overcome the weaknesses in the internalaudit work. If the Chief Internal Auditor is unable to makeimprovements (for example, due to lack of resources), bothsets of auditors should consider jointly how best to presentthis problem to management or the audit committee.

External audit do not copy their reports to internal audit? Both sets of auditors should agree mechanisms by whichthey receive copies of each others reports promptly.

What happens when... Suggested response

External audit try to direct internal audit work toconcentrate only on the areas in which external audit wishto rely?

It is wrong for either party to be directive. The approach toco-operation should be consultative.

Any concerns that internal audit may have should bediscussed with external audit and where necessarymanagement and the Audit Committee (where one exists).


28

Internal audit

Internal audit is provided by a consortium or a firm andcompetition or issues of commercial confidentiality are putforward by either auditor as barriers to co-operation?

Auditors professional standards require them to establishconstructive working relationships and mutual understandingbetween internal and external audit on each engagement. Inthese circumstances, auditors will typically be concerned thata competitor could gain access to their material or couldderive information that might disadvantage them in future.Both auditors should be sensitive to these concerns butshould not treat them as an automatic barrier to achieving agreater degree of co-operation.

Internal auditors may like to note that external auditorsappointed by the Audit Commission have a right of accessunder s16 LGFAI 1982 to all documents relating to a body asappear necessary for the purpose of their audit. Externalauditors are restrained by s30 LGFA 1982 from divulginginformation obtained during the course of an audit.

Internal audit have completed their financial systemsfieldwork early in the year giving coverage for only part ofthe year?

The timing of internal and external audit work is a matter forconsultation between auditors. Internal audit may agree toundertake further or follow-up work later on in the year toincrease the coverage for the year.

Internal audit work indicates that there are significantsystems control weaknesses?

External audit will need to assess the findings of internalaudit and determine the most appropriate external auditapproach. This may mean that external audit will find it moreappropriate to adopt a substantive based approach in orderto obtain the required level of external audit assurance.

What happens when? Suggested response

Internal audit work on systems is spread across thefinancial year for each system, to give systems auditcoverage for the whole year. When should internal auditreport their findings?

Internal audit may wish their reporting to follow the patternof work during the year. If work is undertaken in more thanone tranche on a particular system, internal audit may find itnecessary to produce more than one report on the significantfindings from each tranche of work.

Internal audit complete their work but are not effective atproducing reports of their findings?

External audit will still be able to rely on the work performedby internal audit, provided they are content with the timing,scope and extent of the work. Any significant findings fromthe internal audit work should then be incorporated into therelevant external audit report. They may also need to bereported to line management. External audit may considerdiscussing with internal audit ways of making improvementsin the internal audit reporting process.

I

LGFA: Local Government Finance Act, which also applies to theexternal audit NHS bodies.

29

5 Problem solving

Audit committees (where they exist) and managementshould encourage co-operation between auditors and askhow co-operation has been built into each auditors planand programme of work.

Both sets of auditors are not committed to co-operation?

For co-operation to work, both auditors must becommitted to the process. Each should be aware of theplanning and audit cycle of the other.

Each auditor should ensure that their plans are copied tothe other in sufficient time for the other auditor to be ableto comment on the content of the plan.

Both sets of auditors do not discuss their plans with eachother?

Suggested responseWhat happens when...

Both sets of auditors

This is no excuse for external audit to do nothing. Theyshould co-operate with the old and new internal auditors.

Management may wish to consult the external auditor inthe selection process for new internal audit services, tobenefit from their wider view, although the decision toappoint must remain with management.

Management are proposing a change of internal auditservices?

For audit findings and recommendations to have maximumimpact they should be reported as soon as possible afterthe completion of fieldwork.

Where internal and external audit have adopted jointtesting plans for fraud and corruption work, it may beuseful to produce one report of audit findings andrecommendations for management, athough both partieswill first need to consider whether any such joint reportingmight give rise to any inappropriate liabilities or interfere inany way with each auditors accountability.

Management ask why they get two reports on theirfinancial systems if internal and external audit are co-operating effectively?

Management


30

Co-operation between internal andexternal audit is something that mostauditors could do better, given moresupport from top management or theAudit Committee and a little moreunderstanding of the obligationsplaced upon the other auditor.Improved co-operation can meanbetter progress with the Managed

Audit and a more productive auditservice. Sorting out any perceivedproblems or barriers to better co-operation will demonstrate that forfull success it takes two auditors,internal and external, workingtogether to eliminate duplication anddeliver a seamless service to theaudited body.

Finally...

If you are interested in discussinghow to improve the co-operationbetween internal and externalauditors at your local authority orNHS body, then may we suggestyou take it up with the auditors inthe first instance. They will befamiliar with the issue and willwelcome views from managementor members.

The Audit Commission alsowelcomes comments. If you wouldlike to raise any points on thematters discussed in this guideplease contact:

Director of Purchasing

The Audit Commission1 Vincent SquareLondon SW1P 2PN

Telephone: 0171 828 1212

31

Exhibit A1Spectrum of possible conditions at the audited body

The Managed Audit is the opinionaudit service that results fromapplying the principles of auditingand proper professional standards inconditions where the audited bodyhas:

u sound financial systems;

u effective controls;

u good internal audit; and

u reliable accounts productionprocesses.

The Managed Audit is a cost-effectiveway of delivering the opinion part ofthe external audit. The opinion auditis the work an external auditor mustdo, under the Code of Audit Practice,to give an independent assessment ofwhether the accounts present fairlythe financial position of the auditedbody (or are true and fair for NHStrusts).

Appendix ADefinition of the Managed Audit

Managed audit notpossible

Partial use of managed audit

Managed auditachievable

u poor controlenvironment

u poor monitoringcontrols exercised bymanagement

u reliance on internalaudit not possible

u production ofaccounts schedulesinaccurate or late

u some systems wellcontrolled

u some reliance can beplaced on internalaudit

u some aspects of finalaccounts productioncan be carried outmore efficiently bythe audited body

u strong controlenvironment

u reliance on internalaudit

u good co-operationfrom the auditedbody

(An audited body can move to the right or to the left on this spectrum from year to year.)

Further information on theManaged Audit can be found in theAudit Commission publication TheManaged Audit a good practiceguide, January 1995.


32

Appendix BUnderstanding each other: the different obligations placed on internal and externalauditors

I

The Auditing Practices Board (APB) wasestablished in 1991 by the Consultative

Committee of Accounting Bodies toadvance standards of auditing andprovide prescriptive, persuasive and

other guidance for the exercise of theauditors role.

In establishing co-operation, internalaudit and external audit will beconcerned to fulfil their ownobligations properly and to maximisetheir contribution to the auditedbody. The outcome will be better allround if both parties take steps tounderstand the others position.

Experience shows that internalauditors can have a limited perceptionof the needs and requirements placedupon external audit, and that externalaudit can have a relatively poorunderstanding of how internal auditis placed in the organisation and whatthey are there to do. But externalaudit are often in a strongernegotiating position, in that they cantake a unilateral decision to rely oncertain aspects of internal audit workand may not then form a widerunderstanding of the rest of internalaudits prerogatives.

Good co-operation between internalaudit and external audit restores thebalance, so that understanding eachother and the ability to makedemands are more evenly distributedbetween the parties.

Best practice in auditing

Best practice in auditing generallymeans:

u independence, an objectiveattitude and due professional care;

u an approach that is risk based,carefully planned, and carried outto plan with no undue overruns ordelays; and

u an auditing methodology thatconforms to the relevant auditingstandards (on audit workingpapers, for example, or qualitycontrol) and that provides theauditor with enough evidence onwhich to base the assurances theygive to management.

These requirements are exactly thesame in principle for both internalaudit and external audit but they maybe achieved in different ways or tovarying extents, depending on theobligations placed on the auditor.

The obligations placed on internalauditors

Internal audit is an independentappraisal function established bymanagement of an organisation fortheir review of the internal controlsystem as a service to theorganisation (APB Auditing Guideline308).I This general definition is broadand needs to be interpreted to suitthe circumstances of the auditedbody, so each internal audit unitshould have terms of reference or acharter to define what it is for andhow it operates. Such a documentshould have been agreed at thehighest level in the audited body. Itnormally covers at least the mattersshown in Exhibit B1.

Auditing Standard 550 issued by theInstitute of Internal Auditors statesthat, The Chief Internal Auditorshould ensure that internal andexternal audit efforts are properly co-

33

Appendix B

ordinated. The impetus for good co-operation should already be presentin the internal audit approach.

A duty of service to the auditedbody

Internal auditors are employees of theaudited body. The higher their statuswithin the audited body the bettertheir degree of independence, butultimately they are members of staffand owe a duty of service to theaudited body. This may mean, forinstance, that they will choose not tofulfil their planned annual programmeof controls work if they decide thatsome other audit work is moreimportant to the audited body. Atypical example will be the need toinvestigate a suspected fraud.

Consortia or other providers

Internal audit is not necessarily an in-house service. It can be providedunder contract by a specialistconsortium or by a firm of auditors.The firm in question may also act asone of the Audit Commissionsappointees (although never on thesame audited body, since this isprohibited by the Audit Commission).The obligations placed on one ofthese providers are the same inprinciple as on an in-house providerand may be more clear, since they willhave been set out in the specificationwhich originally led to the contract.

The internal audit planning cycle

Best practice in internal auditinggenerally means a planning cycle ofthree to five years, and a cyclicalexamination of systems based on anevaluation of the likely risk of loss orerror. This means that internal auditwill usually have planned for eachaudit year long before the relatedexternal audit planning cycle begins.

Exhibit B1Terms of reference for internal audit

For example: to assist the Chief Executive (or s151 Officer) and members tomeet their objectives and to discharge their responsibilities by providing anindependent appraisal of the adequacy and effectiveness of the controlsoperated by management and of the arrangements made by managementfor the conduct of business and the use of resources.

u The different responsibilities of internal audit and of management

u The professional requirements placed on internal audit

For example, ethical guidance and independence requirements,professional qualifications, standards to be adopted, auditmethodologies to be followed.

u The organisational status of internal audit in the audited body and theirreporting lines

u The authority of internal audit within the audited body

u The scope of internal audit work

u The output from internal audit work

u Any staffing or training commitments


34

Internal audit objectivity

Internal audit operates to greatestadvantage when it has staff thatknow the business thoroughly but areable to distance themselves from itsufficiently, to carry out an objectiveand well-informed appraisal. Theirwork should be at a levelcommensurate with managementsconcerns.

The obligations placed onexternal auditors

External auditors appointed by theAudit Commission are required to befully independent of the auditedbody. Audited bodies in localgovernment and the health servicemay not, by law, appoint their ownauditors, although they will always beconsulted by the Audit Commissionand their views taken into account.The Audit Commission is obliged, bylaw, to publish and maintain a Codeof Audit Practice that embodies theAudit Commissions view of best

Exhibit B2Audit objectives

The external auditors objectives are to give an independent assessment of:

1. whether the statements of accounts present fairly the financial positionof the audited body and its income and expenditure for the year inquestion (or, for NHS trusts, give a true and fair view) and have beenproperly prepared in accordance with appropriate legislation;

2. the adequacy of the audited bodys arrangements to secure economy,efficiency and effectiveness in the use of resources;

3. the general financial standing of the audited body;

4. the adequacy of the audited bodys financial systems;

5. the adequacy of the audited bodys arrangements for preventing anddetecting fraud and corruption;

6. the adequacy of the audited bodys arrangements for ensuring thelegality of transactions that might have a financial consequence; and

7. the adequacy of the audited bodys arrangements for collecting,recording and publishing information in cases where the audited body isrequired, pursuant to directions under section 1 of the LGFAI 1992, topublish performance information.

The Code of Audit Practice, paragraph 4

35

professional practice in the standards,procedures and techniques to beadopted by auditors in dischargingtheir functions. The Code sets out awide range of objectives that externalaudit are to achieve. The opinionaudit is only one of seven separateaudit objectives, as shown in ExhibitB2.

External auditors appointed bythe Audit Commission are alsorequired to confirm, by means ofdetailed checking, that certaingrant income is being claimed inaccordance with the prevailingrules.

Audit Commission audits alwaysconsist of two main elements: valuefor money auditing and regularityaudit work.

Value for Money (VFM) auditing

External auditors are obliged to takereasonable steps, includingexamination of the accounts, tosatisfy themselves that the auditedbody has made proper arrangementsfor securing economy, efficiency andeffectiveness in its use of resources.This is known as VFM auditing, asdefined in paragraph 37 of the Code.The Audit Commission issues nationalstudies and provides its auditors withguidance on how to carry out thestudy locally, subject to the auditorsjudgement on whether the studyapplies and, if so, to what extent. TheAudit Commission also issues broaderguidance, from time to time, on VFMwork on management arrangements.

External auditors may also carry outlocal VFM projects on issues ofcurrent importance to the use ofresources by the audited body. TheAudit Commission sets targets foraudit performance on VFM work andmeasures the auditors achievementof these performance indicators aspart of its annual programme ofquality control review.

Regularity audit work

Regularity is the collective name givento the rest of the audit work which isintended to achieve the rest of theaudit objectives. It is here that there ismost common ground with internalaudit. The largest element in it is theopinion audit work, but it alsoincludes the work on managementsarrangements for the prevention anddetection of fraud and corruption,audit review work on financialsystems, and audit review work onthe systems for producing certainperformance indicators.

A requirement to co-operate

The Code includes the followingcomments relating to other auditors:

In framing a methodology that willmeet the requirements of this Code,auditors should:

(f) establish effective co-ordinationarrangements between internaland external audit and seek toplace reliance on the work ofinternal audit wherever possible;

(g) co-operate with other externalauditors and the AuditCommission in order to ensurethat knowledge of good practiceis transferred effectively from oneaudited body to another.

[Extract from paragraph 27 of theCode.]

Exhibit B3, overleaf, summarisesthe main points to consider inachieving a good understanding ofthe other auditors point of view.

Appendix B

I

LGFA: Local Government Finance Act,which also applies to the external audit

NHS bodies.


36

The Statement of Auditing Standardson reliance on internal audit (SAS 500)is considered by the Audit Commissionto apply to its appointed auditors, butparagraph 27 of the Code means anexpectation of greater co-operationwith internal audit than envisaged bythe SAS. Reliance on internal auditwork is also one of the key features ofthe Managed Audit, which seeks topromote the most cost-effectiveopinion audit. But it is important toremember that the Code also statesthat the responsibility for the conductof the audit remains that of theappointed auditor (paragraph 12 ofthe Code). This means that external

audit may not sub contract any aspectof the audit to internal audit.

Timing for external audit

The Audit Commission expects to seeeach audit planned in advance, but anexternal audit plan normally does notneed to be drawn up until around themiddle of the accounting year, whichtypically means the period fromNovember to January. The AuditCommissions annual guidance onaudits is normally issued in October ofthe accounting year. External auditorsare then able to finalise their plansand to begin to discuss them with theaudited body.

u Both internal audit and external audit need a reasonable understandingof the requirements placed on the other party, of how their auditobjectives may differ, and why.

u The requirement placed on external audit to carry out an overallevaluation of internal audit from time to time can be dovetailed with anyrequirement placed upon internal audit for an independent or peerreview.

u Planning of the detailed audit work needs to be carried out much earlierthan would normally be the case for external audit, which should belooking two or more years ahead when discussing co-operation withinternal audit and should be familiar with internal audits planning cycle(which may be five years or more).

u Monitoring the work being done by internal audit needs to be sensitiveto external audits needs. Work on which external audit planned to relyin a certain period will normally need to be done in that planned period.If it can not, then external audit will probably have to make good thedeficiency and will benefit from an early warning.

Exhibit B3Understanding each other

37

The work must be done in theyear

Once the audit is planned, externalaudit generally has little or nodiscretion about whether to carry itout in its entirety. Work judgednecessary for the audit opinion in oneyear, for instance, can not be carriedforward to the following year. Itwould be very unusual for externalaudit to decide not to carry out someelement of the work planned for theyear, unless there were to be somemajor upheaval for the audited bodyin the remaining part of theaccounting period.

Regulation by the AuditCommission

The Audit Commission issuesguidance to auditors in the form ofTechnical Releases, annual guidanceon the audit and other publications.External auditors appointed by theCommission are obliged to follow theCode and the guidance issued by theAudit Commission, and are regulatedclosely by the Audit Commission tosee that they do. An internal auditorwishing to understand external auditwill need to have a grasp of thesedemanding requirements placed uponexternal auditors appointed by theAudit Commission.

Appendix B


38

Appendix CControl self assessmentTaken from a professionalbriefing issued by the Institute ofInternal Auditors

Control self assessment is a processwhich allows individual line managersand staff to participate in reviewingexisting controls for adequacy (bothnow and in the predicted future) andin recommending, agreeing andimplementing improvements toexisting controls.

It is likely to include the application ofrisk criteria to the process of controlassessment, and may extend toconfirming that key identified controlsand processes are operating efficientlyand effectively and are likely tocontinue to do so.

It may also include an assessment ofquality.

Potential strengths of control selfassessment include:

u Line management becomes moreinvolved in control and risk issuesand may be more ready to acceptresponsibility for maintaining andupdating controls.

u It may provide better coverage,year on year, than internal auditmay be able to deliver using moreconventional control assessmenttechniques.

u It may lead to more effectivecorrective action by management.

Potential pitfalls and limitationsinclude:

u Management and staff may not becandid in revealing anydeficiencies.

u Cross-functional or inter-departmental matters might bemissed.

u Evidence, for audit purposes, ofwhat was done and why may notbe recorded.

The Audit Commission for LocalAuthorities and the National HealthService in England and Wales.1 Vincent Square, London SW1P 2PNTelephone: 0171 828 1212Fax: 0171 976 6187

The Audit Commission, 1996.

Printed by Press On Printers, London

In this guide the Audit Commissionhas identified areas in which co-operation between internal andexternal audit may be furtherimproved. The main questions toconsider when assessing thearrangements for co-operation at anaudited body have been drawntogether in this checklist for action.

This checklist may be used bymanagement and audit committeesto stimulate discussion of co-operation arrangements. It can helpyou to identify which issues are ofpriority, what action is required andwho should take the lead inaddressing the priorities identified.

It Takes TwoA good practice guideMay 1996

A management checklist for action


1 Are the audit committee and management supportive ofeffective co-operation between the two sets of auditors?

2 Does internal audit take an active role in co-operating withexternal audit?

3 Have we defined the role of internal audit so as to provide aservice that meets our strategic requirements?

Questions

1 Is there two-way communication between internal andexternal audit on matters of mutual interest and concern?

2 Do external audit report the results of their evaluation ofinternal audit to us, and to internal audit, and makeconstructive suggestions for improvement?

3 Have all areas for potential co-operation between auditorsbeen explored imaginatively by both sets of auditors?

4 Have we considered, in conjunction with our auditors,whether joint reporting would be of value?

5 Have we looked objectively at how we use our internal auditresource and whether it could be better deployed? Forinstance, are ad hoc projects always examined to confirmthat they should take priority over internal audit workalready approved?

6 What current internal audit work would we be prepared todrop, modify or postpone in order to improve the potentialfor co-operation between internal and external audit?

Yes/no Priority Lead person

Concept and impact of good co-operation

Practicalities

A management checklist for action

Questions Yes/no Priority Lead person

1 Do our internal and external auditors meet on at least aquarterly basis to give feedback, discuss progress andresolve problems?

2 Is it time we had another in-depth evaluation of internalaudit?

3 Was the last evaluation constructive and helpful?

4 Have we agreed an action plan to implement the externalaudit

A Good Practice Guide to Co-operation Between External and Internal Auditors

Documents

Transcript of A Good Practice Guide to Co-operation Between External and Internal Auditors