Group Audits & Using Others' Work

Why this topic matters

Auditors often rely on other people: component auditors in a group audit, the client's internal audit function, and specialists. Auditing and Attestation (AUD) tests who takes responsibility for what, when the group auditor may "make reference" to another auditor in its report, and what must be evaluated before using others' work.

Group audits

Key terms

• Group financial statements: statements that include the financial information of more than one component (subsidiaries, divisions, equity-method investees, branches).
• Group engagement partner: responsible for the group audit, its direction, supervision, and performance, and for the auditor's report on the group statements.
• Component auditor: an auditor who performs work on a component's financial information for the group audit.

Group auditor responsibilities

• Understand the group, its components, and the consolidation process — including group-wide controls.
• Determine the work to be performed on components based on assessed risks (and, historically, the significance of each component).
• Set component materiality (lower than group materiality) to reduce aggregation risk.
• Understand each component auditor: whether they understand and comply with the ethical requirements, including independence; their professional competence; and the regulatory environment in which they work.
• Communicate clearly with component auditors about the work required, materiality, identified risks, and related parties; evaluate their communications and, where appropriate, their documentation.
• Perform audit procedures on the consolidation process itself.

If a component auditor is not independent, or the group auditor has serious concerns about their competence, the group auditor cannot use their work — it must obtain evidence about the component itself or through another auditor.

Assuming responsibility versus making reference

	Assume responsibility	Make reference
Effect	The group auditor takes responsibility for the component auditor's work — no mention in the report	The group auditor's report states that another auditor audited the component and indicates the magnitude of the portion audited (for example, a percentage of assets and revenues)
Group auditor's involvement	Greater involvement in the component auditor's work, depending on risk	Relies on the component auditor's report for that portion
Conditions	—	The component auditor audited the component's financial statements under relevant auditing standards and issued a report that is not restricted; the component's statements use the same framework (or a reconciliation is audited)
Not permitted when	—	The component auditor only performed limited or specified procedures, or its report is restricted; the component auditor is not independent

Making reference is not a modification of the opinion — it only divides responsibility. The component auditor's name is disclosed only with their permission and if their report is presented alongside. If the component auditor's report is modified, the group auditor considers the effect on the group opinion.

Using the work of internal auditors

The clarified auditing standards (AU-C) address internal audit in AU-C 610. The external auditor may use internal audit's work, or use internal auditors to provide direct assistance, after evaluating:

• Objectivity — organizational status (reporting to the audit committee) and policies that support objectivity.
• Competence — qualifications, training, and resources.
• Whether internal audit applies a systematic and disciplined approach, including quality control.

Limits:

• The external auditor makes all significant judgments and remains solely responsible for the opinion; reliance can reduce but never eliminate the external auditor's work.
• The more judgment involved and the higher the risk of material misstatement, the less the auditor may use internal audit's work.
• Direct-assistance internal auditors may not perform procedures involving significant judgment, higher assessed risks (beyond limited judgment), work they were involved in, or decisions the external auditor must make. They must be directed, supervised, and reviewed, and management must not interfere.
• The external auditor reperforms some of internal audit's work used.
• Use of internal audit is never mentioned in the auditor's report.

Using specialists

	Auditor's specialist	Management's specialist
Engaged by	The auditor (internal or external to the firm)	The entity
Auditor must	Evaluate competence, capabilities, and objectivity; agree in writing (where appropriate) on the nature, scope, objectives, roles, and communication; evaluate the adequacy of the work — relevance of findings, assumptions, methods, and source data	Evaluate competence, capabilities, and objectivity; understand the work; evaluate the appropriateness of the work as audit evidence
Report reference	Not referred to in an unmodified report. May be referred to in a modified report if it helps explain the modification (and the report states that this does not reduce the auditor's responsibility).	Not referred to

The auditor must understand the specialist's field enough to evaluate the work. Examples: actuaries (pensions), appraisers (real estate), engineers (reserves), valuation specialists, attorneys (legal interpretations), and information technology specialists.

Service organizations (AU-C 402)

User auditors obtain an understanding of services provided by service organizations and may use System and Organization Controls (SOC) 1 reports. A Type 2 report (operating effectiveness over a period) is needed to reduce assessed control risk. The user auditor does not refer to the service auditor's report in its own opinion.

How it is tested

• Decide whether making reference is appropriate.
• Identify what the group auditor must evaluate about component auditors.
• Apply the limits on using internal audit.
• Distinguish auditor's and management's specialists and when they can be mentioned.