Internal Audit Standard No. 14 - Use of External Expert Services
Introduction
Internal audit functions play an integral part in an organisations’ governance structure. The purpose of Internal Auditing is to provide independent assurance to management and the board of directors that the organisation’s systems of control are functioning effectively and are adequate to meet the organisation’s goals and objectives.
As part of this assurance role, Internal Auditors may need to utilise external specialist services for support for particular engagements. This document outlines the standards for engaging external services.
Background
When undertaking an audit, the Internal Auditor cannot be expected to have an in-depth knowledge and understanding of every aspect of the organisation’s business and operations. In certain circumstances, an Internal Auditor may have to call upon the services of external specialist auditors with specific skills and expertise. Such situations might include where a member of the internal audit staff has limited technical knowledge of a specific subject matter, legal or taxation advice being sought from an external professional, or contracting an external computer auditor to review the organisation’s IT systems and controls.
Objectives
The objective of this standard is to ensure that external specialist services are used in a professional and accountable manner by the organisation’s Internal Audit function.
This standard will provide guidance on the processes and procedures for the selection, engagement and management of external specialist services in support of internal audit engagements.
Scope
This standard applies to all external services providers engaged to support internal audit engagements.
Definitions
External Services Provider: Refers to any external individual, firm or organisation specialising in specific areas such as legal advice, IT systems audit, tax advice, etc. contracted by the Internal Auditing function.
Engagement: Refers to the document agreed between the external services provider and Internal Auditing function outlining the nature of the services and the expected deliverables.
General Principles
When engaging external services, the Internal Auditing function should ensure they employ professional external services providers who possess:
• Appropriate qualifications and experience to provide the required services.
• An understanding of and appreciation for the Internal Audit function and its mandate.
• A professional code of conduct clearly outlining the expected and required behaviour when working with the Internal Audit function.
• A commitment to confidentiality and a comprehensive code of ethics.
Selection Process
The selection of external services providers should take into account the following principles and processes:
• Advertise or call for tenders from a variety of potential services providers outlining the services the Internal Audit function is seeking.
• Select services providers based on the evaluation of the tenders and their demonstration of the most appropriate and best value for money.
• Establish a “preferred services provider” agreement which will allow the Internal Auditing function to utilise the services of the preferred services provider more quickly and conveniently, as required, in the future.
Agreements
Engagement agreements should be established between the services provider and Internal Audit. The agreement should include:
• A detailed scope of services and the report format required by the Internal Audit function.
• An understanding of the independence and objectivity of the external services provider and the internal audit function.
• Detailed terms and conditions in relation to the provision and use of services.
• An agreed fee structure, payment terms and schedule of charges for any additional services.
• A method for resolving any disputes that may arise during the term of the engagement.
• An agreed timeframe for completion of the engagement and expectations for delivery of reports or other deliverables.
Monitoring
Once the external service provider has been engaged, the Internal Auditing function should monitor the progress of activities and review the services provided in the following ways:
• Periodic meetings or teleconferences with the external services provider, at intervals agreed upon in the engagement document.
• Reviewing and agree the services provider’s work plans and documents prior to their being finalised.
• Reviewing and agree the external service provider’s draft reports and other deliverables prior to their being finalised.
Conclusion
When engaging external specialist services, the Internal Auditing function must ensure they comply with the necessary procedures, attain appropriate value for money and maintain the requisite level of independence and objectivity at all times. Internal Control therefore recommends that this standard be adopted as a policy to ensure that external specialist services are used appropriately and in compliance with all applicable legal and regulatory requirements.
