Using the Work of Others Is Integral Part of Internal Control Reform

An important aspect of the reform of the Sarbanes-Oxley internal control over financial reporting is allowing the outside auditors to use the work of others. The ability of auditors to use the work of others has a direct effect on the procedures that they must perform themselves. Auditors duplicating high-quality, relevant work that already has been performed by competent and objective individuals risks increasing effort without enhancing quality.

Thus, the PCAOB’s new internal control audit standard, AS 5, allows the outside auditor to use the work of others to obtain evidence about the design and operating effectiveness of internal controls. The standard uses a principles-based approach to determining when and to what extent the auditor can use the work of others.

These reforms are designed to drive down the costs of performing the audit of internal controls without sacrificing the integrity of the financial statements or investor protection generally.

Recognizing that issuers might employ personnel other than internal auditors to perform activities relevant to management's assessment of internal controls, the standard allows the auditor to use the work of the company’s internal auditors, other company personnel, and third parties working under the direction of management or the audit committee.

Consistent with the standard’s risk-based approach, the extent to which auditors may use the work of others depends on the risk associated with the control being tested. As the risk decreases, so does the need for auditors to perform the work themselves. Conversely, in higher risk areas, such as controls addressing fraud risks, using the work of others would be limited if such work could be used at all.

Importantly, AS5 also eliminates the principal evidence provision formerly contained in AS2. The principal evidence provision required that the auditor’s own work be the principal evidence for the auditor’s opinion. This provision had limited the use of the work of others, particularly in lower-risk areas.

Similarly, AS 5 eliminates the specific restriction in AS No. 2 on using the work of others for testing controls in the control environment. Application of the general principles in AS5 allows the auditor to use the work of others for testing certain aspects of the control environment when the competence and objectivity of the persons performing the work are sufficiently high.