SA 610 governs when and how a statutory auditor can use the work of an entity's internal audit function, either as audit evidence or to provide direct assistance with the external audit. The standard requires two separate evaluations, in a specific order: first, whether the internal audit function's organisational status, objectivity, competence and systematic approach make it appropriate to use their work at all; only once that's answered can the statutory auditor move to evaluating the specific internal audit work being considered for reliance. A function with excellent technical competence but no real organisational independence from the area it audits fails the first question regardless of how good its actual work looks.
Step one — can this function's work be used at all
| Factor | What it's actually assessing |
|---|---|
| Organisational status | Does internal audit report to a level — the audit committee or board — with enough authority to ensure broad audit coverage and act on its findings, rather than reporting to the function it audits? |
| Objectivity | Are there policies preventing internal auditors from auditing areas they were recently responsible for, or have a personal/financial interest in? |
| Competence | Technical training, proficiency in auditing, and relevant knowledge of the entity's financial reporting framework. |
| Systematic and disciplined approach | Does the function follow a documented methodology — audit programs, documentation standards, quality control — rather than ad hoc activity? |
Where the first evaluation concludes the internal audit function's objectivity is not sufficient, or its organisational status undermines independence, SA 610 does not allow proceeding to rely on specific pieces of their work regardless of how technically competent that work appears — the first evaluation is a genuine gate, not a formality on the way to the second.
Step two — evaluating the specific work
- 01Was the work planned, performed, supervised, reviewed and documented adequatelyThe same quality bar the statutory auditor would expect of their own team's work.
- 02Was sufficient appropriate evidence obtained to support the conclusions reachedReviewed directly, not assumed from a summary report.
- 03Are the conclusions reached appropriate given the circumstances, and are reports consistent with the actual results of the workA disconnect here is itself a reason to limit reliance, independent of the first-step evaluation.
Direct assistance — a separate, more restricted provision
Beyond relying on internal audit's own completed work, SA 610 separately addresses internal auditors providing direct assistance — performing audit procedures under the statutory auditor's direction, supervision and review, as an extension of the external audit team. This carries additional restrictions: direct assistance is not permitted where it would be prohibited by law or regulation, where significant judgments are involved, or in areas involving higher assessed risk — and the statutory auditor must separately evaluate threats to the internal auditor's objectivity for this specific role before using it.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Internal audit & IFCInternal audit vs statutory audit: what actually differsWhere internal audit and statutory audit genuinely differ — objective, reporting line, independence, and timing — and where coordinating the two saves real work on both sides.
- Internal audit & IFCInternal audit checklist for CA firms taking on the mandateHow to scope a new internal audit mandate: the risk-based plan, coverage across the year rather than one visit, typical areas covered, and the reporting rhythm an audit committee expects.
- Internal audit & IFCIFC testing: internal financial controls over financial reportingHow IFC testing differs from a substantive statutory audit, what design versus operating effectiveness testing actually means in practice, and what the file needs to show for each.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.