Using The Work Of Others — Evaluate Use Of Specialists And Internal Audit - CPA Aud

SECTION 1

Historical Context & Motivation

The modern audit engagement is far too complex for a single generalist to handle alone. Financial statements routinely contain assertions about fair values of derivatives, actuarial liabilities, environmental remediation costs, and information-technology controls—areas where the external auditor's own expertise may be insufficient. Recognizing this reality, the auditing profession has long permitted, and in many cases encouraged, auditors to draw upon the work of auditor's specialists, management's specialists, and the entity's own internal audit function. The challenge lies not in whether to use such work, but in how to evaluate it, maintain professional skepticism, and preserve the external auditor's ultimate responsibility for the audit opinion.

1972 • SAS No. 1 — Codification Begins

The AICPA's first Statements on Auditing Standards codified basic expectations for using work performed by others, including guidance on the relationship between principal and other auditors.

1994 • SAS No. 73 — Specialists

SAS No. 73 provided the first dedicated standard on using the work of a specialist, establishing requirements to evaluate the specialist's qualifications, understanding of scope, and the relationship between the specialist and the entity.

2002 • Sarbanes-Oxley Act (SOX)

SOX and the creation of the PCAOB elevated the importance of internal audit evaluations, especially in integrated audits requiring assessments of internal control over financial reporting.

2011 • Clarity Standards — AU-C 500, 610, 620

The AICPA's Clarity Project reorganized and modernized the auditing standards. AU-C 620 governs auditor's specialists, AU-C 610 addresses internal audit, and AU-C 500 covers management's specialists as part of audit evidence.

2020–Present • PCAOB AS 1210 & AS 2605 Updates

The PCAOB continues to refine expectations for issuers, with AS 1210 addressing specialists and AS 2605 (now largely superseded by integrated guidance in AS 2201) addressing internal audit in integrated audits.

The central question these standards address is straightforward yet nuanced: How does the external auditor use and evaluate the work of others without improperly delegating professional responsibility? The answer requires a disciplined framework of competence assessment, objectivity evaluation, testing of underlying data, and careful consideration of scope—topics we will explore throughout this lesson.

SECTION 2

Core Principles & Definitions

Before examining the detailed procedures, it is essential to establish the foundational definitions and principles that govern how the external auditor interacts with specialists and internal audit. The standards draw sharp distinctions between parties based on who engaged them and what role they play relative to the financial statements and the audit.

Auditor's Specialist

An individual or organization possessing expertise in a field other than accounting or auditing, whose work is used by the auditor to assist in obtaining sufficient appropriate audit evidence. Governed by AU-C 620 (nonissuers) and AS 1210 (issuers). The auditor bears responsibility for the conclusion reached.

Management's Specialist

An individual or organization possessing expertise used by management to assist in preparing the financial statements—e.g., an actuary computing pension liabilities. Addressed in AU-C 500 as part of evaluating audit evidence. The auditor treats the specialist's output as an assertion to be tested.

Internal Audit Function

An appraisal activity established within the entity to examine and evaluate internal controls, risk management, and governance. The external auditor may use the work of internal auditors under AU-C 610 (nonissuers) or AS 2605/AS 2201 (issuers), but must evaluate their competence and objectivity.

Sole Responsibility Principle

Regardless of any work performed by specialists or internal audit, the external auditor retains sole responsibility for the audit opinion. The auditor's report must not reference a specialist in an unmodified opinion, as doing so might be misread as a division of responsibility.

Competence & Objectivity Evaluation

For every category—auditor's specialist, management's specialist, and internal audit—the external auditor must assess both technical competence (education, certifications, experience) and objectivity (independence from conflicting interests or undue influence by management).

✦

KEY TAKEAWAY

Think of the external auditor as a general contractor building a house. The contractor may hire an electrician (specialist) and rely on the building's existing maintenance crew (internal audit) to verify certain systems, but the contractor is the one who signs off on the entire structure's safety. The contractor must verify the electrician's license, check the maintenance crew's track record, and personally inspect critical connections. If something fails, the contractor—not the subcontractors—bears ultimate liability to the homeowner.

SECTION 3

Visual Framework — The Auditor's Decision Tree

The following diagram illustrates the external auditor's decision process when determining whether and how to use the work of others. The flowchart highlights the key evaluation gates—competence, objectivity, adequacy of work, and the nature of the area being audited—that the auditor must pass through before placing reliance on another party's work.

The decision tree shows how the external auditor navigates the choice between specialists and internal audit, then applies specific evaluation gates (competence, objectivity, adequacy) before relying on the work. All paths converge on the principle that the external auditor retains sole responsibility for the audit opinion.

As depicted in the diagram, the auditor's first decision is whether the area of expertise calls for a specialist (such as a valuation expert or actuary) or whether internal audit has already performed relevant work. For specialists, the auditor must further distinguish between one engaged by the auditor (governed by AU-C 620) and one engaged by management (evaluated under AU-C 500). For internal audit, the critical consideration is whether the area involves significant judgments—if it does, the external auditor must re-perform the work rather than simply rely on internal audit's conclusions.

SECTION 4

Detailed Evaluation Mechanisms

Evaluating an Auditor's Specialist (AU-C 620 / AS 1210)

When an external auditor engages a specialist—for example, a valuation analyst to appraise a portfolio of complex financial instruments—the auditor must perform a structured evaluation before placing any reliance on the specialist's findings. The evaluation proceeds along three dimensions: competence, objectivity, and adequacy of work performed. Competence is assessed through credentials (e.g., ASA designation for appraisers, FSA for actuaries), relevant experience, professional reputation, and standing in peer organizations. Objectivity analysis examines whether the specialist has financial interests in the client, family or business relationships with client management, or other conflicts that might bias their conclusions. Even if the specialist is engaged by the audit firm itself, objectivity threats can arise if the specialist simultaneously provides advisory services to the audit client.

The auditor must reach an understanding with the specialist regarding the nature, scope, and objectives of the work; the respective roles and responsibilities; the methods and assumptions to be used; and the form of the specialist's report. This understanding is typically documented in an engagement letter or memorandum. The auditor then evaluates the specialist's findings by assessing the relevance and reasonableness of the assumptions, the completeness of the source data, and the internal consistency of the specialist's report. Importantly, the auditor need not possess the same technical expertise as the specialist, but must have sufficient understanding to evaluate whether the work provides appropriate audit evidence.

Evaluating Management's Specialist (AU-C 500)

When management uses a specialist to prepare financial statement amounts—consider a pension actuary computing the projected benefit obligation—the auditor treats the specialist's output as part of management's assertions. The evaluation framework under AU-C 500 mirrors the specialist evaluation above but adds an important layer: the auditor must test the underlying data that management provided to the specialist and evaluate the reasonableness of significant assumptions. For instance, if the actuary used employee census data, the auditor should vouch a sample of that data back to HR records. If the actuary assumed a 7% discount rate, the auditor should evaluate whether that rate is consistent with current market conditions and industry norms.

Evaluating the Internal Audit Function (AU-C 610 / AS 2605)

The external auditor may use the internal audit function in two distinct ways: (1) using internal audit's work as audit evidence and (2) using internal auditors to provide direct assistance under the external auditor's supervision. In either case, the external auditor must evaluate the internal audit function's organizational status (reporting line to the audit committee rather than to operating management), competence (professional certifications such as CIA, adequate staffing, continuing education), and whether their work is performed with due professional care (adequate planning, supervision, documentation, and review). A critical constraint is that the external auditor cannot use internal audit work—or direct assistance—in areas requiring significant auditor judgment, such as assessing accounting estimates or evaluating the adequacy of disclosures. For PCAOB engagements (issuers), the standard is even more restrictive: internal auditors cannot serve as direct assistants.

SECTION 5

Classification of Work-of-Others Relationships

Understanding the distinctions among the various parties whose work the external auditor may consider is critical for exam success. The following table provides a side-by-side classification, and the diagram below maps these relationships visually to show how information flows between the parties and the external auditor.

Attribute	Auditor's Specialist	Management's Specialist	Internal Audit
Engaged by	The external auditor	Management / TCWG	The entity (employee or outsourced)
Governing Standard (Nonissuers)	AU-C 620	AU-C 500	AU-C 610
Governing Standard (Issuers)	AS 1210	AS 1210 (as evidence)	AS 2605 / AS 2201
Examples	IT security tester, forensic accountant	Actuary, appraiser, environmental engineer	Internal audit staff testing controls, reviewing compliance
Auditor's Key Evaluation Focus	Competence, objectivity, agreement on scope	Competence, objectivity, data accuracy, assumption reasonableness	Organizational status, competence, due care, scope of work
Reference in Audit Report?	No (unmodified); may reference in modified opinion	No	No
Direct Assistance Permitted?	N/A (not applicable)	N/A	Yes for nonissuers (AU-C 610); No for issuers (PCAOB)

Comparative classification of the three categories of 'others' whose work the external auditor may use.

This relationship diagram shows the three categories of parties whose work the external auditor may use, along with the engagement and reporting lines. Note that management engages its own specialist (pink box), while the auditor engages its own specialist (purple box). Internal audit (cyan box) reports to management but ideally has a dotted-line relationship to those charged with governance.

SECTION 6

Worked Example — Evaluating Use of a Specialist and Internal Audit

Consider the following scenario: you are the senior auditor on the engagement for Apex Manufacturing, Inc. Apex has a defined-benefit pension plan. Management engaged an actuary (Smith & Associates) to compute the projected benefit obligation (PBO). Additionally, Apex's internal audit department performed testing of the payroll controls that feed employee census data to the actuary. You need to determine how to evaluate and use both sources of work.

Evaluating the Actuary and Internal Audit at Apex Manufacturing

1
Step 1 — Classify the Parties

Smith & Associates is a management's specialist because management—not the audit firm—engaged the actuary. Therefore, AU-C 500 governs the auditor's evaluation. The internal audit function is evaluated under AU-C 610.

Actuary → Management's Specialist (AU-C 500); Internal Audit → AU-C 610
2
Step 2 — Evaluate Competence of the Actuary

Determine whether Smith & Associates holds the Fellow of the Society of Actuaries (FSA) designation, review their experience with pension plan valuations of comparable size and complexity, and inquire about their reputation in the industry. Confirm that they are members of the American Academy of Actuaries and subject to actuarial standards of practice.

Competence satisfied: FSA designation, 15+ years experience, member of AAA
3
Step 3 — Evaluate Objectivity of the Actuary

Inquire whether Smith & Associates has any financial interest in Apex, any family relationships with Apex management, or any contingent fee arrangement tied to the PBO calculation outcome. Determine whether Smith also provides consulting services to Apex that might create a self-review threat. In this case, Smith performs only actuarial valuations and has no other relationship with Apex.

No objectivity threats identified
4
Step 4 — Test the Underlying Data and Assumptions

Select a sample of 30 employees from the census data that management provided to Smith. Agree each employee's hire date, birth date, salary, and years of service to Apex's HR records and payroll system. Evaluate the actuary's key assumptions: the 6.5% discount rate should be compared to yields on high-quality corporate bonds of similar duration; the salary escalation rate of 3.0% should be compared to Apex's historical salary increases and industry norms; and the mortality table (e.g., RP-2014 with MP-2021 improvement scales) should be assessed for current applicability.

Census data agrees to HR records; discount rate and mortality assumptions are reasonable
5
Step 5 — Evaluate Internal Audit's Work on Payroll Controls

Assess internal audit's organizational status: they report functionally to the audit committee. Evaluate competence: two of three internal auditors hold the CIA designation. Review their documentation of payroll control testing—sample sizes, selection methodology, and conclusions. Because payroll controls testing does not involve significant auditor judgment (it is largely a factual, procedural evaluation), the external auditor may rely on internal audit's work after re-performing a sample of tests to validate their conclusions.

Internal audit work reliable; re-performed 10 of 40 tests with consistent results
6
Step 6 — Document and Conclude

Document all evaluations in the audit workpapers. Conclude that the actuary's PBO calculation provides sufficient appropriate audit evidence for the pension liability assertion, subject to the auditor's own evaluation of the financial statement presentation and disclosure. The internal audit function's payroll controls testing reduces the extent of the external auditor's own controls testing in that area. The audit report will not reference either the actuary or internal audit.

Sufficient appropriate evidence obtained; no reference to specialist or IA in unmodified opinion

SECTION 7

Strengths, Limitations, and Common Pitfalls

Using the work of others provides significant benefits in terms of audit efficiency and evidence quality, but also introduces risks that the external auditor must manage carefully. The following table summarizes the key strengths and limitations, followed by common exam pitfalls that CPA candidates should be aware of.

Strengths	Limitations
Access to specialized expertise that the auditor does not possess (actuarial science, IT security, environmental engineering, gemology)	The auditor may lack sufficient understanding of the specialist's field to fully evaluate assumptions and methods
Increased audit efficiency by leveraging internal audit's existing controls testing rather than duplicating it entirely	Internal audit may lack objectivity if they report to operating management rather than the audit committee
Improved evidence quality when specialists bring deeper domain knowledge to complex valuations or technical assessments	Management's specialist may have objectivity threats due to economic dependence on the client or contingent fee arrangements
Can reduce overall engagement cost and time while maintaining audit quality	Over-reliance on others without adequate re-performance or testing may constitute a deficiency in the audit
Internal audit's entity-specific knowledge can help the external auditor understand risks more quickly	The external auditor cannot delegate significant judgments to internal audit; areas such as revenue recognition estimates remain the external auditor's direct responsibility

Strengths and limitations of using the work of others in an audit engagement

⚠

Common Exam Pitfalls

CPA candidates frequently confuse the auditor's specialist with management's specialist. Remember: the critical distinction is who engaged the specialist. Another common error is believing that using a specialist allows the auditor to reference the specialist in an unmodified opinion—it does not. Finally, candidates often forget that under PCAOB standards, internal auditors may not provide direct assistance to the external auditor on issuer engagements.

✦

KEY TAKEAWAY

Think of this like peer review in academic research. A professor (external auditor) may rely on a laboratory technician's spectrometry analysis (specialist) and a teaching assistant's data collection (internal audit), but the professor's name goes on the published paper and the professor alone bears responsibility for the conclusions. The professor must verify the technician's calibration and the TA's methodology before citing their results. If the professor merely rubber-stamps the lab results without independent evaluation, the peer-review process—and the professor's reputation—is compromised.

SECTION 8

Connection to Advanced Audit Topics

The principles governing the use of specialists and internal audit connect directly to broader audit theory and advanced engagement scenarios. Understanding these connections is important both for the CPA exam and for practice. The evaluation of specialists plays a critical role in auditing accounting estimates (AU-C 540), which are among the most judgment-intensive areas of any audit. When fair value measurements involve Level 3 inputs under ASC 820, the auditor almost invariably needs specialist assistance to evaluate management's models and assumptions.

Core Concept (This Lesson)	Advanced Application
Evaluating management's specialist under AU-C 500	Auditing complex fair value estimates (AU-C 540 / AS 2501) where Level 3 inputs require valuation expertise—the auditor may engage their own specialist to develop an independent estimate or challenge management's model
Evaluating internal audit under AU-C 610	Integrated audits of internal control over financial reporting (AS 2201) where internal audit's controls testing feeds directly into the external auditor's ICFR evaluation and affects the nature, timing, and extent of substantive procedures
Sole responsibility principle	Group audits (AU-C 600) where the group engagement partner must evaluate component auditors—similar evaluation of competence and objectivity, but with distinct reporting requirements and possible reference in the report
Competence and objectivity evaluation	Service organization reports (SOC 1 / AU-C 402) where the auditor evaluates the service auditor's competence and independence when relying on a Type 2 report for controls at a service organization

Connections between using the work of others and advanced audit topics

As you advance through the AUD section, you will encounter these concepts repeatedly. The ability to recognize when a scenario involves a specialist versus internal audit, to recall the correct governing standard, and to apply the appropriate evaluation framework will be tested in both multiple-choice and task-based simulation formats. Pay particular attention to the interplay between specialist reliance and the audit risk model—using a well-qualified specialist effectively reduces detection risk for the assertions the specialist's work addresses, whereas an inadequate evaluation of a specialist may increase audit risk by introducing unreliable evidence into the auditor's conclusion.

SECTION 9

Practice Problems

Question 1: CONCEPTUAL

When the external auditor issues an unmodified opinion on the financial statements and has relied on the work of an auditor's specialist, should the auditor's report make reference to the specialist? Explain the reasoning behind the standard's requirement.

Show answer

No, the audit report should not reference the auditor's specialist in an unmodified opinion. Under AU-C 620, referencing a specialist could be misinterpreted by users as a qualification of the opinion or as a division of responsibility. The external auditor bears sole responsibility for the audit opinion regardless of who contributed evidence. The only exception is in a modified opinion, where the auditor may reference the specialist if doing so is relevant to explaining the basis for modification. This principle reinforces that the auditor's professional judgment governs the final conclusion.

Question 2: BASIC CALCULATION

An actuary engaged by management used a 7.2% discount rate to calculate the PBO. The external auditor determines that yields on AA-rated corporate bonds of matching duration range from 5.8% to 6.4%. What should the auditor conclude about the reasonableness of the discount rate assumption, and what is the likely impact on the PBO if the rate is overstated?

Show answer

The auditor should conclude that the 7.2% discount rate falls outside the range of reasonableness established by current market conditions (5.8%–6.4% for AA-rated corporate bonds). A higher discount rate produces a lower present value of future benefit payments, meaning the PBO—and consequently the pension liability on the balance sheet—would be understated. The auditor should discuss this finding with management and the actuary, and if management refuses to adjust, the auditor should consider the implications for the audit opinion. This evaluation of assumptions is a core requirement under AU-C 500 when using the work of management's specialist.

Question 3: INTERMEDIATE

During the audit of a nonissuer, the external auditor wants to use the internal audit function to provide direct assistance in performing inventory count observations. Internal audit reports to the CFO rather than to the audit committee. The internal audit staff hold CIA certifications and have five years of experience. What factors should the external auditor consider, and can the auditor proceed with using internal auditors for direct assistance?

Show answer

Under AU-C 610 for nonissuers, the external auditor may use internal auditors to provide direct assistance, but must evaluate their competence and objectivity. In this case, competence appears adequate (CIA certifications and relevant experience). However, the objectivity assessment raises concerns because internal audit reports to the CFO—an operational manager—rather than to the audit committee. This reporting structure means internal audit lacks the organizational independence needed for strong objectivity. The external auditor could still proceed but must apply heightened professional skepticism, increase supervision, and re-perform a larger portion of the work to compensate for the reduced objectivity. The auditor should also document the objectivity limitation and explain in the workpapers how additional procedures mitigate the risk.

Question 4: APPLIED

You are auditing a chemical manufacturer that has a $45 million environmental remediation liability. Management engaged an environmental engineer (GreenTech Consulting) to estimate the cleanup costs. GreenTech also provides ongoing environmental compliance consulting to the manufacturer for an annual fee of $2 million. Describe the evaluation steps you would perform and identify specific concerns.

Show answer

First, classify GreenTech as management's specialist under AU-C 500. For competence, verify GreenTech's professional credentials, relevant experience with remediation cost estimation, and standing in the environmental engineering community. The critical concern is objectivity: GreenTech receives $2 million annually from the manufacturer for compliance consulting, creating a significant economic dependence that could impair objectivity. GreenTech might be incentivized to produce a favorable (lower) remediation estimate to maintain the consulting relationship. The auditor should evaluate the significance of this economic relationship relative to GreenTech's total revenue. If the threat is significant, the auditor should consider engaging an independent auditor's specialist (under AU-C 620) to develop a separate estimate or to challenge GreenTech's assumptions. Additionally, the auditor should test the underlying site assessment data, evaluate the reasonableness of cost assumptions against industry databases (e.g., EPA remediation cost models), and compare the estimate to any regulatory agency assessments.

Question 5: CRITICAL THINKING

A PCAOB-registered firm is performing an integrated audit of a public company. The company's internal audit department is well-staffed, competent (all CIAs), and reports directly to the audit committee. The external auditor would like internal auditors to (a) test operating effectiveness of revenue recognition controls and (b) serve as team members performing walkthroughs under the external auditor's direct supervision. Analyze whether each use is permissible under PCAOB standards and explain the conceptual justification for any restrictions.

Show answer

Under PCAOB standards (AS 2201 and the Board's interpretive guidance), the external auditor may use the work product of internal audit—for example, their controls testing results—as audit evidence, provided the auditor evaluates competence, objectivity, and re-performs sufficient testing to validate the work. Therefore, use (a) is permissible in principle: the auditor can consider internal audit's tests of revenue recognition controls as evidence, though given the significance of revenue recognition, the auditor should re-perform a substantial portion. Use (b), however, is not permissible under PCAOB standards. The PCAOB explicitly prohibits internal auditors from serving as direct assistants on issuer engagements, even under the external auditor's supervision. The conceptual justification is that internal auditors are employees of the entity being audited and thus lack the independence required of an engagement team member under SEC independence rules and PCAOB standards. Even robust organizational status (reporting to the audit committee) does not overcome the fundamental conflict that the internal auditors are employed and compensated by the audit client. This restriction does not apply to nonissuer engagements under AICPA standards, where AU-C 610 explicitly permits direct assistance with appropriate safeguards.

SUMMARY

Lesson Summary

Summary

External auditors frequently need to leverage the expertise and work of others to gather sufficient appropriate audit evidence. Three categories of parties are relevant: the auditor's specialist (engaged by the auditor, governed by AU-C 620), the management's specialist (engaged by the client, evaluated under AU-C 500), and the internal audit function (addressed in AU-C 610 for nonissuers and AS 2605/AS 2201 for issuers). For every category, the auditor must evaluate competence and objectivity, assess the adequacy of work performed, and test underlying data and assumptions where applicable.

The overarching principle is that the external auditor retains sole responsibility for the audit opinion and must not reference specialists or internal audit in an unmodified opinion. For internal audit, the external auditor cannot delegate areas involving significant auditor judgment, and under PCAOB standards, internal auditors may not provide direct assistance on issuer engagements. Mastering these distinctions is essential for success on the AUD section of the CPA exam and for effective audit practice.