When can internal audit rely on risk management's work?

author: AcadiFi Team

Answer:

Internal audit can consider relying on risk management's work when the work is relevant to the audit objective and the CAE or engagement team has a documented basis for reliance. That basis should consider scope, competence, objectivity, methodology, evidence quality, and whether the work was performed recently enough.

For example, a mature risk management function's vendor risk assessment may help audit planning. But if internal audit is issuing assurance over vendor risk controls, it may still need to test selected controls directly.

Reliance can reduce duplication, but it does not remove internal audit's responsibility for its conclusion.