Reliance on internal audit and auditing accounting estimates: ISA 610 and ISA 540

This topic deals with two judgement areas where the auditor leans on something else. In the first, the auditor leans on the work of the client’s internal auditors, to save effort. In the second, the auditor audits figures that management has estimated, because no exact measure exists. Both carry risk.

The external auditor alone answers for the opinion, and an estimate is only as good as the judgement behind it.

Examiners ask what makes internal audit work reliable, how to audit an estimate and how to spot management bias. In the November 2025 diet, the risks in auditing fair value measurements were worth 6 marks and the indicators of management bias 2 marks. Both are short lists you can learn.

Reliance on internal audit

The work of external and internal auditors often overlaps, especially where internal audit does financial audits. In principle, the external auditor can reduce testing by relying on work internal audit has already done. Where it is right to do so, this makes the audit more efficient and cheaper.

But the external auditor is responsible for the opinion even when relying on others, such as internal auditors and experts. The responsibility for relying on internal audit work rests entirely with the external auditor. The auditor must decide whether to rely, and in what respects.

ISA 610: using the work of internal auditors

ISA 610 guides the external auditor who has decided that the internal audit function is likely to be relevant to the audit. The objectives are to decide:

1. whether and to what extent to use specific work of the internal auditors; and
2. if so, whether that work is adequate for the external audit.

Evaluating the internal audit function

The auditor evaluates the function and its procedures. The factors are:

1. Status and objectivity. The auditor will rely more where internal audit has operational independence, for example in deciding what work to do and in reporting to an independent senior person or body such as the audit committee, rather than to the finance director. The auditor also looks at the scope of the work and any limits placed by senior management, and at whether management acts on recommendations. If management ignores internal audit reports, the external auditor cannot have much confidence that internal audit helps keep internal control effective.
2. Technical competence and due professional care. The staff must have enough technical competence and a professional approach to their work.
3. Communication. There must be effective communication between the external and internal auditors, with meetings at suitable intervals and each telling the other of significant matters that might affect the other’s work.

Planning the effect of specific work

To decide the planned effect of internal audit work on the nature, timing and extent of the external procedures, the auditor considers:

• the nature and scope of the specific work done or to be done;
• the assessed risks of material misstatement at account balance or transaction level; and
• the degree of subjectivity involved in evaluating the evidence internal audit gathered.

Evaluating and testing the work before use

Because the external auditor has full responsibility, the auditor tests internal audit work. Before using specific work, the auditor evaluates whether:

1. it was done by internal auditors with adequate technical training and proficiency;
2. it was properly supervised, reviewed and documented;
3. adequate evidence was obtained;
4. appropriate conclusions were reached, consistent with the reports prepared; and
5. any exceptions or unusual matters were properly resolved.

Procedures to do this include examining items internal audit has already examined, examining other similar items, and observing procedures internal audit performs. The evaluation of the function and its work is fully documented.

Background: ISA 610 (Revised) also says the auditor does not use internal audit work where the function’s status, objectivity or competence is not enough, or where it does not apply a systematic and disciplined approach including quality control. The later topics on internal audit and outsourcing cover the internal audit function itself.

Accounting estimates: the audit problem

Estimated figures are used in financial statements where a more precise measurement is impractical or impossible. ISA 540 describes an accounting estimate as an approximation of a monetary amount in the absence of a precise means of measurement. Accruals, prepayments and depreciation are examples, as are deferred tax and provisions for unsettled legal disputes.

Management makes estimates using its judgement. So the audit problem is how the auditor decides that management’s estimates are reasonable. Audit risk can be high.

Examples in ISA 540

• allowance for doubtful accounts;
• inventory obsolescence;
• warranty obligations;
• depreciation method or asset useful life;
• costs arising from litigation settlements and judgments;
• provision against the carrying amount of an investment where recovery is uncertain; and
• the outcome of long-term contracts.

Fair value accounting estimates may also be needed for complex financial instruments not traded in an active market, share-based payments, property or equipment held for disposal, assets and liabilities acquired in a business combination (including goodwill and intangibles) and exchanges of assets or liabilities.

ISA 540: auditing accounting estimates

ISA 540 covers all accounting estimates, including fair values. The auditor must get sufficient appropriate evidence whether estimates, recognised or disclosed, are reasonable, and whether the related disclosures are adequate. The ISA was revised after scandals about aggressive earnings management and asks for greater rigour and scepticism. It is risk-based and focuses on estimates with high estimation uncertainty.

Evidence on estimates is often of relatively poor quality because of the nature of the items. The auditor therefore needs more of this weaker evidence, particularly where the item may be material or audit risk is high.

Understanding the estimates

As part of risk assessment, the auditor understands:

• the requirements of the reporting framework on estimates and disclosures;
• how management identifies transactions or events that could lead to an estimate;
• the nature of the estimates, such as the terms of a warranty for a warranty provision; and
• management’s procedures for making them: the method (such as how useful lives are decided), relevant controls, use of experts, underlying assumptions, whether the method should have changed since the prior period, and whether and how management has assessed the effect of estimation uncertainty.

Where possible, the auditor checks the amount of an estimate against other known facts. The auditor also reviews the outcome of estimates in the previous year’s statements, to test their reliability, and considers the change from one year end to the next. The auditor evaluates the degree of estimation uncertainty for each current estimate and, if the risk is high, whether it is a significant risk.

Responding to the assessed risks

The auditor determines whether management has properly applied the framework and whether the methods used are appropriate and consistently applied, or whether any change is appropriate. In response to the assessed risks the auditor performs one or more of the following:

1. determine whether events up to the date of the auditor’s report give sufficient evidence on the estimate, by reviewing events after the reporting date;
2. test how management made the estimate and the data it is based on, considering the method and assumptions;
3. test the controls over management’s procedures for making estimates, and carry out suitable substantive procedures; or
4. develop the auditor’s own estimate or range of estimates, compare it with management’s figure and evaluate any significant differences.

The auditor must also consider the need for expert evidence, obtain written representations from management, and document the basis for conclusions and any indications of management bias.

Indicators of management bias

ISA 540 gives four indicators:

1. changes in an accounting estimate, or the method of making it, where this is a subjective judgement;
2. use of the entity’s own assumptions for fair value estimates when they are inconsistent with observable market assumptions;
3. selecting or building significant assumptions that give an estimate which favours management’s objectives; and
4. selecting an unduly optimistic or pessimistic estimate.

Background: The November 2025 model solution adds a fifth: management’s refusal to engage an expert in the area.

Auditing fair value measurements

Issues in auditing fair value are similar to those for estimates, and both fall under ISA 540. Items measured at fair value, such as property and financial instruments, are often significant balances. The auditor recognises the following audit risks.

In an exam scenario, tie each risk to the facts. A valuation prepared by an in-house team with no external valuer points to management bias and weak control. Internal models using unobservable inputs, such as future prices and discount rates, point to high inherent risk because small changes in assumptions move the value materially. Complex instruments point to the need for specialist knowledge.

A fall in expected cash flows points to the risk that an impairment is understated.

The syllabus also mentions an International Auditing and Assurance Standards Board (IAASB) alert of October 2008 on fair value estimates in uncertain markets, which focused on financial instruments and linked to going concern. It is not a requirement, and it is dated.

The rules in more depth

Why the external auditor tests internal audit work

Internal audit is part of the client. Its work can help, but the external auditor cannot pass the responsibility on. Re-examining some of the items internal audit checked shows whether its work can be trusted, and the more risk and subjectivity in the area, the less the auditor relies and the more the auditor re-does.

Why independence of internal audit matters

An internal audit function that reports to the finance director may be pushed to soften findings. One that reports to the audit committee and is free to decide its own work is more objective. Management’s failure to act on internal audit reports also shows that the control environment is weak.

Why estimates attract bias

An estimate leaves room for choice, and management often has an incentive: a bonus, a loan covenant or a share price. Small choices, such as a longer useful life or a lower provision, can raise profit without breaking any rule. The auditor therefore looks at the direction of judgements across estimates and not only at each one.

Why the auditor reviews last year’s outcomes

If estimates made last year turned out too optimistic, the same people are likely to be optimistic again. A track record of accuracy gives comfort. A record of repeated overstatement suggests bias.

Why an own estimate is a strong response

By building its own estimate or range, the auditor tests the answer and not only the method. A management figure outside a reasonable range is hard to defend.

Worked example: relying on internal audit and challenging estimates

1. Status. Internal audit reports to the finance director, so objectivity is limited. The auditor should look for audit committee involvement and for evidence that management acts on its reports.
2. Quality of the work. Incomplete file notes mean the work may not be properly documented. The auditor must re-perform some items before relying on it, and should rely little on the receivables and inventory work given their risk.
3. Bias indicators. The change in useful life after profit fell is a subjective change. The warranty cut against rising claims shows an estimate that favours management. The investment valued with own assumptions above market is inconsistent with observable assumptions. The refusal to use an expert is a further indicator.
4. Responses. Review the outcome of last year’s warranty and depreciation estimates. Test the data and method for each. Develop the auditor’s own warranty estimate from claims history. Check events after the year end. Consider the auditor’s own expert for the investment.
5. Other steps. Obtain representations on the assumptions, document the bias indicators, and tell those charged with governance.

Conclusion. Limit reliance on internal audit and challenge each estimate, since the pattern of choices all raises profit.

How to score full marks

• For reliance on internal audit, give the three function factors, the three planning factors and the five evaluation points, then the tests.
• State that responsibility stays with the external auditor.
• For estimates, give the definition, the understanding needed and the four responses.
• For bias, list the four indicators and apply each to the facts. Add the fifth if the scenario includes it.
• For fair value, use inherent, control and detection risk, with a fact from the case against each.
• Name the direction: bias usually raises profit or assets.
• Time. Spend time in proportion to marks.

Common mistakes in the exam

• Saying that relying on internal audit reduces the external auditor’s responsibility.
• Relying on internal audit without testing its work.
• Ignoring who internal audit reports to.
• Accepting a management estimate because it is supported by a valuation prepared by management itself.
• Listing bias indicators without applying them to the facts.
• Forgetting that estimates are reviewed against previous outcomes.
• Leaving out the auditor’s own estimate or range as a response.

Quick revision

• ISA 610: decide whether and how far to use internal audit work and whether it is adequate. External auditor keeps full responsibility.
• Function: status and objectivity; competence and due care; communication.
• Specific work: nature and scope, risk, subjectivity. Evaluate training, supervision, evidence, conclusions, exceptions. Test it. Document.
• Estimate: an approximation where no precise measure exists. ISA 540: reasonable estimates and adequate disclosures.
• Understand framework, identification, nature, method, controls, experts, assumptions, uncertainty. Review last year’s outcome.
• Responses: events to report date; test method and data; test controls; own estimate or range.
• Bias indicators: changes, own assumptions against market, favourable assumptions, optimistic or pessimistic choice. Fair value risks: inherent, control, detection.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.