At first glance, it might not seem that external audit standards are of urgent importance to internal auditors. But a new rule from the International Auditing and Assurance Standards Board is very specific about how external auditors must review internal auditors’ work if they are to rely on it – and conversations with the audit committee might prove difficult at organisations where internal audit is not ready for review.

Imagine, for example, the conversation that might take place if the audit committee hears that audit fees are rising – and that the reason for this is that the external auditors can no longer rely on the quality of internal audit’s work. Imagine also that internal audit has never mentioned to the audit committee the need for an independent quality assessment – and at the meeting the external auditor points out that an independent quality review is required by our professional standards. The conversation might then turn to how internal audits were reviewed or supervised, which was hopefully, but not necessarily, well documented.

Ouch. We need to get to work on this – now. There is nothing new in knowing that our work might be evaluated by others. Some internal audit groups are ready for inspection at any time, so no changes are needed because of the new standard. For others, quite a bit more might need to be done.

Under ISA 610 (Revised), “Using the work of internal auditors”, external auditors who plan to rely on the work of internal auditors will verify whether the work is adequate or not by evaluating internal audit independence, policies, procedures, competence and whether or not internal audit “applies a systematic and disciplined approach, including quality control”.

External auditors will not merely evaluate the sufficiency of internal audit reports relating directly to their audit; they will also perform audit procedures on “the body of work of the internal audit function as a whole” to check that: internal audit work has been properly planned, performed, supervised, reviewed, and documented; sufficient appropriate evidence has been obtained to enable internal audit to draw reasonable conclusions; conclusions are appropriate in the circumstances; and internal audit reports are consistent with the results of the work done.

When external auditors plan to use the work of internal audit, they will be required to discuss with “those charged with governance” (presumably, both management and the audit committee) how they plan to use internal audit’s work. The nature and extent of external audit work will then be responsive to the amount of judgment involved in internal audit’s work; the level of competence of internal audit; the assessed risk of material misstatement; and the extent to which internal audit’s organisational status, policies and procedures support objectivity. Some internal audit work will be redone by the external auditor, so it will be crucial that the work papers include enough detail to enable this.

Even if your external auditors don’t follow international standards or don’t routinely rely on your reports or other internal audit work, you can expect new enquiries about internal auditing. The new standard is raising the bar for internal auditors and we all may find we are the focus of growing attention from both external auditors and audit committees. Some of us are ready for the scrutiny, but we must all ensure that we’re well prepared.

We have to assess the level of competence of internal audit and ensure that we have properly planned, performed and supervised internal audits, and quality control. I think there is only one logical way to approach this. At every audit group where an independent assessment of internal has not yet taken place, a review needs to be scheduled. This review will give internal audit a road map for how to proceed and will give external auditors a strong basis for some of their reliance on our work.

It’s time to get to work to ensure that we are well prepared. When and if you are evaluated by your external auditors, I hope you will find that being audited is a great experience. I’m sure you believe, as I do, that it’s almost always worthwhile.

Richard Chambers writes a blog at www.theiia.org/blogs/chambers and tweets at www.twitter.com/rfchambers