External auditors can leverage internal audit work to streamline financial reporting, reduce disruptions, and gain deeper insight into a company’s risk environment. If your organization has an internal audit function, there is a real opportunity to make your next external audit faster and more effective by putting that team’s knowledge to work.
This collaboration is not just a convenience. It is backed by professional standards that define exactly how external auditors may rely on internal audit activities. Understanding those standards, and preparing your internal audit team to meet them, can save time, reduce costs, and produce a stronger audit outcome.
Why external auditors benefit from internal audit collaboration
External auditors are not required to use internal auditors in any capacity during a financial statement audit. However, a well-structured collaboration between internal and external audit teams delivers measurable benefits for both sides.
Internal audit personnel typically have deep institutional knowledge that external auditors lack. They understand the company’s processes, internal controls, and risk areas from the inside. When external auditors tap into that knowledge, they gain a faster path to understanding the entity and its environment. This accelerates the risk assessment process and helps identify risks of material misstatement earlier in the engagement.
Collaboration also reduces the operational burden on the business itself. External audit fieldwork can disrupt daily operations by pulling staff into interviews, document requests, and walkthroughs. When internal auditors handle some of that groundwork in advance, the external team spends less time on-site and causes fewer interruptions to the people who run the business.
For internal audit teams, the relationship is equally valuable. Working alongside external auditors raises the visibility and credibility of the internal audit function within the organization. It also gives internal auditors exposure to external perspectives and methodologies that can strengthen their own practices. Firms that provide audit and assurance services often coordinate with in-house teams precisely because that exchange improves the quality of both functions.
What SAS 128 requires for using internal audit work
The professional framework governing this collaboration is Statement on Auditing Standards (SAS) No. 128, _Using the Work of Internal Auditors_, issued by the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA) in 2014. This standard replaced earlier guidance and clarified the specific conditions under which external auditors may rely on internal audit activities. You can review the full set of Statements on Auditing Standards currently in effect on the AICPA and CIMA site.
SAS 128 draws a clear distinction between two types of assistance that internal auditors can provide:
- Providing audit evidence. The external auditor evaluates work already performed by the internal audit function and determines whether it is reliable enough to use as part of the external audit.
- Providing direct assistance. Internal auditors perform specific tasks under the direction, supervision, and review of the external auditor. In this arrangement, the external auditor maintains control over the work product.
The standard imposes a critical prerequisite for both types of assistance. The internal audit function must apply a systematic and disciplined approach to planning, performing, supervising, reviewing, and documenting its activities. This includes maintaining appropriate quality control policies and procedures that align with professional internal auditing standards.
If the external auditor determines that the internal audit function lacks this systematic and disciplined approach, the work of the internal auditor cannot be used, regardless of how competent the individuals may be.
How to prepare your internal audit function for SAS 128 compliance
Meeting the requirements of SAS 128 is not automatic. It requires deliberate preparation and, in many cases, upgrades to how the internal audit team operates. The following steps will position your internal audit function to provide maximum value during an external audit.
Adopt a formal methodology. Your internal audit function should follow a recognized framework, such as the Global Internal Audit Standards issued by the Institute of Internal Auditors (IIA). This demonstrates the systematic and disciplined approach that SAS 128 demands.
Document everything rigorously. External auditors will evaluate the quality of your internal audit workpapers. Ensure that every audit engagement is documented with clear objectives, scope, procedures performed, evidence gathered, findings, and conclusions. Incomplete or inconsistent documentation is one of the fastest ways to disqualify internal audit work from external use.
Implement quality control policies. Establish formal quality assurance and improvement programs within your internal audit department. This includes supervisory review of workpapers, periodic internal assessments of audit quality, and, where feasible, external quality assessments.
Secure written acknowledgment from management. SAS 128 specifically requires that management or those charged with governance provide a written acknowledgment when internal auditors will provide direct assistance to the external auditor. This acknowledgment must confirm two things: that internal auditors will follow the external auditor’s instructions, and that the entity will not interfere with the work performed.
Coordinate early with your external auditor. Before the audit begins, sit down with the external audit team to discuss where internal audit work may be relevant. Identify areas where internal auditors have already performed testing, documented controls, or assessed risks. Early coordination prevents duplicated effort and gives the external auditor time to evaluate whether the internal audit work meets their standards. A structured risk advisory engagement can help map those areas before fieldwork starts.
The difference between internal audit and external audit roles
Understanding the relationship between internal audit and external audit is essential for making collaboration work. While both functions examine financial information and internal controls, their purposes, reporting lines, and audiences are fundamentally different.
Internal auditors are employees of the organization. They report to management or the audit committee and focus on improving operations, risk management, and governance. Their scope extends beyond financial reporting to include operational efficiency, compliance, and strategic risks.
External auditors, by contrast, are independent third parties hired to express an opinion on the fairness of a company’s financial statements. They report to shareholders and regulators, and their work is governed by generally accepted auditing standards (GAAS). Independence is the cornerstone of their role, and they cannot have a financial or personal interest in the organization they audit.
This difference in purpose is precisely why SAS 128 includes safeguards. When external auditors use internal audit work, they must still maintain their independence and professional skepticism. They cannot simply accept internal audit findings at face value. Instead, they must evaluate the objectivity, competence, and quality of the internal audit function before relying on any of its work. For public companies, the PCAOB auditing standards set parallel expectations for how an auditor may use the work of others.
Practical steps to streamline your next external audit
If you want to maximize the value of internal and external audit collaboration, take these steps before your next audit cycle.
First, assess your internal audit function against SAS 128 requirements. Does it use a systematic, documented methodology? Are quality control policies in place? If gaps exist, address them now rather than discovering them when the external auditor arrives.
Second, identify specific audit areas where internal audit work could reduce external audit effort. Common examples include testing of internal controls over financial reporting, walkthroughs of transaction cycles, and assessments of IT general controls. These are areas where internal auditors typically have both the access and the expertise to produce reliable work.
Third, establish a communication protocol between the two teams. Define how information will be shared, how workpapers will be formatted, and who will serve as the primary liaison. Clear communication prevents misunderstandings and ensures that internal audit work is presented in a format that external auditors can evaluate efficiently.
Finally, treat this as an ongoing relationship rather than a one-time event. The most effective collaborations develop over multiple audit cycles, as both teams learn how to work together and the internal audit function refines its approach based on external auditor feedback.
Frequently Asked Questions
How can external auditors use internal audit work?
External auditors can use internal audit work in two ways under SAS 128: by evaluating and relying on work the internal audit function has already performed, or by directing internal auditors to provide direct assistance on specific audit tasks. In both cases, the external auditor retains responsibility for the audit opinion and must evaluate the quality of the internal audit work before relying on it.
What is SAS 128 and why does it matter?
SAS 128 is a Statement on Auditing Standards issued by the AICPA in 2014 that governs how external auditors may use the work of internal auditors. It matters because it sets clear requirements, including a systematic methodology and quality control policies, that the internal audit function must meet before its work can be relied upon during an external audit.
What is the difference between internal audit and external audit?
Internal auditors are employees who evaluate an organization’s operations, risk management, and internal controls for management. External auditors are independent professionals who examine financial statements and issue an opinion for shareholders and regulators. The key difference is independence: external auditors must remain objective and cannot be influenced by the company’s management.
Does the internal audit team need special qualifications to assist external auditors?
The internal audit function must demonstrate a systematic and disciplined approach to its activities, including appropriate quality control policies. While individual certifications like CIA (Certified Internal Auditor) are valuable, SAS 128 focuses on the function as a whole, including its methodology, documentation practices, and quality assurance programs, rather than individual credentials alone.
Can external auditors be required to use internal audit work?
No. External auditors have full discretion over whether to use internal audit work. SAS 128 permits but does not require this collaboration. The decision depends on the external auditor’s assessment of the internal audit function’s competence, objectivity, and the systematic quality of its approach.
How does internal and external audit collaboration reduce audit costs?
When internal auditors perform preliminary testing, document controls, and assess risks before external fieldwork begins, the external audit team spends less time on-site. This reduces billable hours, minimizes disruptions to business operations, and can lower overall audit fees, provided the internal audit work meets the quality standards required by SAS 128.
