SAS 128: Using the Work of Internal Auditors

Earlier this month the Audit Standard Board (ASB) issued new guidelines outlining how auditors can incorporate the work of internal auditors in the financial statement audit. The new regulation, Statement on Audit Standard (SAS) 128 supersedes SAS 65 and significantly amends AU-C Section 315. It introduces additional guidelines outside auditors must follow if they use the work of the internal audit team in their audit.

The new regulations apply to financial statement audits conducted for periods ending on or after December 15, 2014. To help clients, prospects and others who rely on the internal audit function to support their external auditor, we have outlined key aspects of the new regulation below.

SAS 128 Changes

Key changes mandated by SAS 128 focus on the responsibilities the audit firm has in assessing the reliability of information obtained from the internal audit team. SAS 128 applies when the audit firm uses the work of the internal audit function in obtaining audit evidence and when using internal audit staff to provide assistance under the direction/supervision of the audit firm.

As a condition of using the work obtained in these situations, the new regulations require an evaluation of work performed to ensure a systematic and disciplined approach was used. In addition, there must also be an assessment of the quality control processes as well.


SAS 128 does not apply in specific circumstances. Exceptions are provided if the work of the internal audit department is not relevant to the audit, the external auditor does not intend to rely on their work in obtaining audit evidence, and when the internal audit team is not used to provide assistance in conducting the audit. Finally, if a company doesn’t have an internal audit function, SAS 128 does not apply

Was this helpful? Share to your network.

Article Category: