SA 610 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
SA 610 tells the statutory auditor how to use the work of a company's internal audit team. It covers two things: relying on what the internal audit function has already done, and, where the law does not forbid it, using internal auditors as direct helpers under the external auditor's supervision.
SA 610 (Revised), as effective for audits of financial statements for periods beginning on or after 1 April 2016, applies when the entity has an internal audit function and the auditor expects to use it. ICAI may revise standards, so check icai.org for the current text. A reviewed control environment, such as one built through financial and legal due diligence, supports reliance on internal audit.
The external auditor has sole responsibility for the audit opinion, and that is not reduced by using internal audit (paragraph 11). Before using the function's work the auditor evaluates its objectivity, competence and systematic approach, and does not use it if any is lacking (paragraphs 15-16). The more judgement and risk involved, the less is used. For direct assistance, the auditor assesses threats to objectivity and competence, obtains written agreements and directs, supervises and reviews the work. Significant judgements and higher-risk areas cannot be given to internal auditors.
Scope (paragraphs 1-11)
The standard covers using the work of the internal audit function as evidence and using internal auditors to give direct assistance under the external auditor's direction, supervision and review (paragraph 1). It does not apply if there is no internal audit function (paragraph 2), nor if the function's activities are not relevant or the auditor does not expect to use its work (paragraph 3). Nothing requires the external auditor to use the function's work to change the nature or timing, or reduce the extent, of their own procedures (paragraph 3). The requirements on direct assistance apply only if the auditor plans to use it (paragraph 4).
Law or regulation may prohibit or restrict either type of use; the SAs do not override such laws, so a prohibition does not stop the auditor complying with the SAs (paragraph 5). For companies, see our post on section 138: internal audit. In the tax audit context, see why an internal auditor cannot be the tax auditor; that is a separate question from this standard.
Procedures by individuals who do something similar to internal audit are treated as internal controls unless done by an objective and competent function that applies a systematic and disciplined approach including quality control (paragraph 10). Internal auditors are not independent of the entity in the way the external auditor must be, so the standard sets conditions and guards against over-reliance (paragraph 11).
| Term (paragraph 14) | Plain meaning |
|---|---|
| Internal audit function | A function that performs assurance and consulting activities to evaluate and improve the effectiveness of governance, risk management and internal control |
| Direct assistance | Using internal auditors to perform audit procedures under the external auditor's direction, supervision and review |
The objectives are to decide whether, where and how far the function's work or direct assistance can be used; to decide whether the work used is adequate; and, for direct assistance, to direct, supervise and review properly (paragraph 13).
Part A: using the work of the internal audit function
Evaluating the function (paragraphs 15-16)
The auditor evaluates three things: whether the function's organisational status and policies support the objectivity of the internal auditors; its level of competence; and whether it applies a systematic and disciplined approach, including quality control. If any of the three is lacking, the auditor shall not use the function's work (paragraph 16). Objectivity means performing tasks without bias, conflict of interest or undue influence of others overriding professional judgement (A7).
How much can be used (paragraphs 17-20)
The auditor considers the nature and scope of the function's work and its relevance to the audit strategy and plan (paragraph 17). All significant judgements remain with the external auditor, and less internal audit work should be planned, with more done directly, in these cases (paragraph 18):
- the more judgement is involved in planning and performing procedures and evaluating evidence;
- the higher the assessed risk at assertion level, especially significant risks;
- the less the function's status and policies support objectivity; and
- the lower the function's competence.
The auditor also checks that, in aggregate, the planned use still leaves the external auditor sufficiently involved (paragraph 19), and tells those charged with governance how the work of internal audit is planned to be used as part of the planned scope and timing of the audit (paragraph 20; see SA 260).
Using the work (paragraphs 21-25)
| Step | What the auditor does | Paragraph |
|---|---|---|
| Discuss | Talks to the function about the planned use, to co-ordinate | 21 |
| Read | Reads the function's reports on the work to be used | 22 |
| Test | Performs enough procedures on the body of work to judge adequacy: planned, performed, supervised, reviewed and documented properly; enough evidence for reasonable conclusions; conclusions appropriate and reports consistent | 23 |
| Respond to risk | Scales procedures to the judgement involved, assessed risk, objectivity and competence, and includes reperformance of some of the work | 24 |
| Re-evaluate | Checks that the conclusions about the function and the extent of use remain appropriate | 25 |
Part B: direct assistance from internal auditors
Whether it is permitted
The external auditor may be prohibited by law or regulation from obtaining direct assistance, in which case paragraphs 27-35 and 37 do not apply (paragraph 26). As printed, SA 610 (Revised) permits direct assistance where it is not prohibited by law or regulation and the auditor plans to use it (paragraph 27); the standard contains no separate note of India-specific changes on this point, so the permission depends on the law and regulation that apply to the particular entity. Where a prohibition exists, a principal auditor should consider whether it also extends to component auditors and address this in communicating with them (A31).
Conditions and limits (paragraphs 27-32)
The auditor evaluates threats to the objectivity of the internal auditors, including by asking them about interests and relationships that may create a threat, and their competence. Direct assistance is not used if there are significant threats to objectivity or insufficient competence (paragraphs 27-28).
The nature and extent of work assigned, and the direction, supervision and review, depend on the judgement involved, the assessed risk, and the objectivity and competence evaluation (paragraph 29). Internal auditors must not be used for procedures that (paragraph 30):
- involve significant judgements in the audit;
- relate to higher assessed risks where more than limited judgement is needed;
- relate to work in which they were involved and which has been or will be reported to management or governance by the internal audit function; or
- relate to the external auditor's own decisions about the function and its work.
The planned use is communicated to those charged with governance so as to reach a mutual understanding that it is not excessive (paragraph 31), and the auditor checks that direct assistance and use of the function's work together leave the external auditor sufficiently involved (paragraph 32).
Using direct assistance (paragraphs 33-35)
Before using internal auditors, the auditor obtains written agreement from an authorised representative of the entity that the internal auditors may follow the external auditor's instructions and that the entity will not interfere; and written agreement from the internal auditors to keep specified matters confidential and to report any threat to their objectivity (paragraph 33). The external auditor directs, supervises and reviews the work in line with SA 220 (see SA 220), recognising that internal auditors are not independent, and checks back to the underlying evidence for some of the work (paragraph 34). The auditor stays alert for signs that the earlier evaluation no longer holds (paragraph 35).
Documentation (paragraphs 36-37)
If the function's work is used, the file records the evaluation of objectivity, competence and systematic approach, the nature and extent of work used and why, and the procedures performed on its adequacy (paragraph 36). If direct assistance is used, it records the evaluation of threats and competence, the basis for the work assigned, who reviewed it and when, the two written agreements and the internal auditors' working papers (paragraph 37). See SA 230.
The Companies (Auditor's Report) Order has a clause on internal audit systems; see CARO clauses 3(xii) to 3(xvi).
Illustrative example
Orion Retail Ltd is an invented company with an internal audit team reporting to the audit committee. The statutory auditor reviews the team's charter, qualifications and quality review and finds them adequate. It uses the team's store cash-handling tests (limited judgement, low assessed risk), re-performs part of them and confirms they were supervised. It does not rely on internal audit for inventory write-downs, a significant risk involving heavy judgement. For inventory counts, direct assistance is arranged after written agreements, and the auditor re-checks a sample of count sheets.
Need help with internal audit reliance?
A well-documented internal audit programme, charter and reports can reduce duplicated work in the statutory audit. TaxClue's financial and legal due diligence team can help you review your control environment and internal audit documentation so it is ready for the external auditor.
Key takeaways
- The external auditor alone is responsible for the opinion.
- Internal audit work is used only if the function is objective, competent and systematic.
- Less is used where judgement and risk are high.
- Direct assistance needs a permitted legal position, threat evaluation and written agreements.
- Significant judgements and related decisions are never delegated to internal auditors.
Read next
- SA 220: quality control for an audit
- SA 600: using the work of another auditor
- SA 620: using an auditor's expert
- Section 138: internal audit
Disclaimer: Based on the Standards on Auditing and quality standards issued by the Institute of Chartered Accountants of India, in the versions named in the article, and ICAI's announcement of 31 March 2026 on SQM 1 and SQM 2, as consulted on 3 October 2026. ICAI revises standards from time to time; check the current text and effective dates on icai.org. This article is general information, not legal advice; check the official text before acting.