The PCAOB states that the auditor must perform enough of the testing of internal controls himself or herself so that it provides the principal evidence for the opinion on internal control. However, the auditor may use the work of others, such as internal auditors or other company personnel, to alter the nature, timing, or extent of their own testing of internal controls.
Client A has an internal audit department that reports to the CFO and audit committee. The department is fully staffed with personnel that are experienced, highly qualified, and professional. It has an external peer review conducted every three years that shows it has fully complied with the Institute of Internal Auditor's professional standards. It has a charter that clearly allows full access to all areas of the company, company personnel, records, and other sources of information.
It focuses a lot of attention on testing controls of the more significant control activities of the company as well as on corporate government issues and management's processes for risk identification and assessment.
Client B has an internal audit department that reports to the controller and audit committee. It is understaffed and most of its personnel are recent college graduates. The chief audit executive, however, has had a lot of experience with the company and is considered to be
"One of the guys." Its audit scope is determined by the controller. The department focuses most of its attention on financial auditing, but does some testing of controls in areas as directed by the controller. It does not have enough budgets to undergo an external peer review of the quality of its performance.

Required
a. Discuss the factors the external auditor should consider in determining to what extent the work of the internal auditors can be relied on in forming an opinion on internal controls.
b. Is it likely that much reliance can be placed on the work performed by the internal auditors of Client A? Client B? Explain.
c. Why might the external auditors decide to test the effectiveness of the control environment themselves rather than rely to any extent on the testing of corporate governance by the internal auditors of Client A?