OIG UNDER REVIEW

& PERIOD REVIEWED

[Name]{.underline} [Title]{.underline} [Phone Number]{.underline}

PERSON(S) WHO

COMPLETED

SECTION 1
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

DATE COMPLETED
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

PERSON(S) WHO

COMPLETED

SECTION 2
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

DATE COMPLETED
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

[PURPOSE AND INSTRUCTIONS]{.underline}

###### Reviewed Organization

Section 1 of this questionnaire is designed to obtain general
information about your audit organization and information about its
internal quality control system. It requests specific information about
your policies and procedures designed to assure compliance with
generally accepted government auditing standards. The external peer
review team will complete Section 2 as part of the review of your audit
organization's quality control system.

Please respond to the questions in Section 1, by providing a reference
to and a copy of your documented policies and procedures. If you do not
have written policies and procedures, describe the practice in place and
how you ensure all audit staff are cognizant of the requirements. Also
indicate in your response any relevant checklists or forms that your
organization requires and provide copies. If you have an audit manual or
similar document, your answers should be cross‑referenced to the
applicable sections of this and other supplemental documents as
appropriate. The documentation with the completed Section 1
questionnaire should be provided to the team leader before the site
review begins.

The PCIE's *Guide for Conducting External Quality Control Reviews of the
Audit Operations of Offices of Inspector General* contemplates that an
OIG's written policies and procedures, to include control measures to
ensure compliance, is a key characteristic of its overall quality
control system. GAGAS (3.50) states: "An audit organization's system of
quality control encompasses the audit organization's structure and the
policies adopted and procedures established to provide the organization
with reasonable assurance of complying with applicable standards
governing audits and attestation engagements. An audit organization's
internal control system should include procedures for monitoring, on an
ongoing basis, whether the policies and procedures related to the
standards are suitably designed and are being effectively applied."
**[In answering these questions, it is therefore important to describe
any control procedures your organization has in place to ensure that
activities stated in your policies are actually performed as
intended]{.underline}**.

####### External Peer Review Team 

The policies and procedures obtained from or described by the audit
organization being reviewed should be examined and evaluated. A
conclusion should be reached regarding the adequacy of the policies and
procedures in terms of whether they, if properly fulfilled, would
provide reasonable assurance that GAGAS would be met. To facilitate the
review, key passages of the pertinent GAGAS sections are included; for
additional information, the reviewer may want to refer directly to the
standards (references to the applicable citations are included).
Emphasis should be placed upon the qualitative nature of the

guidance promulgated and the adequacy of control measures that would
foster such assurance. The policies and procedures that establish
internal guidance and audit requirements represent a key primary
characteristic of the overall quality control system; accordingly, the
level of assurance afforded needs to be assessed.

**[Record in Section 2 of this Appendix the conclusion "Adequate" or
"Inadequate" as designed.]{.underline}** A cross-reference to a
narrative explanation supporting the determination should also be
recorded. The determination should be based upon the reviewer's
knowledge of GAGAS. To assist in the process, the reviewer should use
the steps set forth in the individual appendices guiding the evaluation
of the reviewed organization's process if the policies and procedures
were found to be inadequate as prescribed. If the policies and
procedures are determined to be adequate, the reviewer should test
compliance directly against them (though this may be achieved through
the use of the checklists (Appendices B-G) provided with modifications,
as needed). It is important to note, however, that GAGAS represents the
overarching criteria. If, for example, the reviewed organization's
policies and procedures encompass more extensive requirements than those
prescribed in GAGAS and lack of compliance is noted with those
incremental requirements, it would not constitute a reportable condition
for the purposes of this review (though it should be orally conveyed as
a courtesy to management).

In addition, the absence of a particular policy or policies does not, in
and of itself, constitute a reportable condition but should be taken
into consideration in concluding as to the adequacy of the quality
control system taken as a whole.

+-----------------+-----------------+-----------------+-----------------+
| **1.            |                 | 7.  The audit   |                 |
| [INDEPENDENCE   |                 |                 |                 |
| ]{.underline}** |                 |    organization |                 |
|                 |                 |     should have |                 |
| ## Perso        |                 |     an internal |                 |
| nal Impairments |                 |     quality     |                 |
|                 |                 |     control     |                 |
| 1.1 What are    |                 |     system to   |                 |
| your policies   |                 |     help        |                 |
| and procedures  |                 |     determine   |                 |
| to determine    |                 |     whether     |                 |
| whether         |                 |     auditors    |                 |
| auditors, both  |                 |     have any    |                 |
| Federal and     |                 |     personal    |                 |
| non-Federal,    |                 |     impairments |                 |
| have any        |                 |     to          |                 |
| personal        |                 |                 |                 |
| impairments     |                 |    independence |                 |
| related to the  |                 |     that could  |                 |
| audits they     |                 |     affect      |                 |
| conduct,        |                 |     their       |                 |
| including       |                 |                 |                 |
| nonaudit        |                 |    impartiality |                 |
| services and    |                 |     or the      |                 |
| their           |                 |     appearance  |                 |
| resolution?     |                 |     of          |                 |
| (GAGAS 3.07,    |                 |                 |                 |
| 3.09)           |                 |   impartiality. |                 |
|                 |                 |     The audit   |                 |
|                 |                 |                 |                 |
|                 |                 |    organization |                 |
|                 |                 |     needs to be |                 |
|                 |                 |     alert for   |                 |
|                 |                 |     personal    |                 |
|                 |                 |     impairments |                 |
|                 |                 |     to          |                 |
|                 |                 |                 |                 |
|                 |                 |    independence |                 |
|                 |                 |     of its      |                 |
|                 |                 |     staff       |                 |
|                 |                 |     members.    |                 |
|                 |                 |     Personal    |                 |
|                 |                 |     impairments |                 |
|                 |                 |     of staff    |                 |
|                 |                 |     members     |                 |
|                 |                 |     result from |                 |
|                 |                 |                 |                 |
|                 |                 |   relationships |                 |
|                 |                 |     and beliefs |                 |
|                 |                 |     that might  |                 |
|                 |                 |     cause       |                 |
|                 |                 |     auditors to |                 |
|                 |                 |     limit the   |                 |
|                 |                 |     extent of   |                 |
|                 |                 |     the         |                 |
|                 |                 |     inquiry,    |                 |
|                 |                 |     limit       |                 |
|                 |                 |     disclosure, |                 |
|                 |                 |     or weaken   |                 |
|                 |                 |     or slant    |                 |
|                 |                 |     audit       |                 |
|                 |                 |     findings in |                 |
|                 |                 |     any way.    |                 |
|                 |                 |     Auditors    |                 |
|                 |                 |     are         |                 |
|                 |                 |     responsible |                 |
|                 |                 |     for         |                 |
|                 |                 |     notifying   |                 |
|                 |                 |     the         |                 |
|                 |                 |     appropriate |                 |
|                 |                 |     officials   |                 |
|                 |                 |     within      |                 |
|                 |                 |     their audit |                 |
|                 |                 |                 |                 |
|                 |                 |   organizations |                 |
|                 |                 |     if they     |                 |
|                 |                 |     have any    |                 |
|                 |                 |     personal    |                 |
|                 |                 |     impairments |                 |
|                 |                 |     to          |                 |
|                 |                 |                 |                 |
|                 |                 |   independence. |                 |
|                 |                 |     Examples of |                 |
|                 |                 |     personal    |                 |
|                 |                 |     impairments |                 |
|                 |                 |     of          |                 |
|                 |                 |     individual  |                 |
|                 |                 |     auditors    |                 |
|                 |                 |     include,    |                 |
|                 |                 |     but are not |                 |
|                 |                 |     limited to, |                 |
|                 |                 |     the         |                 |
|                 |                 |     following:  |                 |
|                 |                 |                 |                 |
|                 |                 | > **a.**        |                 |
|                 |                 | > immediate     |                 |
|                 |                 | > family or     |                 |
|                 |                 | > close family  |                 |
|                 |                 | > member who is |                 |
|                 |                 | > a director or |                 |
|                 |                 | > officer of    |                 |
|                 |                 | > the audited   |                 |
|                 |                 | > entity, or as |                 |
|                 |                 | > an employee   |                 |
|                 |                 | > of the        |                 |
|                 |                 | > audited       |                 |
|                 |                 | > entity, is in |                 |
|                 |                 | > a position to |                 |
|                 |                 | > exert direct  |                 |
|                 |                 | > and           |                 |
|                 |                 | > significant   |                 |
|                 |                 | > influence     |                 |
|                 |                 | > over the      |                 |
|                 |                 | > entity or the |                 |
|                 |                 | > program under |                 |
|                 |                 | > audit;        |                 |
+-----------------+-----------------+-----------------+-----------------+
|                 |                 | > **b.**        |                 |
|                 |                 | > financial     |                 |
|                 |                 | > interest that |                 |
|                 |                 | > is direct, or |                 |
|                 |                 | > is            |                 |
|                 |                 | > signi         |                 |
|                 |                 | ficant/material |                 |
|                 |                 | > though        |                 |
|                 |                 | > indirect, in  |                 |
|                 |                 | > the audited   |                 |
|                 |                 | > entity or     |                 |
|                 |                 | > program,      |                 |
|                 |                 | >               |                 |
|                 |                 | > **c.**        |                 |
|                 |                 | >               |                 |
|                 |                 |  responsibility |                 |
|                 |                 | > for managing  |                 |
|                 |                 | > an entity or  |                 |
|                 |                 | > decision      |                 |
|                 |                 | > making that   |                 |
|                 |                 | > could affect  |                 |
|                 |                 | > operations of |                 |
|                 |                 | > the entity or |                 |
|                 |                 | > program being |                 |
|                 |                 | > audited; for  |                 |
|                 |                 | > example as a  |                 |
|                 |                 | > director,     |                 |
|                 |                 | > officer, or   |                 |
|                 |                 | > other senior  |                 |
|                 |                 | > position of   |                 |
|                 |                 | > the entity,   |                 |
|                 |                 | > activity, or  |                 |
|                 |                 | > program being |                 |
|                 |                 | > audited, or   |                 |
|                 |                 | > as a member   |                 |
|                 |                 | > of management |                 |
|                 |                 | > in any        |                 |
|                 |                 | > decision      |                 |
|                 |                 | > making,       |                 |
|                 |                 | > supervisory,  |                 |
|                 |                 | > or ongoing    |                 |
|                 |                 | > monitoring    |                 |
|                 |                 | > function for  |                 |
|                 |                 | > the entity,   |                 |
|                 |                 | > activity, or  |                 |
|                 |                 | > program under |                 |
|                 |                 | > audit;        |                 |
|                 |                 | >               |                 |
|                 |                 | > **d.**        |                 |
|                 |                 | > concurrent or |                 |
|                 |                 | > subsequent    |                 |
|                 |                 | > performance   |                 |
|                 |                 | > of an audit   |                 |
|                 |                 | > by the same   |                 |
|                 |                 | > individual    |                 |
|                 |                 | > who           |                 |
|                 |                 | > maintained    |                 |
|                 |                 | > the official  |                 |
|                 |                 | > accounting    |                 |
|                 |                 | > records when  |                 |
|                 |                 | > such services |                 |
|                 |                 | > involved      |                 |
|                 |                 | > preparing     |                 |
|                 |                 | > source        |                 |
|                 |                 | > documents or  |                 |
|                 |                 | > originating   |                 |
|                 |                 | > data, in      |                 |
|                 |                 | > electronic or |                 |
|                 |                 | > other form;   |                 |
|                 |                 | > posting       |                 |
|                 |                 | > transactions  |                 |
|                 |                 | > (whether      |                 |
|                 |                 | > coded by      |                 |
|                 |                 | > management or |                 |
|                 |                 | > not coded);   |                 |
|                 |                 | > authorizing,  |                 |
|                 |                 | > executing, or |                 |
|                 |                 | > consummating  |                 |
|                 |                 | > transactions  |                 |
|                 |                 | > (for example, |                 |
|                 |                 | > approving     |                 |
|                 |                 | > invoices,     |                 |
|                 |                 | > payrolls,     |                 |
|                 |                 | > claims, or    |                 |
|                 |                 | > other         |                 |
|                 |                 | > payments of   |                 |
|                 |                 | > the entity or |                 |
|                 |                 | > program being |                 |
|                 |                 | > audited);     |                 |
|                 |                 | > maintaining   |                 |
|                 |                 | > an entity's   |                 |
|                 |                 | > bank account  |                 |
|                 |                 | > or otherwise  |                 |
|                 |                 | > having        |                 |
|                 |                 | > custody of    |                 |
|                 |                 | > the audited   |                 |
|                 |                 | > entity's      |                 |
|                 |                 | > funds; or     |                 |
|                 |                 | > otherwise     |                 |
|                 |                 | > exercising    |                 |
|                 |                 | > authority on  |                 |
|                 |                 | > behalf of the |                 |
|                 |                 | > entity, or    |                 |
|                 |                 | > having        |                 |
|                 |                 | > authority to  |                 |
|                 |                 | > do so;^ ^     |                 |
|                 |                 | >               |                 |
|                 |                 | > **e.**        |                 |
|                 |                 | > preconceived  |                 |
|                 |                 | > ideas toward  |                 |
|                 |                 | > individuals,  |                 |
|                 |                 | > groups,       |                 |
|                 |                 | >               |                 |
|                 |                 |  organizations, |                 |
|                 |                 | > or objectives |                 |
|                 |                 | > of a          |                 |
|                 |                 | > particular    |                 |
|                 |                 | > program that  |                 |
|                 |                 | > could bias    |                 |
|                 |                 | > the audit;    |                 |
|                 |                 | >               |                 |
|                 |                 | > **f.**        |                 |
|                 |                 | > biases,       |                 |
|                 |                 | > including     |                 |
|                 |                 | > those induced |                 |
|                 |                 | > by political, |                 |
|                 |                 | > ideological,  |                 |
|                 |                 | > or social     |                 |
|                 |                 | > convictions,  |                 |
|                 |                 | > that result   |                 |
|                 |                 | > from          |                 |
|                 |                 | > employment    |                 |
|                 |                 | > in, or        |                 |
|                 |                 | > loyalty to, a |                 |
|                 |                 | > particular    |                 |
|                 |                 | > type of       |                 |
|                 |                 | > policy,       |                 |
|                 |                 | > group,        |                 |
|                 |                 | > organization, |                 |
|                 |                 | > or level of   |                 |
|                 |                 | > government;   |                 |
|                 |                 | > and           |                 |
|                 |                 | >               |                 |
|                 |                 | > **g.**        |                 |
|                 |                 | > seeking       |                 |
|                 |                 | > employment    |                 |
|                 |                 | > with an       |                 |
|                 |                 | > audited       |                 |
|                 |                 | > organization  |                 |
|                 |                 | > during the    |                 |
|                 |                 | > conduct of    |                 |
|                 |                 | > the audit     |                 |
|                 |                 |                 |                 |
|                 |                 | **3.09** When   |                 |
|                 |                 | the audit       |                 |
|                 |                 | organization    |                 |
|                 |                 | identifies a    |                 |
|                 |                 | personal        |                 |
|                 |                 | impairment to   |                 |
|                 |                 | independence,   |                 |
|                 |                 | the impairment  |                 |
|                 |                 | needs to be     |                 |
|                 |                 | resolved in a   |                 |
|                 |                 | timely manner.  |                 |
|                 |                 | In situations   |                 |
|                 |                 | in which the    |                 |
|                 |                 | personal        |                 |
|                 |                 | impairment is   |                 |
|                 |                 | applicable only |                 |
|                 |                 | to an           |                 |
|                 |                 | individual      |                 |
|                 |                 | auditor on a    |                 |
|                 |                 | particular      |                 |
|                 |                 | assignment, the |                 |
|                 |                 | audit           |                 |
|                 |                 | organization    |                 |
|                 |                 | may be able to  |                 |
|                 |                 | mitigate the    |                 |
|                 |                 | personal        |                 |
|                 |                 | impairment by   |                 |
|                 |                 | requiring the   |                 |
|                 |                 | auditor to      |                 |
|                 |                 | eliminate the   |                 |
|                 |                 | personal        |                 |
|                 |                 | impairment. For |                 |
|                 |                 | example, the    |                 |
|                 |                 | auditor could   |                 |
|                 |                 | sell a          |                 |
|                 |                 | financial       |                 |
|                 |                 | interest that   |                 |
|                 |                 | created the     |                 |
|                 |                 | personal        |                 |
|                 |                 | impairment, or  |                 |
|                 |                 | the audit       |                 |
|                 |                 | organization    |                 |
|                 |                 | could remove    |                 |
|                 |                 | that auditor    |                 |
|                 |                 | from any work   |                 |
|                 |                 | on that audit   |                 |
|                 |                 | assignment. If  |                 |
|                 |                 | the personal    |                 |
|                 |                 | impairment      |                 |
|                 |                 | cannot be       |                 |
|                 |                 | mitigated       |                 |
|                 |                 | through these   |                 |
|                 |                 | means, the      |                 |
|                 |                 | audit           |                 |
|                 |                 | organization    |                 |
|                 |                 | should withdraw |                 |
|                 |                 | from the audit. |                 |
|                 |                 | In situations   |                 |
|                 |                 | in which        |                 |
|                 |                 | government      |                 |
|                 |                 | auditors cannot |                 |
|                 |                 | withdraw from   |                 |
|                 |                 | the audit, they |                 |
|                 |                 | should follow   |                 |
|                 |                 | the requirement |                 |
|                 |                 | in paragraph    |                 |
|                 |                 | 3.05.           |                 |
+-----------------+-----------------+-----------------+-----------------+
| 1.2 What are    |                 | **3.06** In     |                 |
| your policies   |                 | using the work  |                 |
| and procedures  |                 | of a            |                 |
| to ensure       |                 | specialist,     |                 |
| specialists are |                 | auditors need   |                 |
| independent?    |                 | to consider the |                 |
| (GAGAS 3.06)    |                 | specialist as a |                 |
|                 |                 | member of the   |                 |
|                 |                 | audit team and, |                 |
|                 |                 | accordingly,    |                 |
|                 |                 | assess the      |                 |
|                 |                 | specialist's    |                 |
|                 |                 | ability to      |                 |
|                 |                 | perform the     |                 |
|                 |                 | work and report |                 |
|                 |                 | results         |                 |
|                 |                 | impartially. In |                 |
|                 |                 | conducting this |                 |
|                 |                 | assessment,     |                 |
|                 |                 | auditors should |                 |
|                 |                 | provide the     |                 |
|                 |                 | specialist with |                 |
|                 |                 | the GAGAS       |                 |
|                 |                 | independence    |                 |
|                 |                 | requirements    |                 |
|                 |                 | and obtain      |                 |
|                 |                 | representations |                 |
|                 |                 | from the        |                 |
|                 |                 | specialist      |                 |
|                 |                 | regarding the   |                 |
|                 |                 | specialist's    |                 |
|                 |                 | independence    |                 |
|                 |                 | from the        |                 |
|                 |                 | activity or     |                 |
|                 |                 | program under   |                 |
|                 |                 | audit. If the   |                 |
|                 |                 | specialist has  |                 |
|                 |                 | an impairment   |                 |
|                 |                 | to              |                 |
|                 |                 | independence,   |                 |
|                 |                 | auditors should |                 |
|                 |                 | not use the     |                 |
|                 |                 | work of that    |                 |
|                 |                 | specialist.     |                 |
+-----------------+-----------------+-----------------+-----------------+
| # Exter         |                 |                 |                 |
| nal Impairments |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 1.3 What are    |                 | **3.19**        |                 |
| your policies   |                 | Factors         |                 |
| and procedures  |                 | external to the |                 |
| for             |                 | audit           |                 |
| identifying,    |                 | organization    |                 |
| reporting, and  |                 | may restrict    |                 |
| resolving       |                 | the work or     |                 |
| external        |                 | interfere with  |                 |
| impairments?    |                 | auditors'       |                 |
| (GAGAS          |                 | ability to form |                 |
| 3.19-3.20)      |                 | independent and |                 |
|                 |                 | objective       |                 |
|                 |                 | opinions and    |                 |
|                 |                 | conclusions.    |                 |
|                 |                 | External        |                 |
|                 |                 | impairments to  |                 |
|                 |                 | independence    |                 |
|                 |                 | occur when      |                 |
|                 |                 | auditors are    |                 |
|                 |                 | deterred from   |                 |
|                 |                 | acting          |                 |
|                 |                 | objectively and |                 |
|                 |                 | exercising      |                 |
|                 |                 | professional    |                 |
|                 |                 | skepticism by   |                 |
|                 |                 | pressures,      |                 |
|                 |                 | actual or       |                 |
|                 |                 | perceived, from |                 |
|                 |                 | management and  |                 |
|                 |                 | employees of    |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity or       |                 |
|                 |                 | oversight       |                 |
|                 |                 | organizations.  |                 |
|                 |                 | For example,    |                 |
|                 |                 | under the       |                 |
|                 |                 | following       |                 |
|                 |                 | conditions,     |                 |
|                 |                 | auditors may    |                 |
|                 |                 | not have        |                 |
|                 |                 | complete        |                 |
|                 |                 | freedom to make |                 |
|                 |                 | an independent  |                 |
|                 |                 | and objective   |                 |
|                 |                 | judgment and an |                 |
|                 |                 | audit may be    |                 |
|                 |                 | adversely       |                 |
|                 |                 | affected:       |                 |
|                 |                 |                 |                 |
|                 |                 | > **a.**        |                 |
|                 |                 | > external      |                 |
|                 |                 | > interference  |                 |
|                 |                 | > or influence  |                 |
|                 |                 | > that could    |                 |
|                 |                 | > improperly or |                 |
|                 |                 | > imprudently   |                 |
|                 |                 | > limit or      |                 |
|                 |                 | > modify the    |                 |
|                 |                 | > scope of an   |                 |
|                 |                 | > audit or      |                 |
|                 |                 | > threaten to   |                 |
|                 |                 | > do so,        |                 |
|                 |                 | > including     |                 |
|                 |                 | > pressure to   |                 |
|                 |                 | > reduce        |                 |
|                 |                 | >               |                 |
|                 |                 | inappropriately |                 |
|                 |                 | > the extent of |                 |
|                 |                 | > work          |                 |
|                 |                 | > performed in  |                 |
|                 |                 | > order to      |                 |
|                 |                 | > reduce costs  |                 |
|                 |                 | > or fees;      |                 |
|                 |                 | >               |                 |
|                 |                 | > **b.**        |                 |
|                 |                 | > external      |                 |
|                 |                 | > interference  |                 |
|                 |                 | > with the      |                 |
|                 |                 | > selection or  |                 |
|                 |                 | > application   |                 |
|                 |                 | > of audit      |                 |
|                 |                 | > procedures or |                 |
|                 |                 | > in the        |                 |
|                 |                 | > selection of  |                 |
|                 |                 | > transactions  |                 |
|                 |                 | > to be         |                 |
|                 |                 | > examined;     |                 |
|                 |                 | >               |                 |
|                 |                 | > **c.**        |                 |
|                 |                 | > unreasonable  |                 |
|                 |                 | > restrictions  |                 |
|                 |                 | > on the time   |                 |
|                 |                 | > allowed to    |                 |
|                 |                 | > complete an   |                 |
|                 |                 | > audit or      |                 |
|                 |                 | > issue the     |                 |
|                 |                 | > report;       |                 |
|                 |                 | >               |                 |
|                 |                 | > **d.**        |                 |
|                 |                 | > interference  |                 |
|                 |                 | > external to   |                 |
|                 |                 | > the audit     |                 |
|                 |                 | > organization  |                 |
|                 |                 | > in the        |                 |
|                 |                 | > assignment,   |                 |
|                 |                 | > appointment,  |                 |
|                 |                 | > and promotion |                 |
|                 |                 | > of audit      |                 |
|                 |                 | > personnel;    |                 |
|                 |                 | >               |                 |
|                 |                 | > **e.**        |                 |
|                 |                 | > restrictions  |                 |
|                 |                 | > on funds or   |                 |
|                 |                 | > other         |                 |
|                 |                 | > resources     |                 |
|                 |                 | > provided to   |                 |
|                 |                 | > the audit     |                 |
|                 |                 | > organization  |                 |
|                 |                 | > that          |                 |
|                 |                 | > adversely     |                 |
|                 |                 | > affect the    |                 |
|                 |                 | > audit         |                 |
|                 |                 | >               |                 |
|                 |                 |  organization's |                 |
|                 |                 | > ability to    |                 |
|                 |                 | > carry out its |                 |
|                 |                 | > re            |                 |
|                 |                 | sponsibilities; |                 |
|                 |                 | >               |                 |
|                 |                 | > **f.**        |                 |
|                 |                 | > authority to  |                 |
|                 |                 | > overrule or   |                 |
|                 |                 | > to            |                 |
|                 |                 | >               |                 |
|                 |                 | inappropriately |                 |
|                 |                 | > influence the |                 |
|                 |                 | > auditors'     |                 |
|                 |                 | > judgment as   |                 |
|                 |                 | > to the        |                 |
|                 |                 | > appropriate   |                 |
|                 |                 | > content of    |                 |
|                 |                 | > the report;   |                 |
|                 |                 | >               |                 |
|                 |                 | > **g.** threat |                 |
|                 |                 | > of            |                 |
|                 |                 | > replacement   |                 |
|                 |                 | > over a        |                 |
|                 |                 | > disagreement  |                 |
|                 |                 | > with the      |                 |
|                 |                 | > contents of   |                 |
|                 |                 | > an audit      |                 |
|                 |                 | > report, the   |                 |
|                 |                 | > auditors'     |                 |
|                 |                 | > conclusions,  |                 |
|                 |                 | > or the        |                 |
|                 |                 | > application   |                 |
|                 |                 | > of an         |                 |
|                 |                 | > accounting    |                 |
|                 |                 | > principle or  |                 |
|                 |                 | > other         |                 |
|                 |                 | > criteria; and |                 |
|                 |                 | >               |                 |
|                 |                 | > **h.**        |                 |
|                 |                 | > influences    |                 |
|                 |                 | > that          |                 |
|                 |                 | > jeopardize    |                 |
|                 |                 | > the auditors' |                 |
|                 |                 | > continued     |                 |
|                 |                 | > employment    |                 |
|                 |                 | > for reasons   |                 |
|                 |                 | > other than    |                 |
|                 |                 | > incompetence, |                 |
|                 |                 | > misconduct,   |                 |
|                 |                 | > or the need   |                 |
|                 |                 | > for audit     |                 |
|                 |                 | > services.     |                 |
|                 |                 |                 |                 |
|                 |                 | **3.20** An     |                 |
|                 |                 | audit           |                 |
|                 |                 | organization's  |                 |
|                 |                 | internal        |                 |
|                 |                 | quality control |                 |
|                 |                 | system for      |                 |
|                 |                 | compliance with |                 |
|                 |                 | GAGAS           |                 |
|                 |                 | independence    |                 |
|                 |                 | requirements,   |                 |
|                 |                 | as stated in    |                 |
|                 |                 | paragraph 3.08, |                 |
|                 |                 | should include  |                 |
|                 |                 | internal        |                 |
|                 |                 | policies and    |                 |
|                 |                 | procedures for  |                 |
|                 |                 | reporting and   |                 |
|                 |                 | resolving       |                 |
|                 |                 | external        |                 |
|                 |                 | impairments     |                 |
+-----------------+-----------------+-----------------+-----------------+
| # Organizatio   |                 |                 |                 |
| nal Impairments |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 1.4 What are    |                 | **3.32** The    |                 |
| your policies   |                 | audit           |                 |
| and procedures  |                 | organization    |                 |
| for ensuring    |                 | should document |                 |
| the OIG is      |                 | the conditions  |                 |
| considered free |                 | that allow it   |                 |
| from            |                 | to be           |                 |
| organizational  |                 | considered free |                 |
| impairments?    |                 | of              |                 |
| Provide         |                 | organizational  |                 |
| documentation   |                 | impairments to  |                 |
| which allows    |                 | independence to |                 |
| the audit       |                 | report          |                 |
| organization to |                 | internally.     |                 |
| be considered   |                 | Those           |                 |
| free of         |                 | conditions      |                 |
| organizational  |                 | should be       |                 |
| impairments     |                 | reviewed during |                 |
| (GAGAS          |                 | the peer review |                 |
| 3.21-3.31;      |                 | to ensure that  |                 |
| 3.32)           |                 | all the         |                 |
|                 |                 | necessary       |                 |
|                 |                 | safeguards have |                 |
|                 |                 | been met.       |                 |
+-----------------+-----------------+-----------------+-----------------+
| 1.5 What are    |                 | **3.17** Audit  |                 |
| your policies   |                 | organizations   |                 |
| and procedures  |                 | may perform     |                 |
| for ensuring    |                 | nonaudit        |                 |
| nonaudit        |                 | services that   |                 |
| services do not |                 | do not violate  |                 |
| impair          |                 | the principles  |                 |
| independence?   |                 | stated in       |                 |
| (GAGAS 3.17     |                 | paragraph 3.13  |                 |
| a-e)            |                 | only if the     |                 |
|                 |                 | audit           |                 |
|                 |                 | organization    |                 |
|                 |                 | and the audited |                 |
|                 |                 | entity comply   |                 |
|                 |                 | with the        |                 |
|                 |                 | following       |                 |
|                 |                 | safeguards.     |                 |
|                 |                 | These           |                 |
|                 |                 | safeguards      |                 |
|                 |                 | would not apply |                 |
|                 |                 | in connection   |                 |
|                 |                 | with the type   |                 |
|                 |                 | of routine      |                 |
|                 |                 | activities      |                 |
|                 |                 | described in    |                 |
|                 |                 | paragraph 3.15. |                 |
|                 |                 | The intent in   |                 |
|                 |                 | this paragraph  |                 |
|                 |                 | is not for the  |                 |
|                 |                 | audit           |                 |
|                 |                 | organization to |                 |
|                 |                 | apply these     |                 |
|                 |                 | safeguards to   |                 |
|                 |                 | every           |                 |
|                 |                 | interaction it  |                 |
|                 |                 | has with        |                 |
|                 |                 | management.     |                 |
|                 |                 |                 |                 |
|                 |                 | > **a**. The    |                 |
|                 |                 | > audit         |                 |
|                 |                 | > organization  |                 |
|                 |                 | > should        |                 |
|                 |                 | > document its  |                 |
|                 |                 | > consideration |                 |
|                 |                 | > of the        |                 |
|                 |                 | > nonaudit      |                 |
|                 |                 | > services as   |                 |
|                 |                 | > discussed in  |                 |
|                 |                 | > paragraph     |                 |
|                 |                 | > 3.13,         |                 |
|                 |                 | > including     |                 |
|                 |                 | > documentation |                 |
|                 |                 | > for its       |                 |
|                 |                 | > rationale     |                 |
|                 |                 | > that          |                 |
|                 |                 | > providing the |                 |
|                 |                 | > nonaudit      |                 |
|                 |                 | > services does |                 |
|                 |                 | > not violate   |                 |
|                 |                 | > the two       |                 |
|                 |                 | > overarching   |                 |
|                 |                 | > principles.   |                 |
|                 |                 | >               |                 |
|                 |                 | > **b.** Before |                 |
|                 |                 | > performing    |                 |
|                 |                 | > nonaudit      |                 |
|                 |                 | > services, the |                 |
|                 |                 | > audit         |                 |
|                 |                 | > organization  |                 |
|                 |                 | > should        |                 |
|                 |                 | > establish and |                 |
|                 |                 | > document an   |                 |
|                 |                 | > understanding |                 |
|                 |                 | > with the      |                 |
|                 |                 | > audited       |                 |
|                 |                 | > entity        |                 |
|                 |                 | > regarding the |                 |
|                 |                 | > objectives,   |                 |
|                 |                 | > scope of      |                 |
|                 |                 | > work, and     |                 |
|                 |                 | > product or    |                 |
|                 |                 | > deliverables  |                 |
|                 |                 | > of the        |                 |
|                 |                 | > nonaudit      |                 |
|                 |                 | > service. The  |                 |
|                 |                 | > audit         |                 |
|                 |                 | > organization  |                 |
|                 |                 | > should also   |                 |
|                 |                 | > establish and |                 |
|                 |                 | > document an   |                 |
|                 |                 | > understanding |                 |
|                 |                 | > with          |                 |
|                 |                 | > management    |                 |
|                 |                 | > that (1)      |                 |
|                 |                 | > management is |                 |
|                 |                 | > responsible   |                 |
|                 |                 | > for the       |                 |
|                 |                 | > substantive   |                 |
|                 |                 | > outcomes of   |                 |
|                 |                 | > the work and, |                 |
|                 |                 | > therefore,    |                 |
|                 |                 | > has a         |                 |
|                 |                 | >               |                 |
|                 |                 |  responsibility |                 |
|                 |                 | > to be in a    |                 |
|                 |                 | > position in   |                 |
|                 |                 | > fact and      |                 |
|                 |                 | > appearance to |                 |
|                 |                 | > make an       |                 |
|                 |                 | > informed      |                 |
|                 |                 | > judgment on   |                 |
|                 |                 | > the results   |                 |
|                 |                 | > of the        |                 |
|                 |                 | > nonaudit      |                 |
|                 |                 | > service and   |                 |
|                 |                 | > (2) the       |                 |
|                 |                 | > audited       |                 |
|                 |                 | > entity        |                 |
|                 |                 | > complies with |                 |
|                 |                 | > the           |                 |
|                 |                 | > following:    |                 |
|                 |                 | >               |                 |
|                 |                 | > **1.**        |                 |
|                 |                 | > designates a  |                 |
|                 |                 | > m             |                 |
|                 |                 | anagement-level |                 |
|                 |                 | > individual to |                 |
|                 |                 | > be            |                 |
|                 |                 | > responsible   |                 |
|                 |                 | > and           |                 |
|                 |                 | > accountable   |                 |
|                 |                 | > for           |                 |
|                 |                 | > overseeing    |                 |
|                 |                 | > the nonaudit  |                 |
|                 |                 | > service,      |                 |
|                 |                 | >               |                 |
|                 |                 | > **2.**        |                 |
|                 |                 | > establishes   |                 |
|                 |                 | > and monitors  |                 |
|                 |                 | > the           |                 |
|                 |                 | > performance   |                 |
|                 |                 | > of the        |                 |
|                 |                 | > nonaudit      |                 |
|                 |                 | > service to    |                 |
|                 |                 | > ensure that   |                 |
|                 |                 | > it meets      |                 |
|                 |                 | > management's  |                 |
|                 |                 | > objectives,   |                 |
|                 |                 | >               |                 |
|                 |                 | > **3.** makes  |                 |
|                 |                 | > any decisions |                 |
|                 |                 | > that involve  |                 |
|                 |                 | > management    |                 |
|                 |                 | > functions     |                 |
|                 |                 | > related to    |                 |
|                 |                 | > the nonaudit  |                 |
|                 |                 | > service and   |                 |
|                 |                 | > accepts full  |                 |
|                 |                 | >               |                 |
|                 |                 |  responsibility |                 |
|                 |                 | > for such      |                 |
|                 |                 | > decisions,    |                 |
|                 |                 | > and           |                 |
|                 |                 | >               |                 |
|                 |                 | > **4.**        |                 |
|                 |                 | > evaluates the |                 |
|                 |                 | > adequacy of   |                 |
|                 |                 | > the services  |                 |
|                 |                 | > performed and |                 |
|                 |                 | > any findings  |                 |
|                 |                 | > that result.  |                 |
|                 |                 | >               |                 |
|                 |                 | > **c.** The    |                 |
|                 |                 | > audit         |                 |
|                 |                 | > organization  |                 |
|                 |                 | > should        |                 |
|                 |                 | > preclude      |                 |
|                 |                 | > personnel who |                 |
|                 |                 | > provided the  |                 |
|                 |                 | > nonaudit      |                 |
|                 |                 | > services from |                 |
|                 |                 | > planning,     |                 |
|                 |                 | > conducting,   |                 |
|                 |                 | > or reviewing  |                 |
|                 |                 | > audit work of |                 |
|                 |                 | > subject       |                 |
|                 |                 | > matter        |                 |
|                 |                 | > involving the |                 |
|                 |                 | > nonaudit      |                 |
|                 |                 | > service under |                 |
|                 |                 | > the           |                 |
|                 |                 | > overarching   |                 |
|                 |                 | > principle     |                 |
|                 |                 | > that auditors |                 |
|                 |                 | > cannot audit  |                 |
|                 |                 | > their own     |                 |
|                 |                 | > work.^ ^      |                 |
|                 |                 | >               |                 |
|                 |                 | > **d.** The    |                 |
|                 |                 | > audit         |                 |
|                 |                 | > organization  |                 |
|                 |                 | > is precluded  |                 |
|                 |                 | > from reducing |                 |
|                 |                 | > the scope and |                 |
|                 |                 | > extent of the |                 |
|                 |                 | > audit work    |                 |
|                 |                 | > below the     |                 |
|                 |                 | > level that    |                 |
|                 |                 | > would be      |                 |
|                 |                 | > appropriate   |                 |
|                 |                 | > if the        |                 |
|                 |                 | > nonaudit work |                 |
|                 |                 | > were          |                 |
|                 |                 | > performed by  |                 |
|                 |                 | > an unrelated  |                 |
|                 |                 | > party.        |                 |
|                 |                 | >               |                 |
|                 |                 | > **e.** The    |                 |
|                 |                 | > audit         |                 |
|                 |                 | >               |                 |
|                 |                 |  organization's |                 |
|                 |                 | > quality       |                 |
|                 |                 | > control       |                 |
|                 |                 | > systems for   |                 |
|                 |                 | > compliance    |                 |
|                 |                 | > with          |                 |
|                 |                 | > independence  |                 |
|                 |                 | > requirements  |                 |
|                 |                 | > should        |                 |
|                 |                 | > include: (1)  |                 |
|                 |                 | > policies and  |                 |
|                 |                 | > procedures to |                 |
|                 |                 | > assure        |                 |
|                 |                 | > consideration |                 |
|                 |                 | > of the effect |                 |
|                 |                 | > on the        |                 |
|                 |                 | > ongoing,      |                 |
|                 |                 | > planned, and  |                 |
|                 |                 | > future audits |                 |
|                 |                 | > when deciding |                 |
|                 |                 | > whether to    |                 |
|                 |                 | > provide       |                 |
|                 |                 | > nonaudit      |                 |
|                 |                 | > services, and |                 |
|                 |                 | > (2) a         |                 |
|                 |                 | > requirement   |                 |
|                 |                 | > to have the   |                 |
|                 |                 | > understanding |                 |
|                 |                 | > with          |                 |
|                 |                 | > management of |                 |
|                 |                 | > the audited   |                 |
|                 |                 | > entity        |                 |
|                 |                 | > documented.   |                 |
|                 |                 | > The           |                 |
|                 |                 | > understanding |                 |
|                 |                 | > should be     |                 |
|                 |                 | > communicated  |                 |
|                 |                 | > to management |                 |
|                 |                 | > in writing    |                 |
|                 |                 | > and can be    |                 |
|                 |                 | > included in   |                 |
|                 |                 | > the           |                 |
|                 |                 | > engagement    |                 |
|                 |                 | > letter. In    |                 |
|                 |                 | > addition, the |                 |
|                 |                 | > documentation |                 |
|                 |                 | > should        |                 |
|                 |                 | > specifically  |                 |
|                 |                 | > identify      |                 |
|                 |                 | > management's  |                 |
|                 |                 | > compliance    |                 |
|                 |                 | > with the      |                 |
|                 |                 | > elements      |                 |
|                 |                 | > discussed in  |                 |
|                 |                 | > paragraph     |                 |
|                 |                 | > 3.17b,        |                 |
|                 |                 | > including     |                 |
|                 |                 | > evidence of   |                 |
|                 |                 | > the           |                 |
|                 |                 | > m             |                 |
|                 |                 | anagement-level |                 |
|                 |                 | > individual    |                 |
|                 |                 | > responsible   |                 |
|                 |                 | > for           |                 |
|                 |                 | > overseeing    |                 |
|                 |                 | > the nonaudit  |                 |
|                 |                 | > service's     |                 |
|                 |                 | >               |                 |
|                 |                 |  qualifications |                 |
|                 |                 | > to conduct    |                 |
|                 |                 | > the required  |                 |
|                 |                 | > oversight and |                 |
|                 |                 | > that the      |                 |
|                 |                 | > tasks         |                 |
|                 |                 | > required of   |                 |
|                 |                 | > management    |                 |
|                 |                 | > were          |                 |
|                 |                 | > performed.    |                 |
+-----------------+-----------------+-----------------+-----------------+
|                 |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **2.            |                 | **3.40** This   |                 |
| [COMPETENCE     |                 | standard places |                 |
| ]{.underline}** |                 | responsibility  |                 |
|                 |                 | on audit        |                 |
| **Staffing**    |                 | organizations   |                 |
|                 |                 | to ensure that  |                 |
| 2.1 What are    |                 | each audit or   |                 |
| your policies   |                 | attestation     |                 |
| and procedures  |                 | engagement is   |                 |
| to ensure that  |                 | performed by    |                 |
| staff members   |                 | staff who       |                 |
| who conduct     |                 | collectively    |                 |
| audit and       |                 | have the        |                 |
| attestation     |                 | knowledge,      |                 |
| engagements     |                 | skills, and     |                 |
| fulfill the     |                 | experience      |                 |
| competence      |                 | necessary for   |                 |
| standard?       |                 | that            |                 |
| Include         |                 | assignment.     |                 |
| references to   |                 | Accordingly,    |                 |
| your agency\'s  |                 | audit           |                 |
| established     |                 | organizations   |                 |
| hiring          |                 | should have a   |                 |
| policies,       |                 | process for     |                 |
| policies and    |                 | recruitment,    |                 |
| procedures for  |                 | hiring,         |                 |
| assigning staff |                 | continuous      |                 |
| to audits and   |                 | development,    |                 |
| attestation     |                 | and evaluation  |                 |
| engagements,    |                 | of staff to     |                 |
| staff           |                 | assist the      |                 |
| appraisals, and |                 | organization in |                 |
| other relevant  |                 | maintaining a   |                 |
| policies and    |                 | workforce that  |                 |
| procedures.     |                 | has adequate    |                 |
| (GAGAS 3.40 and |                 | competence. The |                 |
| 3.42)           |                 | nature, extent, |                 |
|                 |                 | and formality   |                 |
|                 |                 | of the process  |                 |
|                 |                 | will depend on  |                 |
|                 |                 | various factors |                 |
|                 |                 | such as the     |                 |
|                 |                 | size of the     |                 |
|                 |                 | audit           |                 |
|                 |                 | organization,   |                 |
|                 |                 | its work, and   |                 |
|                 |                 | its structure.  |                 |
|                 |                 |                 |                 |
|                 |                 | **3.42** Audit  |                 |
|                 |                 | organizations   |                 |
|                 |                 | should ensure   |                 |
|                 |                 | that staff      |                 |
|                 |                 | members         |                 |
|                 |                 | assigned to     |                 |
|                 |                 | conduct an      |                 |
|                 |                 | audit or        |                 |
|                 |                 | attestation     |                 |
|                 |                 | engagement      |                 |
|                 |                 | under GAGAS     |                 |
|                 |                 | should          |                 |
|                 |                 | collectively    |                 |
|                 |                 | possess the     |                 |
|                 |                 | technical       |                 |
|                 |                 | knowledge,      |                 |
|                 |                 | skills, and     |                 |
|                 |                 | experience      |                 |
|                 |                 | necessary to be |                 |
|                 |                 | competent for   |                 |
|                 |                 | the type of     |                 |
|                 |                 | work being      |                 |
|                 |                 | performed       |                 |
|                 |                 | before          |                 |
|                 |                 | beginning work  |                 |
|                 |                 | on that         |                 |
|                 |                 | assignment.     |                 |
|                 |                 | Staff members   |                 |
|                 |                 | should          |                 |
|                 |                 | collectively    |                 |
|                 |                 | possess.        |                 |
|                 |                 |                 |                 |
|                 |                 | > **a.**        |                 |
|                 |                 | > knowledge of  |                 |
|                 |                 | > GAGAS         |                 |
|                 |                 | > applicable to |                 |
|                 |                 | > the type of   |                 |
|                 |                 | > work they are |                 |
|                 |                 | > assigned and  |                 |
|                 |                 | > the           |                 |
|                 |                 | > education,    |                 |
|                 |                 | > skills, and   |                 |
|                 |                 | > experience to |                 |
|                 |                 | > apply such    |                 |
|                 |                 | > knowledge to  |                 |
|                 |                 | > the work      |                 |
|                 |                 | > being         |                 |
|                 |                 | > performed;    |                 |
|                 |                 | >               |                 |
|                 |                 | > **b.**        |                 |
|                 |                 | > general       |                 |
|                 |                 | > knowledge of  |                 |
|                 |                 | > the           |                 |
|                 |                 | > environment   |                 |
|                 |                 | > in which the  |                 |
|                 |                 | > audited       |                 |
|                 |                 | > entity        |                 |
|                 |                 | > operates and  |                 |
|                 |                 | > the subject   |                 |
|                 |                 | > matter under  |                 |
|                 |                 | > review;       |                 |
|                 |                 | >               |                 |
|                 |                 | > **c.** skills |                 |
|                 |                 | > to            |                 |
|                 |                 | > communicate   |                 |
|                 |                 | > clearly and   |                 |
|                 |                 | > effectively,  |                 |
|                 |                 | > both orally   |                 |
|                 |                 | > and in        |                 |
|                 |                 | > writing; and  |                 |
|                 |                 | >               |                 |
|                 |                 | > **d.** skills |                 |
|                 |                 | > appropriate   |                 |
|                 |                 | > for the work  |                 |
|                 |                 | > being         |                 |
|                 |                 | > performed.    |                 |
|                 |                 | > For example:  |                 |
|                 |                 | >               |                 |
|                 |                 | > **(1)** if    |                 |
|                 |                 | > the work      |                 |
|                 |                 | > requires use  |                 |
|                 |                 | > of            |                 |
|                 |                 | > statistical   |                 |
|                 |                 | > sampling, the |                 |
|                 |                 | > staff or      |                 |
|                 |                 | > specialists   |                 |
|                 |                 | > should        |                 |
|                 |                 | > include       |                 |
|                 |                 | > persons with  |                 |
|                 |                 | > statistical   |                 |
|                 |                 | > sampling      |                 |
|                 |                 | > skills;       |                 |
|                 |                 | >               |                 |
|                 |                 | > **(2)** if    |                 |
|                 |                 | > the work      |                 |
|                 |                 | > requires      |                 |
|                 |                 | > extensive     |                 |
|                 |                 | > review of     |                 |
|                 |                 | > information   |                 |
|                 |                 | > systems, the  |                 |
|                 |                 | > staff or      |                 |
|                 |                 | > specialists   |                 |
|                 |                 | > should        |                 |
|                 |                 | > include       |                 |
|                 |                 | > persons with  |                 |
|                 |                 | > information   |                 |
|                 |                 | > technology    |                 |
|                 |                 | > skills;       |                 |
|                 |                 | >               |                 |
|                 |                 | > **(3)** if    |                 |
|                 |                 | > the work      |                 |
|                 |                 | > involves      |                 |
|                 |                 | > review of     |                 |
|                 |                 | > complex       |                 |
|                 |                 | > engineering   |                 |
|                 |                 | > data, the     |                 |
|                 |                 | > staff or      |                 |
|                 |                 | > specialists   |                 |
|                 |                 | > should        |                 |
|                 |                 | > include       |                 |
|                 |                 | > persons with  |                 |
|                 |                 | > engineering   |                 |
|                 |                 | > skills; or    |                 |
|                 |                 | >               |                 |
|                 |                 | > **(4)** if    |                 |
|                 |                 | > the work      |                 |
|                 |                 | > involves the  |                 |
|                 |                 | > use of        |                 |
|                 |                 | > specialized   |                 |
|                 |                 | > audit         |                 |
|                 |                 | > methodologies |                 |
|                 |                 | > or analytical |                 |
|                 |                 | > techniques,   |                 |
|                 |                 | > such as the   |                 |
|                 |                 | > use of        |                 |
|                 |                 | > complex       |                 |
|                 |                 | > survey        |                 |
|                 |                 | > instruments,  |                 |
|                 |                 | >               |                 |
|                 |                 | actuarial-based |                 |
|                 |                 | > estimates, or |                 |
|                 |                 | > statistical   |                 |
|                 |                 | > analysis      |                 |
|                 |                 | > tests, the    |                 |
|                 |                 | > staff or      |                 |
|                 |                 | > specialists   |                 |
|                 |                 | > should        |                 |
|                 |                 | > include       |                 |
|                 |                 | > persons with  |                 |
|                 |                 | > skills in     |                 |
|                 |                 | > those         |                 |
|                 |                 | > methodologies |                 |
|                 |                 | > or            |                 |
|                 |                 | > techniques.   |                 |
+-----------------+-----------------+-----------------+-----------------+
| 2.2 What are    |                 | **3.41** The    |                 |
| your policies   |                 | competencies    |                 |
| and procedures  |                 | discussed below |                 |
| to determine    |                 | apply to the    |                 |
| whether         |                 | knowledge,      |                 |
| specialists     |                 | skills, and     |                 |
| hired to        |                 | experience of   |                 |
| perform audits  |                 | audit           |                 |
| have the        |                 | organizations   |                 |
| knowledge,      |                 | and not         |                 |
| skills, and     |                 | necessarily to  |                 |
| experience      |                 | each individual |                 |
| needed to       |                 | auditor. An     |                 |
| perform the     |                 | audit           |                 |
| required task   |                 | organization    |                 |
| (e.g., a        |                 | may need to     |                 |
| procedure for   |                 | employ          |                 |
| reviewing       |                 | personnel or    |                 |
| specialists'    |                 | hire            |                 |
| education,      |                 | specialists who |                 |
| experience, or  |                 | are             |                 |
| performance     |                 | knowledgeable,  |                 |
| before hiring   |                 | skilled, or     |                 |
| decisions are   |                 | experienced in  |                 |
| made)? (GAGAS   |                 | such areas as   |                 |
| 3.41, 3.48)     |                 | accounting,     |                 |
|                 |                 | statistics,     |                 |
|                 |                 | law,            |                 |
|                 |                 | engineering,    |                 |
|                 |                 | audit design    |                 |
|                 |                 | and             |                 |
|                 |                 | methodology,    |                 |
|                 |                 | information     |                 |
|                 |                 | technology,     |                 |
|                 |                 | public          |                 |
|                 |                 | administration, |                 |
|                 |                 | economics,      |                 |
|                 |                 | social          |                 |
|                 |                 | sciences, or    |                 |
|                 |                 | actuarial       |                 |
|                 |                 | science.        |                 |
|                 |                 |                 |                 |
|                 |                 | **3.48**        |                 |
|                 |                 | External and    |                 |
|                 |                 | internal        |                 |
|                 |                 | specialists     |                 |
|                 |                 | assisting in    |                 |
|                 |                 | performing a    |                 |
|                 |                 | GAGAS           |                 |
|                 |                 | assignment      |                 |
|                 |                 | should be       |                 |
|                 |                 | qualified and   |                 |
|                 |                 | should maintain |                 |
|                 |                 | professional    |                 |
|                 |                 | competence in   |                 |
|                 |                 | their areas of  |                 |
|                 |                 | specialization  |                 |
|                 |                 | but are not     |                 |
|                 |                 | required to     |                 |
|                 |                 | meet the CPE    |                 |
|                 |                 | requirements    |                 |
|                 |                 | described here. |                 |
|                 |                 | However,        |                 |
|                 |                 | auditors who    |                 |
|                 |                 | use the work of |                 |
|                 |                 | external and    |                 |
|                 |                 | internal        |                 |
|                 |                 | specialists     |                 |
|                 |                 | should ensure   |                 |
|                 |                 | that such       |                 |
|                 |                 | specialists are |                 |
|                 |                 | qualified in    |                 |
|                 |                 | their areas of  |                 |
|                 |                 | specialization  |                 |
|                 |                 | and should      |                 |
|                 |                 | document such   |                 |
|                 |                 | assurance.      |                 |
+-----------------+-----------------+-----------------+-----------------+
| 2.3 What are    |                 | **3.44**        |                 |
| your polices    |                 | Auditors        |                 |
| and procedures  |                 | engaged to      |                 |
| to ensure that  |                 | perform         |                 |
| auditors        |                 | financial       |                 |
| engaged to      |                 | audits or       |                 |
| perform         |                 | attestation     |                 |
| financial       |                 | engagements     |                 |
| audits or       |                 | should be       |                 |
| attestation     |                 | licensed        |                 |
| engagements are |                 | certified       |                 |
| licensed        |                 | public          |                 |
| certified       |                 | accountants or  |                 |
| public          |                 | persons working |                 |
| accountants or  |                 | for a licensed  |                 |
| persons working |                 | certified       |                 |
| for a licensed  |                 | public          |                 |
| certified       |                 | accounting firm |                 |
| public          |                 | or a government |                 |
| accounting firm |                 | auditing        |                 |
| or a Government |                 | organization.   |                 |
| auditing        |                 | Public          |                 |
| organization?   |                 | accountants and |                 |
| (GAGAS 3.44)    |                 | accounting      |                 |
|                 |                 | firms meeting   |                 |
|                 |                 | licensing       |                 |
|                 |                 | requirements    |                 |
|                 |                 | should also     |                 |
|                 |                 | comply with the |                 |
|                 |                 | applicable      |                 |
|                 |                 | provisions of   |                 |
|                 |                 | the public      |                 |
|                 |                 | accountancy law |                 |
|                 |                 | and rules of    |                 |
|                 |                 | the             |                 |
|                 |                 | jurisdiction(s) |                 |
|                 |                 | where the audit |                 |
|                 |                 | is being        |                 |
|                 |                 | performed and   |                 |
|                 |                 | the             |                 |
|                 |                 | jurisdiction(s) |                 |
|                 |                 | in which the    |                 |
|                 |                 | public          |                 |
|                 |                 | accountants and |                 |
|                 |                 | their firms are |                 |
|                 |                 | licensed.       |                 |
+-----------------+-----------------+-----------------+-----------------+
| **Continuing    |                 | **3.45**        |                 |
| Education and   |                 | Auditors        |                 |
| Training**      |                 | performing work |                 |
|                 |                 | under GAGAS,    |                 |
| 2.4 What are    |                 | including       |                 |
| your policies   |                 | planning,       |                 |
| and procedures  |                 | directing,      |                 |
| for ensuring    |                 | performing      |                 |
| that the        |                 | field work, or  |                 |
| continuing      |                 | reporting on an |                 |
| education and   |                 | audit or        |                 |
| training        |                 | attestation     |                 |
| requirements    |                 | engagement      |                 |
| for your        |                 | under GAGAS,    |                 |
| agency\'s audit |                 | need to         |                 |
| staff are met?  |                 | maintain their  |                 |
| (GAGAS          |                 | professional    |                 |
| 3.45-3.47)      |                 | competence      |                 |
|                 |                 | through         |                 |
|                 |                 | continuing      |                 |
|                 |                 | professional    |                 |
|                 |                 | education       |                 |
|                 |                 | (CPE).          |                 |
|                 |                 | Therefore, each |                 |
|                 |                 | auditor         |                 |
|                 |                 | performing work |                 |
|                 |                 | under GAGAS     |                 |
|                 |                 | should          |                 |
|                 |                 | complete, every |                 |
|                 |                 | 2 years, at     |                 |
|                 |                 | least 80 hours  |                 |
|                 |                 | of CPE that     |                 |
|                 |                 | directly        |                 |
|                 |                 | enhance the     |                 |
|                 |                 | auditor's       |                 |
|                 |                 | professional    |                 |
|                 |                 | proficiency to  |                 |
|                 |                 | perform audits  |                 |
|                 |                 | and/or          |                 |
|                 |                 | attestation     |                 |
|                 |                 | en              |                 |
|                 |                 | gagements.^ ^At |                 |
|                 |                 | least 24 of the |                 |
|                 |                 | 80 hours of CPE |                 |
|                 |                 | should be in    |                 |
|                 |                 | subjects        |                 |
|                 |                 | directly        |                 |
|                 |                 | related to      |                 |
|                 |                 | government      |                 |
|                 |                 | auditing, the   |                 |
|                 |                 | government      |                 |
|                 |                 | environment, or |                 |
|                 |                 | the specific or |                 |
|                 |                 | unique          |                 |
|                 |                 | environment in  |                 |
|                 |                 | which the       |                 |
|                 |                 | audited entity  |                 |
|                 |                 | operates.^ ^At  |                 |
|                 |                 | least 20 hours  |                 |
|                 |                 | of the 80       |                 |
|                 |                 | should be       |                 |
|                 |                 | completed in    |                 |
|                 |                 | any 1 year of   |                 |
|                 |                 | the 2-year      |                 |
|                 |                 | period.         |                 |
|                 |                 |                 |                 |
|                 |                 | **3.47** The    |                 |
|                 |                 | audit           |                 |
|                 |                 | organization is |                 |
|                 |                 | responsible for |                 |
|                 |                 | ensuring that   |                 |
|                 |                 | auditors meet   |                 |
|                 |                 | the continuing  |                 |
|                 |                 | education       |                 |
|                 |                 | requirements    |                 |
|                 |                 | and should      |                 |
|                 |                 | maintain        |                 |
|                 |                 | documentation   |                 |
|                 |                 | of the CPE      |                 |
|                 |                 | completed. The  |                 |
|                 |                 | U.S. Government |                 |
|                 |                 | Accountability  |                 |
|                 |                 | Office (GAO)    |                 |
|                 |                 | has developed   |                 |
|                 |                 | guidance        |                 |
|                 |                 | pertaining to   |                 |
|                 |                 | CPE             |                 |
|                 |                 | requirements to |                 |
|                 |                 | assist auditors |                 |
|                 |                 | and audit       |                 |
|                 |                 | organizations   |                 |
|                 |                 | in exercising   |                 |
|                 |                 | professional    |                 |
|                 |                 | judgment in     |                 |
|                 |                 | complying with  |                 |
|                 |                 | the CPE         |                 |
|                 |                 | requirements.   |                 |
+-----------------+-----------------+-----------------+-----------------+
|                 |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **3.            |                 |                 |                 |
| [PROFESSIONAL   |                 |                 |                 |
| JUDGEMENT       |                 |                 |                 |
| ]{.underline}** |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 3.1 What are    |                 | **3.34** This   |                 |
| your policies   |                 | standard        |                 |
| and procedures  |                 | requires        |                 |
| for requiring   |                 | auditors to     |                 |
| staff to follow |                 | exercise        |                 |
| all applicable  |                 | reasonable care |                 |
| standards in    |                 | and diligence   |                 |
| conducting      |                 | and to observe  |                 |
| audits and      |                 | the principles  |                 |
| attestation     |                 | of serving the  |                 |
| engagements?    |                 | public interest |                 |
| How are         |                 | and maintaining |                 |
| departures from |                 | the highest     |                 |
| GAGAS           |                 | degree of       |                 |
| justified?      |                 | integrity,      |                 |
| (GAGAS 3.34)    |                 | objectivity,    |                 |
|                 |                 | and             |                 |
|                 |                 | independence in |                 |
|                 |                 | applying        |                 |
|                 |                 | professional    |                 |
|                 |                 | judgment to all |                 |
|                 |                 | aspects of      |                 |
|                 |                 | their work.     |                 |
|                 |                 | This standard   |                 |
|                 |                 | also imposes a  |                 |
|                 |                 | responsibility  |                 |
|                 |                 | upon each       |                 |
|                 |                 | auditor         |                 |
|                 |                 | performing work |                 |
|                 |                 | under GAGAS to  |                 |
|                 |                 | observe GAGAS.  |                 |
|                 |                 | If auditors     |                 |
|                 |                 | state they are  |                 |
|                 |                 | performing      |                 |
|                 |                 | their work in   |                 |
|                 |                 | accordance with |                 |
|                 |                 | GAGAS, they     |                 |
|                 |                 | should justify  |                 |
|                 |                 | any departures  |                 |
|                 |                 | from GAGAS.     |                 |
+-----------------+-----------------+-----------------+-----------------+
| 2.              |                 | **3.37**        |                 |
|                 |                 | Auditors        |                 |
| 3.              |                 | neither assume  |                 |
|                 |                 | that management |                 |
| 4.  What are    |                 | is dishonest    |                 |
|     your        |                 | nor assume      |                 |
|     policies    |                 | unquestioned    |                 |
|     and         |                 | honesty. In     |                 |
|     procedures  |                 | exercising      |                 |
|     for         |                 | professional    |                 |
|     handling    |                 | skepticism,     |                 |
|     situations  |                 | auditors should |                 |
|     in which a  |                 | not be          |                 |
|     standard is |                 | satisfied with  |                 |
|     not         |                 | less than       |                 |
|     applicable  |                 | persuasive      |                 |
|     to a        |                 | evidence        |                 |
|     particular  |                 | because of a    |                 |
|     audit or    |                 | belief that     |                 |
|     will not be |                 | management is   |                 |
|     followed    |                 | honest.         |                 |
|     for a       |                 |                 |                 |
|     particular  |                 |                 |                 |
|     audit (s)?  |                 |                 |                 |
|     Please      |                 |                 |                 |
|     describe    |                 |                 |                 |
|     who makes   |                 |                 |                 |
|     the         |                 |                 |                 |
|     decision    |                 |                 |                 |
|     that a      |                 |                 |                 |
|     standard in |                 |                 |                 |
|     not         |                 |                 |                 |
|     applicable, |                 |                 |                 |
|     whether the |                 |                 |                 |
|     decision is |                 |                 |                 |
|     reviewed,   |                 |                 |                 |
|     and whether |                 |                 |                 |
|     the OIG has |                 |                 |                 |
|     any         |                 |                 |                 |
|     guidance    |                 |                 |                 |
|     for         |                 |                 |                 |
|     handling    |                 |                 |                 |
|     such        |                 |                 |                 |
|     situations. |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 5.  What are    |                 |                 |                 |
|     your        |                 |                 |                 |
|     procedures  |                 |                 |                 |
|     for         |                 |                 |                 |
|     disclosing  |                 |                 |                 |
|     that one or |                 |                 |                 |
|     more        |                 |                 |                 |
|     standards   |                 |                 |                 |
|     were not    |                 |                 |                 |
|     followed in |                 |                 |                 |
|     the scope   |                 |                 |                 |
|     section of  |                 |                 |                 |
|     the report  |                 |                 |                 |
|     including   |                 |                 |                 |
|     reasons why |                 |                 |                 |
|     and any     |                 |                 |                 |
|     known       |                 |                 |                 |
|     effect of   |                 |                 |                 |
|     not         |                 |                 |                 |
|     following   |                 |                 |                 |
|     the         |                 |                 |                 |
|                 |                 |                 |                 |
|   standards(s)? |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 6.  Do the OIG  |                 |                 |                 |
|     policies    |                 |                 |                 |
|     and         |                 |                 |                 |
|     procedures  |                 |                 |                 |
|     require     |                 |                 |                 |
|     that the    |                 |                 |                 |
|                 |                 |                 |                 |
|   determination |                 |                 |                 |
|     be          |                 |                 |                 |
|     documented  |                 |                 |                 |
|     in the      |                 |                 |                 |
|     audit       |                 |                 |                 |
|                 |                 |                 |                 |
|   documentation |                 |                 |                 |
|     that        |                 |                 |                 |
|     certain     |                 |                 |                 |
|     standards   |                 |                 |                 |
|     do not      |                 |                 |                 |
|     apply to an |                 |                 |                 |
|     audit?      |                 |                 |                 |
|     (GAGAS      |                 |                 |                 |
|     3.37-.38)   |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
|                 |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **4.**          |                 |                 |                 |
| **[QUALITY      |                 |                 |                 |
| CONTROL AND     |                 |                 |                 |
| ASSURANCE       |                 |                 |                 |
| ]{.underline}** |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 4.1 What are    |                 | **3.50** An     |                 |
| your policies   |                 | audit           |                 |
| and procedures  |                 | organization's  |                 |
| to ensure       |                 | system of       |                 |
| monitoring of   |                 | quality control |                 |
| quality         |                 | encompasses the |                 |
| control, on an  |                 | audit           |                 |
| ongoing basis?  |                 | organization's  |                 |
| (GAGAS 3.50;    |                 | structure and   |                 |
| PCIE/ECIE       |                 | the policies    |                 |
| Quality         |                 | adopted and     |                 |
| Standards V.C)  |                 | procedures      |                 |
|                 |                 | established to  |                 |
|                 |                 | provide the     |                 |
|                 |                 | organization    |                 |
|                 |                 | with reasonable |                 |
|                 |                 | assurance of    |                 |
|                 |                 | complying with  |                 |
|                 |                 | applicable      |                 |
|                 |                 | standards       |                 |
|                 |                 | governing       |                 |
|                 |                 | audits and      |                 |
|                 |                 | attestation     |                 |
|                 |                 | engagements. An |                 |
|                 |                 | audit           |                 |
|                 |                 | organization's  |                 |
|                 |                 | internal        |                 |
|                 |                 | quality control |                 |
|                 |                 | system should   |                 |
|                 |                 | include         |                 |
|                 |                 | procedures for  |                 |
|                 |                 | monitoring, on  |                 |
|                 |                 | an ongoing      |                 |
|                 |                 | basis, whether  |                 |
|                 |                 | the policies    |                 |
|                 |                 | and procedures  |                 |
|                 |                 | related to the  |                 |
|                 |                 | standards are   |                 |
|                 |                 | suitably        |                 |
|                 |                 | designed and    |                 |
|                 |                 | are being       |                 |
|                 |                 | effectively     |                 |
|                 |                 | applied.        |                 |
|                 |                 |                 |                 |
|                 |                 | > **V. C** An   |                 |
|                 |                 | > internal      |                 |
|                 |                 | > quality       |                 |
|                 |                 | > assurance     |                 |
|                 |                 | > program must  |                 |
|                 |                 | > be structured |                 |
|                 |                 | > and           |                 |
|                 |                 | > implemented   |                 |
|                 |                 | > to ensure an  |                 |
|                 |                 | > objective,    |                 |
|                 |                 | > timely, and   |                 |
|                 |                 | > comprehensive |                 |
|                 |                 | > appraisial of |                 |
|                 |                 | > operations.   |                 |
|                 |                 | > The internal  |                 |
|                 |                 | > quality       |                 |
|                 |                 | > assurance     |                 |
|                 |                 | > reviews       |                 |
|                 |                 | > should be     |                 |
|                 |                 | > conducted by  |                 |
|                 |                 | > individuals   |                 |
|                 |                 | > who are not   |                 |
|                 |                 | > directly      |                 |
|                 |                 | > involved in   |                 |
|                 |                 | > the activitiy |                 |
|                 |                 | > or unit being |                 |
|                 |                 | > reviewed and  |                 |
|                 |                 | > who do not    |                 |
|                 |                 | > report to the |                 |
|                 |                 | > immediate     |                 |
|                 |                 | > supervisor of |                 |
|                 |                 | > that activity |                 |
|                 |                 | > or unit.      |                 |
+-----------------+-----------------+-----------------+-----------------+
| 4.2 What are    |                 | **3.52** Audit  |                 |
| your policies   |                 | organizations   |                 |
| and procedures  |                 | performing      |                 |
| to ensure that  |                 | audits and      |                 |
| your audit      |                 | attestation     |                 |
| organization    |                 | engagements in  |                 |
| takes remedial  |                 | accordance with |                 |
| corrective      |                 | GAGAS should    |                 |
| action as       |                 | have an         |                 |
| needed on the   |                 | external peer   |                 |
| results of      |                 | review of their |                 |
| external peer   |                 | auditing and    |                 |
| reviews? (GAGAS |                 | attestation     |                 |
| 3.52)           |                 | engagement      |                 |
|                 |                 | practices at    |                 |
|                 |                 | least once      |                 |
|                 |                 | every 3 years   |                 |
|                 |                 | by reviewers    |                 |
|                 |                 | independent of  |                 |
|                 |                 | the audit       |                 |
|                 |                 | organization    |                 |
|                 |                 | being           |                 |
|                 |                 | reviewed.^ ^The |                 |
|                 |                 | external peer   |                 |
|                 |                 | review should   |                 |
|                 |                 | determine       |                 |
|                 |                 | whether, during |                 |
|                 |                 | the period      |                 |
|                 |                 | under review,   |                 |
|                 |                 | the reviewed    |                 |
|                 |                 | audit           |                 |
|                 |                 | organization's  |                 |
|                 |                 | internal        |                 |
|                 |                 | quality control |                 |
|                 |                 | system was      |                 |
|                 |                 | adequate and    |                 |
|                 |                 | whether quality |                 |
|                 |                 | control         |                 |
|                 |                 | policies and    |                 |
|                 |                 | procedures were |                 |
|                 |                 | being complied  |                 |
|                 |                 | with to provide |                 |
|                 |                 | the audit       |                 |
|                 |                 | organization    |                 |
|                 |                 | with reasonable |                 |
|                 |                 | assurance of    |                 |
|                 |                 | conforming with |                 |
|                 |                 | applicable      |                 |
|                 |                 | professional    |                 |
|                 |                 | standards.      |                 |
|                 |                 | Audit           |                 |
|                 |                 | organizations   |                 |
|                 |                 | should take     |                 |
|                 |                 | remedial,       |                 |
|                 |                 | corrective      |                 |
|                 |                 | actions as      |                 |
|                 |                 | needed based on |                 |
|                 |                 | the results of  |                 |
|                 |                 | the peer        |                 |
|                 |                 | review.         |                 |
+-----------------+-----------------+-----------------+-----------------+
| 4.3 What are    |                 | **3.51** The    |                 |
| your policies   |                 | nature and      |                 |
| and procedures  |                 | extent of an    |                 |
| regarding       |                 | audit           |                 |
| documenting     |                 | organization's  |                 |
| compliance with |                 | internal        |                 |
| your system of  |                 | quality control |                 |
| quality control |                 | system depends  |                 |
| (GAGAS 3.51)    |                 | on a number of  |                 |
| for the         |                 | factors, such   |                 |
| following       |                 | as its size,    |                 |
| c               |                 | the degree of   |                 |
| haracteristics: |                 | operating       |                 |
|                 |                 | autonomy        |                 |
| a.  Policies    |                 | allowed its     |                 |
|     and         |                 | personnel and   |                 |
|     procedures  |                 | its audit       |                 |
|     that        |                 | offices, the    |                 |
|     establish   |                 | nature of its   |                 |
|     internal    |                 | work, its       |                 |
|     guidance    |                 | organizational  |                 |
|     and         |                 | structure, and  |                 |
|                 |                 | appropriate     |                 |
|   requirements? |                 | cost-benefit    |                 |
|                 |                 | considerations. |                 |
| b.  Supervisory |                 | Thus, the       |                 |
|     review      |                 | systems         |                 |
|     processes?  |                 | established by  |                 |
|                 |                 | individual      |                 |
| c.  Quality     |                 | audit           |                 |
|     control     |                 | organizations   |                 |
|     process for |                 | will vary as    |                 |
|     each audit? |                 | will the need   |                 |
|     (such as    |                 | for, and extent |                 |
|     independent |                 | of, their       |                 |
|                 |                 | documentation   |                 |
|    referencing, |                 | of the systems. |                 |
|     GAGAS 8.45) |                 | However, each   |                 |
|                 |                 | audit           |                 |
| d.  Quality     |                 | organization    |                 |
|     assurance   |                 | should prepare  |                 |
|     program?    |                 | appropriate     |                 |
|                 |                 | documentation   |                 |
|                 |                 | for its system  |                 |
|                 |                 | of quality      |                 |
|                 |                 | control to      |                 |
|                 |                 | demonstrate     |                 |
|                 |                 | compliance with |                 |
|                 |                 | its policies    |                 |
|                 |                 | and procedures. |                 |
|                 |                 | The form and    |                 |
|                 |                 | content of such |                 |
|                 |                 | documentation   |                 |
|                 |                 | is a matter of  |                 |
|                 |                 | judgment.       |                 |
|                 |                 | Documentation   |                 |
|                 |                 | of compliance   |                 |
|                 |                 | should be       |                 |
|                 |                 | retained for a  |                 |
|                 |                 | period of time  |                 |
|                 |                 | sufficient to   |                 |
|                 |                 | enable those    |                 |
|                 |                 | performing      |                 |
|                 |                 | monitoring      |                 |
|                 |                 | procedures and  |                 |
|                 |                 | peer reviews to |                 |
|                 |                 | evaluate the    |                 |
|                 |                 | extent of the   |                 |
|                 |                 | audit           |                 |
|                 |                 | organization's  |                 |
|                 |                 | compliance with |                 |
|                 |                 | the quality     |                 |
|                 |                 | control         |                 |
|                 |                 | policies and    |                 |
|                 |                 | procedures.     |                 |
|                 |                 |                 |                 |
|                 |                 | **8.45**        |                 |
|                 |                 | Evidence        |                 |
|                 |                 | included in     |                 |
|                 |                 | audit reports   |                 |
|                 |                 | should          |                 |
|                 |                 | demonstrate the |                 |
|                 |                 | correctness and |                 |
|                 |                 | reasonableness  |                 |
|                 |                 | of the matters  |                 |
|                 |                 | reported.       |                 |
|                 |                 | Correct         |                 |
|                 |                 | portrayal means |                 |
|                 |                 | describing      |                 |
|                 |                 | accurately the  |                 |
|                 |                 | audit scope and |                 |
|                 |                 | methodology and |                 |
|                 |                 | presenting      |                 |
|                 |                 | findings and    |                 |
|                 |                 | conclusions in  |                 |
|                 |                 | a manner        |                 |
|                 |                 | consistent with |                 |
|                 |                 | the scope of    |                 |
|                 |                 | audit work. The |                 |
|                 |                 | report also     |                 |
|                 |                 | should not have |                 |
|                 |                 | errors in logic |                 |
|                 |                 | and reasoning.  |                 |
|                 |                 | One way to help |                 |
|                 |                 | ensure that the |                 |
|                 |                 | audit report    |                 |
|                 |                 | meets these     |                 |
|                 |                 | reporting       |                 |
|                 |                 | standards is to |                 |
|                 |                 | use a quality   |                 |
|                 |                 | control process |                 |
|                 |                 | such as         |                 |
|                 |                 | referencing.    |                 |
|                 |                 | Referencing is  |                 |
|                 |                 | a process in    |                 |
|                 |                 | which an        |                 |
|                 |                 | experienced     |                 |
|                 |                 | auditor who is  |                 |
|                 |                 | independent of  |                 |
|                 |                 | the audit       |                 |
|                 |                 | verifies that   |                 |
|                 |                 | statements of   |                 |
|                 |                 | facts, figures, |                 |
|                 |                 | and dates are   |                 |
|                 |                 | correctly       |                 |
|                 |                 | reported, that  |                 |
|                 |                 | the findings    |                 |
|                 |                 | are adequately  |                 |
|                 |                 | supported by    |                 |
|                 |                 | the audit       |                 |
|                 |                 | documentation,  |                 |
|                 |                 | and that the    |                 |
|                 |                 | conclusions and |                 |
|                 |                 | recommendations |                 |
|                 |                 | flow logically  |                 |
|                 |                 | from the        |                 |
|                 |                 | support.        |                 |
+-----------------+-----------------+-----------------+-----------------+
|                 |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **5. [AUDIT     |                 |                 |                 |
| PLANNING        |                 |                 |                 |
| ]{.underline}** |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **Financial     |                 |                 |                 |
| Audits**        |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 5.1 What are    |                 | **4.03** The    |                 |
| your policies   |                 | three AICPA     |                 |
| and procedures  |                 | generally       |                 |
| regarding the   |                 | accepted        |                 |
| documentation   |                 | standards of    |                 |
| of the planning |                 | field work are  |                 |
| of an audit     |                 | as follows:     |                 |
| engagement?     |                 |                 |                 |
| (GAGAS 4.03, AU |                 | > a\. The work  |                 |
| 311.01-311.10)  |                 | > is to be      |                 |
|                 |                 | > adequately    |                 |
|                 |                 | > planned, and  |                 |
|                 |                 | > assistants,   |                 |
|                 |                 | > if any, are   |                 |
|                 |                 | > to be         |                 |
|                 |                 | > properly      |                 |
|                 |                 | > supervised.   |                 |
|                 |                 | >               |                 |
|                 |                 | > b\. A         |                 |
|                 |                 | > sufficient    |                 |
|                 |                 | > understanding |                 |
|                 |                 | > of internal   |                 |
|                 |                 | > control is to |                 |
|                 |                 | > be obtained   |                 |
|                 |                 | > to plan the   |                 |
|                 |                 | > audit and to  |                 |
|                 |                 | > determine the |                 |
|                 |                 | > nature,       |                 |
|                 |                 | > timing, and   |                 |
|                 |                 | > extent of     |                 |
|                 |                 | > tests to be   |                 |
|                 |                 | > performed.    |                 |
+-----------------+-----------------+-----------------+-----------------+
| 5.2 What are    |                 |                 |                 |
| your policies   |                 |                 |                 |
| and procedures  |                 |                 |                 |
| that require    |                 |                 |                 |
| consideration   |                 |                 |                 |
| of the          |                 |                 |                 |
| following       |                 |                 |                 |
| during the      |                 |                 |                 |
| planning        |                 |                 |                 |
| process of      |                 |                 |                 |
| financial       |                 |                 |                 |
| statement       |                 |                 |                 |
| audits:         |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| > a\. The       |                 |                 |                 |
| > matters       |                 |                 |                 |
| > described in  |                 |                 |                 |
| > AU 311.03     |                 |                 |                 |
| > that are      |                 |                 |                 |
| > relevant to   |                 |                 |                 |
| > the auditee   |                 |                 |                 |
| > as follows:   |                 |                 |                 |
| >               |                 |                 |                 |
| > 1\. Matters   |                 |                 |                 |
| > relating to   |                 |                 |                 |
| > the auditee's |                 |                 |                 |
| > mission and   |                 |                 |                 |
| > the           |                 |                 |                 |
| > environment   |                 |                 |                 |
| > in which it   |                 |                 |                 |
| > operates?     |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| > 2\. The       |                 |                 |                 |
| > auditee\'s    |                 |                 |                 |
| > accounting    |                 |                 |                 |
| > policies and  |                 |                 |                 |
| > procedures?   |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| > 3\. The       |                 |                 |                 |
| > methods used  |                 |                 |                 |
| > by the        |                 |                 |                 |
| > auditee to    |                 |                 |                 |
| > process       |                 |                 |                 |
| > significant   |                 |                 |                 |
| > accounting    |                 |                 |                 |
| > information,  |                 |                 |                 |
| > including the |                 |                 |                 |
| > use of        |                 |                 |                 |
| > service       |                 |                 |                 |
| >               |                 |                 |                 |
|  organizations, |                 |                 |                 |
| > such as       |                 |                 |                 |
| > outside       |                 |                 |                 |
| > service       |                 |                 |                 |
| > centers?      |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| > 4\. Planned   |                 |                 |                 |
| > assessed      |                 |                 |                 |
| > level of      |                 |                 |                 |
| > control risk? |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| > 5\.           |                 |                 |                 |
| > Preliminary   |                 |                 |                 |
| > judgment      |                 |                 |                 |
| > about         |                 |                 |                 |
| > materiality   |                 |                 |                 |
| > levels for    |                 |                 |                 |
| > audit         |                 |                 |                 |
| > purposes?     |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| > 6\. Financial |                 |                 |                 |
| > statement     |                 |                 |                 |
| > items likely  |                 |                 |                 |
| > to require    |                 |                 |                 |
| > adjustment?   |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| > 7\.           |                 |                 |                 |
| > Conditions    |                 |                 |                 |
| > that may      |                 |                 |                 |
| > require       |                 |                 |                 |
| > extension or  |                 |                 |                 |
| > modification  |                 |                 |                 |
| > of audit      |                 |                 |                 |
| > tests, such   |                 |                 |                 |
| > as the risk   |                 |                 |                 |
| > of material   |                 |                 |                 |
| > errors or     |                 |                 |                 |
| >               |                 |                 |                 |
|  irregularities |                 |                 |                 |
| > or the        |                 |                 |                 |
| > existence of  |                 |                 |                 |
| > related party |                 |                 |                 |
| > transactions? |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| > 8\. The       |                 |                 |                 |
| > nature of     |                 |                 |                 |
| > reports       |                 |                 |                 |
| > expected to   |                 |                 |                 |
| > be rendered   |                 |                 |                 |
| > (for example, |                 |                 |                 |
| > a report on   |                 |                 |                 |
| > consolidating |                 |                 |                 |
| > financial     |                 |                 |                 |
| > statements)?  |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| > b\. What are  |                 | **4.14** The    |                 |
| > your policies |                 | standard        |                 |
| > and           |                 | related to      |                 |
| > procedures    |                 | considering the |                 |
| > requiring     |                 | results of      |                 |
| > follow-up on  |                 | previous audits |                 |
| > prior         |                 | and attestation |                 |
| > material      |                 | engagements for |                 |
| > findings and  |                 | financial       |                 |
| >               |                 | audits          |                 |
| recommendations |                 | performed in    |                 |
| > that affect   |                 | accordance with |                 |
| > the current   |                 | GAGAS is that   |                 |
| > audit? (GAGAS |                 | auditors should |                 |
| > 4.14-4.16)    |                 | consider the    |                 |
|                 |                 | results of      |                 |
|                 |                 | previous audits |                 |
|                 |                 | and attestation |                 |
|                 |                 | engagements and |                 |
|                 |                 | follow up on    |                 |
|                 |                 | known           |                 |
|                 |                 | significant     |                 |
|                 |                 | findings and    |                 |
|                 |                 | recommendations |                 |
|                 |                 | that directly   |                 |
|                 |                 | relate to the   |                 |
|                 |                 | objectives of   |                 |
|                 |                 | the audit being |                 |
|                 |                 | undertaken.     |                 |
+-----------------+-----------------+-----------------+-----------------+
| > c\. Detection |                 | **4.18** AICPA  |                 |
| > of material   |                 | standards and   |                 |
| > misstatements |                 | GAGAS require   |                 |
| > resulting     |                 | auditors to     |                 |
| > from          |                 | assess the risk |                 |
| > violations of |                 | of material     |                 |
| > contract      |                 | misstatements   |                 |
| > provisions or |                 | of financial    |                 |
| > grant         |                 | statement       |                 |
| > agreements or |                 | amounts or      |                 |
| > from abuse?   |                 | other financial |                 |
| > (GAGAS 4.17   |                 | data            |                 |
| > -- 4.20)      |                 | s               |                 |
|                 |                 | ignificant^ ^to |                 |
|                 |                 | the audit       |                 |
|                 |                 | objectives due  |                 |
|                 |                 | to fraud and to |                 |
|                 |                 | consider that   |                 |
|                 |                 | assessment in   |                 |
|                 |                 | designing the   |                 |
|                 |                 | audit           |                 |
|                 |                 | procedures to   |                 |
|                 |                 | be performed.   |                 |
|                 |                 | Auditors are    |                 |
|                 |                 | also required   |                 |
|                 |                 | to design the   |                 |
|                 |                 | audit to        |                 |
|                 |                 | provide         |                 |
|                 |                 | reasonable      |                 |
|                 |                 | assurance of    |                 |
|                 |                 | detecting       |                 |
|                 |                 | material        |                 |
|                 |                 | misstatements   |                 |
|                 |                 | resulting from  |                 |
|                 |                 | direct and      |                 |
|                 |                 | material        |                 |
|                 |                 | illegal acts    |                 |
|                 |                 | (violations of  |                 |
|                 |                 | laws and        |                 |
|                 |                 | regulations)    |                 |
|                 |                 | and to be aware |                 |
|                 |                 | of the          |                 |
|                 |                 | possibility     |                 |
|                 |                 | that indirect   |                 |
|                 |                 | illegal acts    |                 |
|                 |                 | may have        |                 |
|                 |                 | occurred. Under |                 |
|                 |                 | GAGAS, auditors |                 |
|                 |                 | have the same   |                 |
|                 |                 | r               |                 |
|                 |                 | esponsibilities |                 |
|                 |                 | for detecting   |                 |
|                 |                 | material        |                 |
|                 |                 | misstatements   |                 |
|                 |                 | arising from    |                 |
|                 |                 | violations of   |                 |
|                 |                 | provisions of   |                 |
|                 |                 | contracts or    |                 |
|                 |                 | grant           |                 |
|                 |                 | agreements as   |                 |
|                 |                 | they do for     |                 |
|                 |                 | detecting those |                 |
|                 |                 | arising from    |                 |
|                 |                 | fraud and       |                 |
|                 |                 | illegal acts.   |                 |
|                 |                 | Auditors should |                 |
|                 |                 | design the      |                 |
|                 |                 | audit to        |                 |
|                 |                 | provide         |                 |
|                 |                 | reasonable      |                 |
|                 |                 | assurance of    |                 |
|                 |                 | detecting       |                 |
|                 |                 | material        |                 |
|                 |                 | misstatements   |                 |
|                 |                 | resulting from  |                 |
|                 |                 | direct and      |                 |
|                 |                 | material        |                 |
|                 |                 | violations of   |                 |
|                 |                 | provisions of   |                 |
|                 |                 | contracts or    |                 |
|                 |                 | grant           |                 |
|                 |                 | agreements. If  |                 |
|                 |                 | specific        |                 |
|                 |                 | information     |                 |
|                 |                 | comes to the    |                 |
|                 |                 | auditors'       |                 |
|                 |                 | attention that  |                 |
|                 |                 | provides        |                 |
|                 |                 | evidence        |                 |
|                 |                 | concerning the  |                 |
|                 |                 | existence of    |                 |
|                 |                 | possible        |                 |
|                 |                 | violations of   |                 |
|                 |                 | provisions of   |                 |
|                 |                 | contracts or    |                 |
|                 |                 | grant           |                 |
|                 |                 | agreements that |                 |
|                 |                 | could have a    |                 |
|                 |                 | material        |                 |
|                 |                 | indirect effect |                 |
|                 |                 | on the          |                 |
|                 |                 | financial       |                 |
|                 |                 | statements or   |                 |
|                 |                 | significant     |                 |
|                 |                 | indirect effect |                 |
|                 |                 | on other        |                 |
|                 |                 | financial data  |                 |
|                 |                 | needed to       |                 |
|                 |                 | achieve audit   |                 |
|                 |                 | objectives,     |                 |
|                 |                 | auditors should |                 |
|                 |                 | apply audit     |                 |
|                 |                 | procedures      |                 |
|                 |                 | specifically    |                 |
|                 |                 | directed to     |                 |
|                 |                 | ascertain       |                 |
|                 |                 | whether         |                 |
|                 |                 | violations have |                 |
|                 |                 | occurred or are |                 |
|                 |                 | likely to have  |                 |
|                 |                 | occurred.       |                 |
+-----------------+-----------------+-----------------+-----------------+
| > d\.           |                 | **4.06** The    |                 |
| > Communication |                 | standard        |                 |
| > of relevant   |                 | related to      |                 |
| > information   |                 | auditor         |                 |
| > concerning    |                 | communication   |                 |
| > the audit?    |                 | for financial   |                 |
| > (GAGAS 4.06   |                 | audits          |                 |
| > -- 4.13)      |                 | performed in    |                 |
|                 |                 | accordance with |                 |
|                 |                 | GAGAS is:       |                 |
|                 |                 |                 |                 |
|                 |                 | > Auditors      |                 |
|                 |                 | > should        |                 |
|                 |                 | > communicate   |                 |
|                 |                 | > information   |                 |
|                 |                 | > regarding the |                 |
|                 |                 | > nature,       |                 |
|                 |                 | > timing, and   |                 |
|                 |                 | > extent of     |                 |
|                 |                 | > planned       |                 |
|                 |                 | > testing and   |                 |
|                 |                 | > reporting and |                 |
|                 |                 | > the level of  |                 |
|                 |                 | > assurance     |                 |
|                 |                 | > provided to   |                 |
|                 |                 | > officials of  |                 |
|                 |                 | > the audited   |                 |
|                 |                 | > entity and to |                 |
|                 |                 | > the           |                 |
|                 |                 | > individuals   |                 |
|                 |                 | > contracting   |                 |
|                 |                 | > for or        |                 |
|                 |                 | > requesting    |                 |
|                 |                 | > the audit.    |                 |
+-----------------+-----------------+-----------------+-----------------+
| > e\.           |                 | **4.21** Audit  |                 |
| > Development   |                 | findings, such  |                 |
| > of finding    |                 | as deficiencies |                 |
| > elements      |                 | in internal     |                 |
| > (criteria,    |                 | control, fraud, |                 |
| > condition,    |                 | illegal acts,   |                 |
| > effect, plus  |                 | violations of   |                 |
| > cause)?       |                 | provisions of   |                 |
| > (GAGAS 4.21)  |                 | contracts or    |                 |
|                 |                 | grant           |                 |
|                 |                 | agreements, and |                 |
|                 |                 | abuse, have     |                 |
|                 |                 | often been      |                 |
|                 |                 | regarded as     |                 |
|                 |                 | containing the  |                 |
|                 |                 | elements of     |                 |
|                 |                 | criteria,       |                 |
|                 |                 | condition, and  |                 |
|                 |                 | effect, plus    |                 |
|                 |                 | cause when      |                 |
|                 |                 | problems are    |                 |
|                 |                 | found. However, |                 |
|                 |                 | the elements    |                 |
|                 |                 | needed for a    |                 |
|                 |                 | finding depend  |                 |
|                 |                 | entirely on the |                 |
|                 |                 | objectives of   |                 |
|                 |                 | the audit.      |                 |
|                 |                 | Thus, a finding |                 |
|                 |                 | or set of       |                 |
|                 |                 | findings is     |                 |
|                 |                 | complete to the |                 |
|                 |                 | extent that the |                 |
|                 |                 | audit           |                 |
|                 |                 | objectives are  |                 |
|                 |                 | satisfied. When |                 |
|                 |                 | problems are    |                 |
|                 |                 | identified, to  |                 |
|                 |                 | the extent      |                 |
|                 |                 | possible,       |                 |
|                 |                 | auditors should |                 |
|                 |                 | plan audit      |                 |
|                 |                 | procedures to   |                 |
|                 |                 | develop the     |                 |
|                 |                 | elements of a   |                 |
|                 |                 | finding to      |                 |
|                 |                 | facilitate      |                 |
|                 |                 | developing the  |                 |
|                 |                 | auditors'       |                 |
|                 |                 | report. (See    |                 |
|                 |                 | paragraph 5.15  |                 |
|                 |                 | for a           |                 |
|                 |                 | description of  |                 |
|                 |                 | the elements of |                 |
|                 |                 | a finding.)     |                 |
+-----------------+-----------------+-----------------+-----------------+
| 5.3 What are    |                 |                 |                 |
| your policies   |                 |                 |                 |
| and procedures  |                 |                 |                 |
| for:            |                 |                 |                 |
|                 |                 |                 |                 |
| a.  Inquiring   |                 |                 |                 |
|     about the   |                 |                 |                 |
|                 |                 |                 |                 |
|    professional |                 |                 |                 |
|     reputation  |                 |                 |                 |
|     and         |                 |                 |                 |
|     standing of |                 |                 |                 |
|     the other   |                 |                 |                 |
|     auditor?    |                 |                 |                 |
|     (AU 543.10) |                 |                 |                 |
|                 |                 |                 |                 |
| b.  Obtaining   |                 |                 |                 |
|                 |                 |                 |                 |
|  representation |                 |                 |                 |
|     from the    |                 |                 |                 |
|     other       |                 |                 |                 |
|     auditor     |                 |                 |                 |
|     regarding   |                 |                 |                 |
|                 |                 |                 |                 |
|   independence? |                 |                 |                 |
|     (AU 543.10) |                 |                 |                 |
|                 |                 |                 |                 |
| > c\. When the  |                 |                 |                 |
| > audit report  |                 |                 |                 |
| > will not make |                 |                 |                 |
| > reference to  |                 |                 |                 |
| > the work of   |                 |                 |                 |
| > the other     |                 |                 |                 |
| > auditor, are  |                 |                 |                 |
| > additional    |                 |                 |                 |
| > steps         |                 |                 |                 |
| > performed to  |                 |                 |                 |
| > obtain        |                 |                 |                 |
| > satisfaction  |                 |                 |                 |
| > regarding the |                 |                 |                 |
| > other         |                 |                 |                 |
| > auditor\'s    |                 |                 |                 |
| > examination?  |                 |                 |                 |
| > (AU 543.10    |                 |                 |                 |
| > and 543.12)   |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| ##              |                 | **6.03-6.04**   |                 |
| ## Attestations |                 | The two AICPA   |                 |
|                 |                 | field work      |                 |
| 5.4 What are    |                 | standards for   |                 |
| your policies   |                 | attestation     |                 |
| and procedures  |                 | engagements are |                 |
| for ensuring    |                 | as follows:     |                 |
| that the        |                 |                 |                 |
| auditor         |                 | > a\. The work  |                 |
| performs an     |                 | > shall be      |                 |
| engagement only |                 | > adequately    |                 |
| if there is     |                 | > planned and   |                 |
| reason to       |                 | > assistants,   |                 |
| believe that    |                 | > if any, shall |                 |
| the subject     |                 | > be properly   |                 |
| matter is       |                 | > supervised.   |                 |
| capable of      |                 | >               |                 |
| evaluation      |                 | > b\.           |                 |
| against         |                 | > Sufficient    |                 |
| criteria that   |                 | > evidence      |                 |
| are suitable    |                 | > shall be      |                 |
| and available   |                 | > obtained to   |                 |
| to users?       |                 | > provide a     |                 |
| (GAGAS          |                 | > reasonable    |                 |
| 6.02-6.04)      |                 | > basis for the |                 |
|                 |                 | > conclusion    |                 |
|                 |                 | > that is       |                 |
|                 |                 | > expressed in  |                 |
|                 |                 | > the report.   |                 |
+-----------------+-----------------+-----------------+-----------------+
| 5.5 What are    |                 | **6.22** The    |                 |
| your policies   |                 | standard        |                 |
| and procedures  |                 | related to      |                 |
| to ensure       |                 | attest          |                 |
| planning        |                 | documentation   |                 |
| documentation   |                 | for attestation |                 |
| is sufficient?  |                 | engagements     |                 |
| (GAGAS          |                 | performed in    |                 |
| 6.22-6.26)      |                 | accordance with |                 |
|                 |                 | GAGAS is:       |                 |
|                 |                 | Attest          |                 |
|                 |                 | documentation   |                 |
|                 |                 | related to      |                 |
|                 |                 | planning,       |                 |
|                 |                 | conducting, and |                 |
|                 |                 | reporting on    |                 |
|                 |                 | the attestation |                 |
|                 |                 | engagement      |                 |
|                 |                 | should contain  |                 |
|                 |                 | sufficient      |                 |
|                 |                 | information to  |                 |
|                 |                 | enable an       |                 |
|                 |                 | experienced     |                 |
|                 |                 | auditor who has |                 |
|                 |                 | had no previous |                 |
|                 |                 | connection with |                 |
|                 |                 | the attestation |                 |
|                 |                 | engagement to   |                 |
|                 |                 | ascertain from  |                 |
|                 |                 | the attest      |                 |
|                 |                 | documentation   |                 |
|                 |                 | the evidence    |                 |
|                 |                 | that supports   |                 |
|                 |                 | the auditors'   |                 |
|                 |                 | significant     |                 |
|                 |                 | judgments and   |                 |
|                 |                 | conclusions.    |                 |
|                 |                 | Attest          |                 |
|                 |                 | documentation   |                 |
|                 |                 | should contain  |                 |
|                 |                 | support for     |                 |
|                 |                 | findings,       |                 |
|                 |                 | conclusions,    |                 |
|                 |                 | and             |                 |
|                 |                 | recommendations |                 |
|                 |                 | before auditors |                 |
|                 |                 | issue their     |                 |
|                 |                 | report.         |                 |
+-----------------+-----------------+-----------------+-----------------+
| > What are your |                 | **6.06** The    |                 |
| > policies and  |                 | standard        |                 |
| > procedures to |                 | related to      |                 |
| > communicate   |                 | auditor         |                 |
| > relevant      |                 | communication   |                 |
| > information   |                 | for attestation |                 |
| > concerning    |                 | engagements     |                 |
| > the           |                 | performed in    |                 |
| > attestation   |                 | accordance with |                 |
| > engagement?   |                 | GAGAS is:       |                 |
| > (GAGAS 6.06   |                 | Auditors should |                 |
| > -6.09)        |                 | communicate     |                 |
|                 |                 | information     |                 |
|                 |                 | regarding the   |                 |
|                 |                 | nature, timing, |                 |
|                 |                 | and extent of   |                 |
|                 |                 | planned testing |                 |
|                 |                 | and reporting   |                 |
|                 |                 | on the subject  |                 |
|                 |                 | matter or       |                 |
|                 |                 | assertion about |                 |
|                 |                 | the subject     |                 |
|                 |                 | matter,         |                 |
|                 |                 | including the   |                 |
|                 |                 | level of        |                 |
|                 |                 | assurance       |                 |
|                 |                 | provided, to    |                 |
|                 |                 | officials of    |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity and to   |                 |
|                 |                 | the individuals |                 |
|                 |                 | contracting for |                 |
|                 |                 | or requesting   |                 |
|                 |                 | the attestation |                 |
|                 |                 | engagement.     |                 |
+-----------------+-----------------+-----------------+-----------------+
| > What are your |                 | **6.10** The    |                 |
| > policies and  |                 | standard        |                 |
| > procedures to |                 | related to      |                 |
| > consider the  |                 | considering the |                 |
| > results of    |                 | results of      |                 |
| > previous      |                 | previous audits |                 |
| > audits and    |                 | and attestation |                 |
| > attestation   |                 | engagements for |                 |
| > engagements?  |                 | attestation     |                 |
| > (GAGAS 6.10   |                 | engagements     |                 |
| > -6.12)        |                 | performed in    |                 |
|                 |                 | accordance with |                 |
|                 |                 | GAGAS is:       |                 |
|                 |                 | Auditors should |                 |
|                 |                 | consider the    |                 |
|                 |                 | results of      |                 |
|                 |                 | previous audits |                 |
|                 |                 | and attestation |                 |
|                 |                 | engagements and |                 |
|                 |                 | follow up on    |                 |
|                 |                 | known           |                 |
|                 |                 | significant     |                 |
|                 |                 | findings and    |                 |
|                 |                 | recommendations |                 |
|                 |                 | that directly   |                 |
|                 |                 | relate to the   |                 |
|                 |                 | subject matter  |                 |
|                 |                 | or the          |                 |
|                 |                 | assertion of    |                 |
|                 |                 | the attestation |                 |
|                 |                 | engagement      |                 |
|                 |                 | being           |                 |
|                 |                 | undertaken.     |                 |
+-----------------+-----------------+-----------------+-----------------+
| **Performance   |                 | **7.03** In     |                 |
| Audits**        |                 | planning the    |                 |
|                 |                 | audit, auditors |                 |
| 5.6 What are    |                 | should define   |                 |
| your policies   |                 | the audit       |                 |
| and procedures  |                 | objectives, as  |                 |
| to ensure the   |                 | well as the     |                 |
| work is         |                 | scope and       |                 |
| adequately      |                 | methodology to  |                 |
| planned? (GAGAS |                 | achieve those   |                 |
| 7.02 & 7.03)    |                 | objectives.     |                 |
|                 |                 | Audit           |                 |
|                 |                 | objectives,     |                 |
|                 |                 | scope, and      |                 |
|                 |                 | methodologies   |                 |
|                 |                 | are not         |                 |
|                 |                 | determined in   |                 |
|                 |                 | isolation.      |                 |
|                 |                 | Auditors        |                 |
|                 |                 | determine these |                 |
|                 |                 | three elements  |                 |
|                 |                 | of the audit    |                 |
|                 |                 | plan together,  |                 |
|                 |                 | as the          |                 |
|                 |                 | considerations  |                 |
|                 |                 | in determining  |                 |
|                 |                 | each often      |                 |
|                 |                 | overlap.        |                 |
|                 |                 | Planning is a   |                 |
|                 |                 | continuous      |                 |
|                 |                 | process         |                 |
|                 |                 | throughout the  |                 |
|                 |                 | audit.          |                 |
|                 |                 | Therefore,      |                 |
|                 |                 | auditors should |                 |
|                 |                 | consider the    |                 |
|                 |                 | need to make    |                 |
|                 |                 | adjustments to  |                 |
|                 |                 | the audit       |                 |
|                 |                 | objectives,     |                 |
|                 |                 | scope, and      |                 |
|                 |                 | methodology as  |                 |
|                 |                 | work is being   |                 |
|                 |                 | completed.      |                 |
+-----------------+-----------------+-----------------+-----------------+
| > a\. What are  |                 | **7.10**        |                 |
| > your policies |                 | Auditors should |                 |
| > and           |                 | obtain an       |                 |
| > procedures to |                 | understanding   |                 |
| > ensure that   |                 | of the program  |                 |
| > sufficient    |                 | to be audited   |                 |
| > background    |                 | to help assess, |                 |
| > information   |                 | among other     |                 |
| > on the        |                 | matters, the    |                 |
| > organization, |                 | significance of |                 |
| > program,      |                 | possible audit  |                 |
| > activity, or  |                 | objectives and  |                 |
| > function      |                 | the feasibility |                 |
| > being audited |                 | of achieving    |                 |
| > is obtained?  |                 | them. The       |                 |
| > (GAGAS 7.10)  |                 | auditors'       |                 |
|                 |                 | understanding   |                 |
|                 |                 | may come from   |                 |
|                 |                 | knowledge they  |                 |
|                 |                 | already have    |                 |
|                 |                 | about the       |                 |
|                 |                 | program or      |                 |
|                 |                 | knowledge they  |                 |
|                 |                 | gain from       |                 |
|                 |                 | inquiries and   |                 |
|                 |                 | observations    |                 |
|                 |                 | they make in    |                 |
|                 |                 | planning the    |                 |
|                 |                 | audit. The      |                 |
|                 |                 | extent and      |                 |
|                 |                 | breadth of      |                 |
|                 |                 | those inquiries |                 |
|                 |                 | and             |                 |
|                 |                 | observations    |                 |
|                 |                 | will vary among |                 |
|                 |                 | audits based on |                 |
|                 |                 | the audit       |                 |
|                 |                 | objectives, as  |                 |
|                 |                 | will the need   |                 |
|                 |                 | to understand   |                 |
|                 |                 | individual      |                 |
|                 |                 | aspects of the  |                 |
|                 |                 | program, such   |                 |
|                 |                 | as the          |                 |
|                 |                 | following:      |                 |
|                 |                 |                 |                 |
|                 |                 | a.  Laws,       |                 |
|                 |                 |                 |                 |
|                 |                 |    regulations, |                 |
|                 |                 |     and         |                 |
|                 |                 |     provisions  |                 |
|                 |                 |     of          |                 |
|                 |                 |     contracts   |                 |
|                 |                 |     or grant    |                 |
|                 |                 |     agreements, |                 |
|                 |                 |                 |                 |
|                 |                 | b.  Purpose and |                 |
|                 |                 |     goals,      |                 |
|                 |                 |                 |                 |
|                 |                 | c.  Internal    |                 |
|                 |                 |     control,    |                 |
|                 |                 |                 |                 |
|                 |                 | d.  Efforts,    |                 |
|                 |                 |                 |                 |
|                 |                 | e.  Program     |                 |
|                 |                 |     Operations, |                 |
|                 |                 |                 |                 |
|                 |                 | f.  Outputs,    |                 |
|                 |                 |     and         |                 |
|                 |                 |                 |                 |
|                 |                 | g.  Outcomes.   |                 |
+-----------------+-----------------+-----------------+-----------------+
| > b\. What are  |                 | **7.28**        |                 |
| > your policies |                 | Criteria are    |                 |
| > and           |                 | the standards,  |                 |
| > procedures to |                 | measures,       |                 |
| > identify the  |                 | expectations of |                 |
| > criteria to   |                 | what should     |                 |
| > evaluate the  |                 | exist, best     |                 |
| > subject       |                 | practices, and  |                 |
| > matter of the |                 | benchmarks      |                 |
| > audit? (GAGAS |                 | against which   |                 |
| > 7.28)         |                 | performance is  |                 |
|                 |                 | compared or     |                 |
|                 |                 | evaluated.      |                 |
|                 |                 | Criteria, one   |                 |
|                 |                 | of the elements |                 |
|                 |                 | of a finding,   |                 |
|                 |                 | provide a       |                 |
|                 |                 | context for     |                 |
|                 |                 | understanding   |                 |
|                 |                 | the results of  |                 |
|                 |                 | the audit. (See |                 |
|                 |                 | paragraphs 7.62 |                 |
|                 |                 | through 7.65    |                 |
|                 |                 | for a           |                 |
|                 |                 | discussion on   |                 |
|                 |                 | the other       |                 |
|                 |                 | elements of a   |                 |
|                 |                 | finding.) The   |                 |
|                 |                 | audit plan,     |                 |
|                 |                 | where possible, |                 |
|                 |                 | should state    |                 |
|                 |                 | the criteria to |                 |
|                 |                 | be used. In     |                 |
|                 |                 | selecting       |                 |
|                 |                 | criteria,       |                 |
|                 |                 | auditors have a |                 |
|                 |                 | responsibility  |                 |
|                 |                 | to use criteria |                 |
|                 |                 | that are        |                 |
|                 |                 | reasonable,     |                 |
|                 |                 | attainable, and |                 |
|                 |                 | relevant to the |                 |
|                 |                 | objectives of   |                 |
|                 |                 | the performance |                 |
|                 |                 | audit. The      |                 |
|                 |                 | following are   |                 |
|                 |                 | some examples   |                 |
|                 |                 | of possible     |                 |
|                 |                 | criteria:       |                 |
|                 |                 |                 |                 |
|                 |                 | > **a.**        |                 |
|                 |                 | > purpose or    |                 |
|                 |                 | > goals         |                 |
|                 |                 | > prescribed by |                 |
|                 |                 | > law or        |                 |
|                 |                 | > regulation or |                 |
|                 |                 | > set by        |                 |
|                 |                 | > officials of  |                 |
|                 |                 | > the audited   |                 |
|                 |                 | > entity,       |                 |
|                 |                 | >               |                 |
|                 |                 | > **b.**        |                 |
|                 |                 | > policies and  |                 |
|                 |                 | > procedures    |                 |
|                 |                 | > established   |                 |
|                 |                 | > by officials  |                 |
|                 |                 | > of the        |                 |
|                 |                 | > audited       |                 |
|                 |                 | > entity,       |                 |
|                 |                 | >               |                 |
|                 |                 | > **c.**        |                 |
|                 |                 | > technically   |                 |
|                 |                 | > developed     |                 |
|                 |                 | > standards or  |                 |
|                 |                 | > norms,        |                 |
|                 |                 | >               |                 |
|                 |                 | > **d.** expert |                 |
|                 |                 | > opinions,     |                 |
|                 |                 | >               |                 |
|                 |                 | > **e.** prior  |                 |
|                 |                 | > periods'      |                 |
|                 |                 | > performance,  |                 |
|                 |                 | >               |                 |
|                 |                 | > **f.**        |                 |
|                 |                 | > performance   |                 |
|                 |                 | > of similar    |                 |
|                 |                 | > entities,     |                 |
|                 |                 | >               |                 |
|                 |                 | > **g.**        |                 |
|                 |                 | > performance   |                 |
|                 |                 | > in the        |                 |
|                 |                 | > private       |                 |
|                 |                 | > sector, or    |                 |
|                 |                 | >               |                 |
|                 |                 | > **h.** best   |                 |
|                 |                 | > practices of  |                 |
|                 |                 | > leading       |                 |
|                 |                 | >               |                 |
|                 |                 |  organizations. |                 |
+-----------------+-----------------+-----------------+-----------------+
| > c\. What are  |                 | **7.29**        |                 |
| > your policies |                 | Auditors should |                 |
| > and           |                 | consider the    |                 |
| > procedures to |                 | results of      |                 |
| > consider the  |                 | previous audits |                 |
| > results of    |                 | and attestation |                 |
| > previous      |                 | engagements and |                 |
| > audits that   |                 | follow up on    |                 |
| > could affect  |                 | known           |                 |
| > the current   |                 | significant     |                 |
| > audit         |                 | findings and    |                 |
| > objectives?   |                 | recommendatio   |                 |
| > (GAGAS        |                 | ns^ ^identified |                 |
| > 7.29-7.30)    |                 | in previous     |                 |
|                 |                 | audit reports   |                 |
|                 |                 | that directly   |                 |
|                 |                 | relate to the   |                 |
|                 |                 | objectives of   |                 |
|                 |                 | the audit being |                 |
|                 |                 | undertaken.     |                 |
|                 |                 | Auditors should |                 |
|                 |                 | ask audited     |                 |
|                 |                 | entity          |                 |
|                 |                 | officials to    |                 |
|                 |                 | identify        |                 |
|                 |                 | previous        |                 |
|                 |                 | financial       |                 |
|                 |                 | audits,         |                 |
|                 |                 | attestation     |                 |
|                 |                 | engagements,    |                 |
|                 |                 | performance     |                 |
|                 |                 | audits, or      |                 |
|                 |                 | other studies   |                 |
|                 |                 | related to the  |                 |
|                 |                 | objectives of   |                 |
|                 |                 | the audit being |                 |
|                 |                 | undertaken and  |                 |
|                 |                 | to identify     |                 |
|                 |                 | corrective      |                 |
|                 |                 | actions taken   |                 |
|                 |                 | to address      |                 |
|                 |                 | significant     |                 |
|                 |                 | findings and    |                 |
|                 |                 | r               |                 |
|                 |                 | ecommendations. |                 |
|                 |                 | For example, an |                 |
|                 |                 | audit report on |                 |
|                 |                 | an entity's     |                 |
|                 |                 | computerized    |                 |
|                 |                 | information     |                 |
|                 |                 | systems may     |                 |
|                 |                 | contain         |                 |
|                 |                 | significant     |                 |
|                 |                 | findings that   |                 |
|                 |                 | could relate to |                 |
|                 |                 | the performance |                 |
|                 |                 | audit if the    |                 |
|                 |                 | entity uses     |                 |
|                 |                 | such systems to |                 |
|                 |                 | process its     |                 |
|                 |                 | accounting or   |                 |
|                 |                 | other           |                 |
|                 |                 | information the |                 |
|                 |                 | auditors plan   |                 |
|                 |                 | on using.       |                 |
|                 |                 | Auditors should |                 |
|                 |                 | use             |                 |
|                 |                 | professional    |                 |
|                 |                 | judgment in     |                 |
|                 |                 | determining (1) |                 |
|                 |                 | prior periods   |                 |
|                 |                 | to be           |                 |
|                 |                 | considered, (2) |                 |
|                 |                 | the level of    |                 |
|                 |                 | work necessary  |                 |
|                 |                 | to follow up on |                 |
|                 |                 | significant     |                 |
|                 |                 | findings and    |                 |
|                 |                 | recommendations |                 |
|                 |                 | that affect the |                 |
|                 |                 | audit, and (3)  |                 |
|                 |                 | the risk        |                 |
|                 |                 | assessment used |                 |
|                 |                 | in planning the |                 |
|                 |                 | current audit   |                 |
|                 |                 | and designing   |                 |
|                 |                 | audit           |                 |
|                 |                 | procedures to   |                 |
|                 |                 | be performed.   |                 |
+-----------------+-----------------+-----------------+-----------------+
| > d\. What are  |                 | **7.32**        |                 |
| > your policies |                 | Auditors should |                 |
| > and           |                 | determine       |                 |
| > procedures to |                 | whether other   |                 |
| > consider the  |                 | auditors have   |                 |
| > work of       |                 | previously      |                 |
| > others?       |                 | done, or are    |                 |
| > (GAGAS        |                 | doing, audits   |                 |
| > 7.32-7.34)    |                 | of the program  |                 |
|                 |                 | or the entity   |                 |
|                 |                 | that operates   |                 |
|                 |                 | it. Whether     |                 |
|                 |                 | other auditors  |                 |
|                 |                 | have done       |                 |
|                 |                 | performance     |                 |
|                 |                 | audits,         |                 |
|                 |                 | financial       |                 |
|                 |                 | audits, or      |                 |
|                 |                 | attestation     |                 |
|                 |                 | engagements,    |                 |
|                 |                 | the other       |                 |
|                 |                 | auditors may be |                 |
|                 |                 | useful sources  |                 |
|                 |                 | of information  |                 |
|                 |                 | for planning    |                 |
|                 |                 | and performing  |                 |
|                 |                 | the audit. If   |                 |
|                 |                 | other auditors  |                 |
|                 |                 | have identified |                 |
|                 |                 | areas that      |                 |
|                 |                 | warrant further |                 |
|                 |                 | study, their    |                 |
|                 |                 | work may        |                 |
|                 |                 | influence the   |                 |
|                 |                 | auditors'       |                 |
|                 |                 | selection of    |                 |
|                 |                 | performance     |                 |
|                 |                 | audit           |                 |
|                 |                 | objectives. The |                 |
|                 |                 | availability of |                 |
|                 |                 | other auditors' |                 |
|                 |                 | work may also   |                 |
|                 |                 | influence the   |                 |
|                 |                 | selection of    |                 |
|                 |                 | methodology,    |                 |
|                 |                 | since the       |                 |
|                 |                 | auditors may be |                 |
|                 |                 | able to rely on |                 |
|                 |                 | that work to    |                 |
|                 |                 | limit the       |                 |
|                 |                 | extent of their |                 |
|                 |                 | own testing.    |                 |
+-----------------+-----------------+-----------------+-----------------+
| > e\. What are  |                 | **7.35** Staff  |                 |
| > your policies |                 | planning should |                 |
| > and           |                 | include, among  |                 |
| > procedures to |                 | other things:   |                 |
| > assess the    |                 |                 |                 |
| > skill,        |                 | > **a.**        |                 |
| > knowledge and |                 | > assigning     |                 |
| > availability  |                 | > staff with    |                 |
| > of the        |                 | > the           |                 |
| > personnel to  |                 | > appropriate   |                 |
| > staff the     |                 | > collective    |                 |
| > assignment?   |                 | > knowledge,    |                 |
| > (GAGAS        |                 | > skills, and   |                 |
| > 7.35-7.38)    |                 | > experience    |                 |
|                 |                 | > for the job;  |                 |
|                 |                 | >               |                 |
|                 |                 | > **b.**        |                 |
|                 |                 | > assigning an  |                 |
|                 |                 | > adequate      |                 |
|                 |                 | > number of     |                 |
|                 |                 | > staff and     |                 |
|                 |                 | > supervisors   |                 |
|                 |                 | > to the audit; |                 |
|                 |                 | >               |                 |
|                 |                 | > **c.**        |                 |
|                 |                 | > providing for |                 |
|                 |                 | > on-the-job    |                 |
|                 |                 | > training of   |                 |
|                 |                 | > staff; and    |                 |
|                 |                 | >               |                 |
|                 |                 | > **d.**        |                 |
|                 |                 | > engaging      |                 |
|                 |                 | > specialists   |                 |
|                 |                 | > when          |                 |
|                 |                 | > necessary.    |                 |
+-----------------+-----------------+-----------------+-----------------+
| > f\. What are  |                 | **7.39**        |                 |
| > your policies |                 | Auditors should |                 |
| > and           |                 | communicate     |                 |
| > procedures to |                 | information     |                 |
| > communicate   |                 | about the       |                 |
| > information   |                 | specific nature |                 |
| > about the     |                 | of the          |                 |
| > nature of the |                 | performance     |                 |
| > audit? (GAGAS |                 | audit, as well  |                 |
| > 7.39-7.40)    |                 | as general      |                 |
|                 |                 | information     |                 |
|                 |                 | concerning the  |                 |
|                 |                 | planning and    |                 |
|                 |                 | conduct of the  |                 |
|                 |                 | audit and       |                 |
|                 |                 | r               |                 |
|                 |                 | eporting\--such |                 |
|                 |                 | as the form of  |                 |
|                 |                 | the report and  |                 |
|                 |                 | any potential   |                 |
|                 |                 | restrictions on |                 |
|                 |                 | the report\--to |                 |
|                 |                 | the various     |                 |
|                 |                 | parties         |                 |
|                 |                 | involved in the |                 |
|                 |                 | audit to help   |                 |
|                 |                 | them understand |                 |
|                 |                 | the objectives, |                 |
|                 |                 | time frames,    |                 |
|                 |                 | and any data    |                 |
|                 |                 | needs. Parties  |                 |
|                 |                 | involved may    |                 |
|                 |                 | include         |                 |
|                 |                 |                 |                 |
|                 |                 | > **a.** the    |                 |
|                 |                 | > head of the   |                 |
|                 |                 | > audited       |                 |
|                 |                 | > entity;       |                 |
|                 |                 | >               |                 |
|                 |                 | > **b.** the    |                 |
|                 |                 | > audit         |                 |
|                 |                 | > committee or, |                 |
|                 |                 | > in the        |                 |
|                 |                 | > absence of an |                 |
|                 |                 | > audit         |                 |
|                 |                 | > committee,    |                 |
|                 |                 | > the board of  |                 |
|                 |                 | > directors or  |                 |
|                 |                 | > other         |                 |
|                 |                 | > equivalent    |                 |
|                 |                 | > oversight     |                 |
|                 |                 | > body;         |                 |
|                 |                 | >               |                 |
|                 |                 | > **c.** the    |                 |
|                 |                 | > individual    |                 |
|                 |                 | > who possesses |                 |
|                 |                 | > a sufficient  |                 |
|                 |                 | > level of      |                 |
|                 |                 | > authority and |                 |
|                 |                 | >               |                 |
|                 |                 |  responsibility |                 |
|                 |                 | > for the       |                 |
|                 |                 | > program or    |                 |
|                 |                 | > activity      |                 |
|                 |                 | > being         |                 |
|                 |                 | > audited; and  |                 |
|                 |                 | >               |                 |
|                 |                 | > **d.** the    |                 |
|                 |                 | > individuals   |                 |
|                 |                 | > contracting   |                 |
|                 |                 | > for or        |                 |
|                 |                 | > requesting    |                 |
|                 |                 | > audit         |                 |
|                 |                 | > services,     |                 |
|                 |                 | > such as       |                 |
|                 |                 | > contracting   |                 |
|                 |                 | > officials or  |                 |
|                 |                 | > legislative   |                 |
|                 |                 | > members or    |                 |
|                 |                 | > staff, if     |                 |
|                 |                 | > applicable.   |                 |
+-----------------+-----------------+-----------------+-----------------+
| > g\. What are  |                 | **7.31** In     |                 |
| > your policies |                 | identifying     |                 |
| > and           |                 | potential       |                 |
| > procedures to |                 | sources of data |                 |
| > assess        |                 | that could be   |                 |
| > potential     |                 | used as audit   |                 |
| > sources of    |                 | evidence,       |                 |
| > data and the  |                 | auditors should |                 |
| > validity and  |                 | consider the    |                 |
| > reliability   |                 | validity and    |                 |
| > of such data? |                 | reliability of  |                 |
| > (GAGAS 7.31)  |                 | the data,       |                 |
|                 |                 | including data  |                 |
|                 |                 | collected by    |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity, data    |                 |
|                 |                 | generated by    |                 |
|                 |                 | the auditors,   |                 |
|                 |                 | or data         |                 |
|                 |                 | provided by     |                 |
|                 |                 | third parties,  |                 |
|                 |                 | as well as the  |                 |
|                 |                 | sufficiency and |                 |
|                 |                 | relevance of    |                 |
|                 |                 | the evidence.   |                 |
|                 |                 | (See paragraphs |                 |
|                 |                 | 7.48 through    |                 |
|                 |                 | 7.65 for        |                 |
|                 |                 | standards and   |                 |
|                 |                 | guidance        |                 |
|                 |                 | concerning      |                 |
|                 |                 | evidence.)      |                 |
+-----------------+-----------------+-----------------+-----------------+
| > h\. What are  |                 |                 |                 |
| > your policies |                 |                 |                 |
| > and           |                 |                 |                 |
| > procedures    |                 |                 |                 |
| > for           |                 |                 |                 |
| > considering   |                 |                 |                 |
| > risks due to  |                 |                 |                 |
| > fraud that    |                 |                 |                 |
| > could         |                 |                 |                 |
| > significantly |                 |                 |                 |
| > affect the    |                 |                 |                 |
| > audit         |                 |                 |                 |
| > objectives?   |                 |                 |                 |
| > (GAGAS        |                 |                 |                 |
| > 7.21-7.26)    |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 5.7 What are    |                 | **7.43**        |                 |
| your policies   |                 | Written audit   |                 |
| and procedures  |                 | plans may       |                 |
| regarding audit |                 | include the     |                 |
| plans? Is a     |                 | following:      |                 |
| written audit   |                 |                 |                 |
| plan (or        |                 | > **a.**        |                 |
| program) used   |                 | > information   |                 |
| on all audit    |                 | > about the     |                 |
| engagements?    |                 | > legal         |                 |
| Who is required |                 | > authority for |                 |
| to review and   |                 | > the audited   |                 |
| approve the     |                 | > program, its  |                 |
| audit plan, and |                 | > history and   |                 |
| how is this     |                 | > current       |                 |
| approval        |                 | > objectives,   |                 |
| documented?     |                 | > its principal |                 |
| Does management |                 | > locations,    |                 |
| require formal  |                 | > and other     |                 |
| authorization   |                 | > background    |                 |
| of revisions to |                 | > that can help |                 |
| the audit plan? |                 | > auditors      |                 |
| (GAGAS          |                 | > understand    |                 |
| 7.41-7.43)      |                 | > and carry out |                 |
|                 |                 | > the audit     |                 |
|                 |                 | > plan;         |                 |
|                 |                 | >               |                 |
|                 |                 | > **b.**        |                 |
|                 |                 | > information   |                 |
|                 |                 | > about the     |                 |
|                 |                 | > r             |                 |
|                 |                 | esponsibilities |                 |
|                 |                 | > of each       |                 |
|                 |                 | > member of the |                 |
|                 |                 | > audit team    |                 |
|                 |                 | > (such as      |                 |
|                 |                 | > preparing     |                 |
|                 |                 | > audit         |                 |
|                 |                 | > programs,     |                 |
|                 |                 | > conducting    |                 |
|                 |                 | > audit work,   |                 |
|                 |                 | > supervising   |                 |
|                 |                 | > and reviewing |                 |
|                 |                 | > audit work,   |                 |
|                 |                 | > drafting      |                 |
|                 |                 | > reports,      |                 |
|                 |                 | > handling      |                 |
|                 |                 | > comments from |                 |
|                 |                 | > officials of  |                 |
|                 |                 | > the audited   |                 |
|                 |                 | > program, and  |                 |
|                 |                 | > processing    |                 |
|                 |                 | > the final     |                 |
|                 |                 | > report),      |                 |
|                 |                 | > which can     |                 |
|                 |                 | > help auditors |                 |
|                 |                 | > when the work |                 |
|                 |                 | > is conducted  |                 |
|                 |                 | > at several    |                 |
|                 |                 | > different     |                 |
|                 |                 | > locations. In |                 |
|                 |                 | > these audits, |                 |
|                 |                 | > use of        |                 |
|                 |                 | > comparable    |                 |
|                 |                 | > audit methods |                 |
|                 |                 | > and           |                 |
|                 |                 | > procedures    |                 |
|                 |                 | > can help make |                 |
|                 |                 | > the data      |                 |
|                 |                 | > obtained from |                 |
|                 |                 | > participating |                 |
|                 |                 | > locations     |                 |
|                 |                 | > comparable;   |                 |
|                 |                 | >               |                 |
|                 |                 | > **c.** audit  |                 |
|                 |                 | > programs      |                 |
|                 |                 | > describing    |                 |
|                 |                 | > procedures to |                 |
|                 |                 | > accomplish    |                 |
|                 |                 | > the audit     |                 |
|                 |                 | > objectives    |                 |
|                 |                 | > and providing |                 |
|                 |                 | > a systematic  |                 |
|                 |                 | > basis for     |                 |
|                 |                 | > assigning     |                 |
|                 |                 | > work to staff |                 |
|                 |                 | > and for       |                 |
|                 |                 | > summarizing   |                 |
|                 |                 | > the work      |                 |
|                 |                 | > performed;    |                 |
|                 |                 | > and           |                 |
|                 |                 | >               |                 |
|                 |                 | > **d.** the    |                 |
|                 |                 | > general       |                 |
|                 |                 | > format of the |                 |
|                 |                 | > audit report  |                 |
|                 |                 | > and the types |                 |
|                 |                 | > of            |                 |
|                 |                 | > information   |                 |
|                 |                 | > to be         |                 |
|                 |                 | > included,     |                 |
|                 |                 | > which can     |                 |
|                 |                 | > help auditors |                 |
|                 |                 | > focus their   |                 |
|                 |                 | > field work on |                 |
|                 |                 | > the           |                 |
|                 |                 | > information   |                 |
|                 |                 | > to be         |                 |
|                 |                 | > reported.     |                 |
+-----------------+-----------------+-----------------+-----------------+
| 5.8 What are    |                 | **8.39** To be  |                 |
| your policies   |                 | of maximum use, |                 |
| and procedures  |                 | the audit       |                 |
| to ensure the   |                 | report needs to |                 |
| audit is        |                 | provide         |                 |
| planned         |                 | relevant        |                 |
| effectively to  |                 | information in  |                 |
| culminate in    |                 | time to respond |                 |
| the timely      |                 | to officials of |                 |
| issuance of the |                 | the audited     |                 |
| report? How is  |                 | entity,         |                 |
| timeliness      |                 | legislative     |                 |
| defined and     |                 | officials, and  |                 |
| measured?       |                 | other users'    |                 |
| (GAGAS 8.39)    |                 | legitimate      |                 |
|                 |                 | needs.          |                 |
|                 |                 | Likewise, the   |                 |
|                 |                 | information     |                 |
|                 |                 | provided in the |                 |
|                 |                 | report needs to |                 |
|                 |                 | be current.     |                 |
|                 |                 | Therefore,      |                 |
|                 |                 | auditors should |                 |
|                 |                 | plan for the    |                 |
|                 |                 | appropriate     |                 |
|                 |                 | issuance of the |                 |
|                 |                 | report and      |                 |
|                 |                 | conduct the     |                 |
|                 |                 | audit with      |                 |
|                 |                 | these goals in  |                 |
|                 |                 | mind.           |                 |
+-----------------+-----------------+-----------------+-----------------+
|                 |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **6.            |                 |                 |                 |
| [SUPERVISION    |                 |                 |                 |
| ]{.underline}** |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **All Audits**  |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 6.1 What are    |                 | **7.44** The    |                 |
| your policies   |                 | field work      |                 |
| and procedures  |                 | standard        |                 |
| for ensuring    |                 | related to      |                 |
| that auditors   |                 | supervision for |                 |
| and others      |                 | performance     |                 |
| (including      |                 | audits          |                 |
| specialists)    |                 | performed in    |                 |
| receive         |                 | accordance with |                 |
| appropriate     |                 | GAGAS is:       |                 |
| guidance and    |                 |                 |                 |
| effective       |                 | > Staff are to  |                 |
| supervision     |                 | > be properly   |                 |
| during the      |                 | > supervised.   |                 |
| performance of  |                 |                 |                 |
| the audit? (AU  |                 |                 |                 |
| 311.11-14;      |                 |                 |                 |
| GAGAS 6.4,      |                 |                 |                 |
| 7.44-7.47)      |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 6.2 What are    |                 | **7.45**        |                 |
| your policies   |                 | Supervision     |                 |
| and procedures  |                 | involves        |                 |
| for ensuring    |                 | directing the   |                 |
| that staff is   |                 | efforts of      |                 |
| aware of their  |                 | staff assigned  |                 |
| r               |                 | to the audit to |                 |
| esponsibilities |                 | ensure that the |                 |
| and for         |                 | audit           |                 |
| providing the   |                 | objectives are  |                 |
| level of        |                 | accomplished.   |                 |
| supervision     |                 | Elements of     |                 |
| warranted by    |                 | supervision     |                 |
| the experience  |                 | include         |                 |
| level of the    |                 | providing       |                 |
| staff? (AU      |                 | sufficient      |                 |
| 311.12, GAGAS   |                 | guidance to     |                 |
| 7.45 and 7.46)  |                 | staff members,  |                 |
|                 |                 | staying         |                 |
|                 |                 | informed about  |                 |
|                 |                 | significant     |                 |
|                 |                 | problems        |                 |
|                 |                 | encountered,    |                 |
|                 |                 | reviewing the   |                 |
|                 |                 | work performed, |                 |
|                 |                 | and providing   |                 |
|                 |                 | effective       |                 |
|                 |                 | on-the-job      |                 |
|                 |                 | training.       |                 |
|                 |                 |                 |                 |
|                 |                 | **7.46**        |                 |
|                 |                 | Supervisors     |                 |
|                 |                 | should satisfy  |                 |
|                 |                 | themselves that |                 |
|                 |                 | staff members   |                 |
|                 |                 | clearly         |                 |
|                 |                 | understand what |                 |
|                 |                 | work they are   |                 |
|                 |                 | to do, why the  |                 |
|                 |                 | work is to be   |                 |
|                 |                 | conducted, and  |                 |
|                 |                 | what the work   |                 |
|                 |                 | is expected to  |                 |
|                 |                 | accomplish.     |                 |
|                 |                 | With            |                 |
|                 |                 | experienced     |                 |
|                 |                 | staff,          |                 |
|                 |                 | supervisors may |                 |
|                 |                 | outline the     |                 |
|                 |                 | scope of the    |                 |
|                 |                 | work and leave  |                 |
|                 |                 | details to the  |                 |
|                 |                 | staff. With     |                 |
|                 |                 | less            |                 |
|                 |                 | experienced     |                 |
|                 |                 | staff,          |                 |
|                 |                 | supervisors may |                 |
|                 |                 | have to specify |                 |
|                 |                 | audit           |                 |
|                 |                 | procedures to   |                 |
|                 |                 | be performed as |                 |
|                 |                 | well as         |                 |
|                 |                 | techniques for  |                 |
|                 |                 | gathering and   |                 |
|                 |                 | analyzing data. |                 |
+-----------------+-----------------+-----------------+-----------------+
| 6.3 What are    |                 | **7.47**        |                 |
| your policies   |                 | Reviews of      |                 |
| and procedures  |                 | audit work      |                 |
| regarding the   |                 | should be       |                 |
| documentation   |                 | documented. The |                 |
| of supervisory  |                 | nature and      |                 |
| reviews of      |                 | extent of the   |                 |
| audit work? (AU |                 | review of audit |                 |
| 339.05; GAGAS   |                 | work may vary   |                 |
| 4.24 6.24,      |                 | depending on a  |                 |
| 7.47, 7.68)     |                 | number of       |                 |
|                 |                 | factors, such   |                 |
|                 |                 | as the size of  |                 |
|                 |                 | the audit       |                 |
|                 |                 | organization,   |                 |
|                 |                 | the             |                 |
|                 |                 | significance of |                 |
|                 |                 | the work, and   |                 |
|                 |                 | the experience  |                 |
|                 |                 | of the staff.   |                 |
+-----------------+-----------------+-----------------+-----------------+
|                 |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **7. [EVIDENCE  |                 |                 |                 |
| AND             |                 |                 |                 |
| DOCUMENTATION   |                 |                 |                 |
| ]{.underline}** |                 |                 |                 |
|                 |                 |                 |                 |
| **All Audits**  |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **Sufficient,   |                 | **7.52**        |                 |
| Competent, and  |                 | Evidence should |                 |
| Relevant        |                 | be sufficient,  |                 |
| Evidence**      |                 | competent, and  |                 |
|                 |                 | relevant to     |                 |
| 7.1 What are    |                 | support a sound |                 |
| your policies   |                 | basis for audit |                 |
| and procedures  |                 | findings,       |                 |
| to ensure that  |                 | conclusions,    |                 |
| audit and       |                 | and             |                 |
| attestation     |                 | r               |                 |
| engagement      |                 | ecommendations: |                 |
| findings and    |                 |                 |                 |
| conclusions are |                 | > **a.**        |                 |
| supported by    |                 | > Evidence      |                 |
| sufficient,     |                 | > should be     |                 |
| competent, and  |                 | > sufficient to |                 |
| relevant        |                 | > support the   |                 |
| evidence? (AU   |                 | > auditors'     |                 |
| 326.01; GAGAS   |                 | > findings. In  |                 |
| 4.22-4.24,      |                 | > determining   |                 |
| 6.22-6.24,      |                 | > the           |                 |
| 7.48-7.53)      |                 | > sufficiency   |                 |
|                 |                 | > of evidence,  |                 |
|                 |                 | > auditors      |                 |
|                 |                 | > should ensure |                 |
|                 |                 | > that enough   |                 |
|                 |                 | > evidence      |                 |
|                 |                 | > exists to     |                 |
|                 |                 | > persuade a    |                 |
|                 |                 | > knowledgeable |                 |
|                 |                 | > person of the |                 |
|                 |                 | > validity of   |                 |
|                 |                 | > the findings. |                 |
|                 |                 | > When          |                 |
|                 |                 | > appropriate,  |                 |
|                 |                 | > statistical   |                 |
|                 |                 | > methods may   |                 |
|                 |                 | > be used to    |                 |
|                 |                 | > establish     |                 |
|                 |                 | > sufficiency.  |                 |
+-----------------+-----------------+-----------------+-----------------+
|                 |                 | > **b.**        |                 |
|                 |                 | > Evidence is   |                 |
|                 |                 | > competent if  |                 |
|                 |                 | > it is valid,  |                 |
|                 |                 | > reliable, and |                 |
|                 |                 | > consistent    |                 |
|                 |                 | > with fact. In |                 |
|                 |                 | > assessing the |                 |
|                 |                 | > competence of |                 |
|                 |                 | > evidence,     |                 |
|                 |                 | > auditors      |                 |
|                 |                 | > should        |                 |
|                 |                 | > consider such |                 |
|                 |                 | > factors as    |                 |
|                 |                 | > whether the   |                 |
|                 |                 | > evidence is   |                 |
|                 |                 | > accurate,     |                 |
|                 |                 | >               |                 |
|                 |                 |  authoritative, |                 |
|                 |                 | > timely, and   |                 |
|                 |                 | > authentic.    |                 |
|                 |                 | > When          |                 |
|                 |                 | > appropriate,  |                 |
|                 |                 | > auditors may  |                 |
|                 |                 | > use           |                 |
|                 |                 | > statistical   |                 |
|                 |                 | > methods to    |                 |
|                 |                 | > derive        |                 |
|                 |                 | > competent     |                 |
|                 |                 | > evidence.     |                 |
|                 |                 | >               |                 |
|                 |                 | > **c.**        |                 |
|                 |                 | > Evidence is   |                 |
|                 |                 | > relevant if   |                 |
|                 |                 | > it has a      |                 |
|                 |                 | > logical       |                 |
|                 |                 | > relationship  |                 |
|                 |                 | > with, and     |                 |
|                 |                 | > importance    |                 |
|                 |                 | > to, the issue |                 |
|                 |                 | > being         |                 |
|                 |                 | > addressed.    |                 |
|                 |                 |                 |                 |
|                 |                 | **7.49** A      |                 |
|                 |                 | large part of   |                 |
|                 |                 | auditors' work  |                 |
|                 |                 | on an audit     |                 |
|                 |                 | concerns        |                 |
|                 |                 | obtaining and   |                 |
|                 |                 | evaluating      |                 |
|                 |                 | evidence that   |                 |
|                 |                 | ultimately      |                 |
|                 |                 | supports their  |                 |
|                 |                 | judgments and   |                 |
|                 |                 | conclusions     |                 |
|                 |                 | pertaining to   |                 |
|                 |                 | the audit       |                 |
|                 |                 | objectives. In  |                 |
|                 |                 | evaluating      |                 |
|                 |                 | evidence,       |                 |
|                 |                 | auditors        |                 |
|                 |                 | consider        |                 |
|                 |                 | whether they    |                 |
|                 |                 | have obtained   |                 |
|                 |                 | the evidence    |                 |
|                 |                 | necessary to    |                 |
|                 |                 | achieve         |                 |
|                 |                 | specific audit  |                 |
|                 |                 | objectives.     |                 |
|                 |                 | When internal   |                 |
|                 |                 | control or      |                 |
|                 |                 | compliance      |                 |
|                 |                 | requirements    |                 |
|                 |                 | are significant |                 |
|                 |                 | to the audit    |                 |
|                 |                 | objectives,     |                 |
|                 |                 | auditors should |                 |
|                 |                 | also collect    |                 |
|                 |                 | and evaluate    |                 |
|                 |                 | evidence        |                 |
|                 |                 | relating to     |                 |
|                 |                 | controls or     |                 |
|                 |                 | compliance.     |                 |
+-----------------+-----------------+-----------------+-----------------+
| 7.2 What are    |                 | **7.54**        |                 |
| your policies   |                 | Auditors may    |                 |
| and procedures  |                 | find it useful  |                 |
| regarding       |                 | to obtain       |                 |
| written         |                 | written         |                 |
| representations |                 | representations |                 |
| about the       |                 | concerning the  |                 |
| validity of     |                 | competence and  |                 |
| evidence        |                 | completeness of |                 |
| obtained from   |                 | certain         |                 |
| officials of an |                 | evidence from   |                 |
| audited entity? |                 | officials of    |                 |
| (AU 333.02;     |                 | the audited     |                 |
| GAGAS 7.54)     |                 | entity. Written |                 |
|                 |                 | representations |                 |
|                 |                 | ordinarily      |                 |
|                 |                 | confirm oral    |                 |
|                 |                 | representations |                 |
|                 |                 | given to        |                 |
|                 |                 | auditors,       |                 |
|                 |                 | indicate and    |                 |
|                 |                 | document the    |                 |
|                 |                 | continuing      |                 |
|                 |                 | appropriateness |                 |
|                 |                 | of such         |                 |
|                 |                 | r               |                 |
|                 |                 | epresentations, |                 |
|                 |                 | and reduce the  |                 |
|                 |                 | possibility of  |                 |
|                 |                 | mi              |                 |
|                 |                 | sunderstandings |                 |
|                 |                 | concerning the  |                 |
|                 |                 | matters that    |                 |
|                 |                 | are the subject |                 |
|                 |                 | of the          |                 |
|                 |                 | r               |                 |
|                 |                 | epresentations. |                 |
|                 |                 | Written         |                 |
|                 |                 | representations |                 |
|                 |                 | can take        |                 |
|                 |                 | several forms,  |                 |
|                 |                 | including       |                 |
|                 |                 | summary         |                 |
|                 |                 | documents       |                 |
|                 |                 | prepared by the |                 |
|                 |                 | auditors and    |                 |
|                 |                 | signed by the   |                 |
|                 |                 | entity's        |                 |
|                 |                 | management. If  |                 |
|                 |                 | officials of    |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity refuse   |                 |
|                 |                 | to provide a    |                 |
|                 |                 | written         |                 |
|                 |                 | representation  |                 |
|                 |                 | that the        |                 |
|                 |                 | auditors have   |                 |
|                 |                 | requested, the  |                 |
|                 |                 | auditors should |                 |
|                 |                 | consider the    |                 |
|                 |                 | effects of the  |                 |
|                 |                 | refusal on      |                 |
|                 |                 | results of the  |                 |
|                 |                 | audit.          |                 |
+-----------------+-----------------+-----------------+-----------------+
| **Assessing the |                 | 59. Validity    |                 |
| Reliability of  |                 |     and         |                 |
| Computer        |                 |     reliability |                 |
| Processed       |                 |     of data     |                 |
| Data**          |                 |     from        |                 |
|                 |                 |                 |                 |
| 7.3 What are    |                 |  computer-based |                 |
| you policies    |                 |     systems:    |                 |
| and procedures  |                 |     Auditors    |                 |
| for assessing   |                 |     should      |                 |
| the reliability |                 |     obtain      |                 |
| of              |                 |     sufficient, |                 |
| com             |                 |     competent,  |                 |
| puter‑processed |                 |     and         |                 |
| data? (AU       |                 |     relevant    |                 |
| 326.12, GAGAS   |                 |     evidence    |                 |
| 4.24, 6.24,     |                 |     that        |                 |
| 7.59)           |                 |     com         |                 |
|                 |                 | puter-processed |                 |
+-----------------+-----------------+-----------------+-----------------+
|                 |                 | data are valid  |                 |
|                 |                 | and reliable    |                 |
|                 |                 | when these data |                 |
|                 |                 | are significant |                 |
|                 |                 | to the          |                 |
|                 |                 | auditors'       |                 |
|                 |                 | findings. This  |                 |
|                 |                 | work is         |                 |
|                 |                 | necessary       |                 |
|                 |                 | regardless of   |                 |
|                 |                 | whether the     |                 |
|                 |                 | data are        |                 |
|                 |                 | provided to     |                 |
|                 |                 | auditors or     |                 |
|                 |                 | auditors        |                 |
|                 |                 | independently   |                 |
|                 |                 | extract them.   |                 |
|                 |                 | Auditors should |                 |
|                 |                 | determine if    |                 |
|                 |                 | officials of    |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity or other |                 |
|                 |                 | auditors have   |                 |
|                 |                 | worked to       |                 |
|                 |                 | establish the   |                 |
|                 |                 | validity and    |                 |
|                 |                 | reliability of  |                 |
|                 |                 | the data or the |                 |
|                 |                 | effectiveness   |                 |
|                 |                 | of the controls |                 |
|                 |                 | over the system |                 |
|                 |                 | that produced   |                 |
|                 |                 | the data. If    |                 |
|                 |                 | the results of  |                 |
|                 |                 | such work are   |                 |
|                 |                 | current,        |                 |
|                 |                 | auditors may be |                 |
|                 |                 | able to rely on |                 |
|                 |                 | that work. (See |                 |
|                 |                 | paragraphs 7.32 |                 |
|                 |                 | through 7.34    |                 |
|                 |                 | for             |                 |
|                 |                 | requirements    |                 |
|                 |                 | when relying on |                 |
|                 |                 | the work of     |                 |
|                 |                 | others.)        |                 |
|                 |                 | Auditors may    |                 |
|                 |                 | also determine  |                 |
|                 |                 | the validity    |                 |
|                 |                 | and reliability |                 |
|                 |                 | of              |                 |
|                 |                 | com             |                 |
|                 |                 | puter-processed |                 |
|                 |                 | data by direct  |                 |
|                 |                 | tests of the    |                 |
|                 |                 | data.           |                 |
+-----------------+-----------------+-----------------+-----------------+
| **              |                 | **7.66** The    |                 |
| Documentation** |                 | field work      |                 |
|                 |                 | standard        |                 |
| 7.4 What are    |                 | related to      |                 |
| your policies   |                 | audit           |                 |
| and procedures  |                 | documentation   |                 |
| for preparing   |                 | for performance |                 |
| and maintaining |                 | audits          |                 |
| documentation   |                 | performed in    |                 |
| and ensuring    |                 | accordance with |                 |
| the safety,     |                 | GAGAS is:       |                 |
| custody, and    |                 |                 |                 |
| retention of    |                 | > Auditors      |                 |
| the             |                 | > should        |                 |
| documentation?. |                 | > prepare and   |                 |
| (AU 339.08;     |                 | > maintain      |                 |
| GAGAS 4.26,     |                 | > audit         |                 |
| 6.26,           |                 | >               |                 |
| 7.66-7.71)      |                 |  documentation. |                 |
|                 |                 | > Audit         |                 |
|                 |                 | > documentation |                 |
|                 |                 | > related to    |                 |
|                 |                 | > planning,     |                 |
|                 |                 | > conducting,   |                 |
|                 |                 | > and reporting |                 |
|                 |                 | > on the audit  |                 |
|                 |                 | > should        |                 |
|                 |                 | > contain       |                 |
|                 |                 | > sufficient    |                 |
|                 |                 | > information   |                 |
|                 |                 | > to enable an  |                 |
|                 |                 | > experienced   |                 |
|                 |                 | > auditor, who  |                 |
|                 |                 | > has had no    |                 |
|                 |                 | > previous      |                 |
|                 |                 | > connection    |                 |
|                 |                 | > with the      |                 |
|                 |                 | > audit, to     |                 |
|                 |                 | > ascertain     |                 |
|                 |                 | > from the      |                 |
|                 |                 | > audit         |                 |
|                 |                 | > documentation |                 |
|                 |                 | > the evidence  |                 |
|                 |                 | > that supports |                 |
|                 |                 | > the auditors' |                 |
|                 |                 | > significant   |                 |
|                 |                 | > judgments and |                 |
|                 |                 | > conclusions.  |                 |
|                 |                 | > Audit         |                 |
|                 |                 | > documentation |                 |
|                 |                 | > should        |                 |
|                 |                 | > contain       |                 |
|                 |                 | > support for   |                 |
|                 |                 | > findings,     |                 |
|                 |                 | > conclusions,  |                 |
|                 |                 | > and           |                 |
|                 |                 | >               |                 |
|                 |                 | recommendations |                 |
|                 |                 | > before        |                 |
|                 |                 | > auditors      |                 |
|                 |                 | > issue their   |                 |
|                 |                 | > report.       |                 |
+-----------------+-----------------+-----------------+-----------------+
| 7.5 What are    |                 | **7.68** Audit  |                 |
| your policies   |                 | documentation   |                 |
| and procedures  |                 | serves to (1)   |                 |
| for ensuring    |                 | provide the     |                 |
| that audit      |                 | principal       |                 |
| documentation   |                 | support for the |                 |
| is              |                 | auditors'       |                 |
| appropriately   |                 | report, (2) aid |                 |
| organized in    |                 | auditors in     |                 |
| order to        |                 | conducting and  |                 |
| provide a clear |                 | supervising the |                 |
| link to the     |                 | audit, and\     |                 |
| findings,       |                 | (3) allow for   |                 |
| conclusions,    |                 | the review of   |                 |
| and             |                 | audit quality.  |                 |
| recommendations |                 | Audit           |                 |
| contained in    |                 | documentation   |                 |
| the audit       |                 | should be       |                 |
| report and the  |                 | appropriately   |                 |
| evidence and    |                 | detailed to     |                 |
| summaries meet  |                 | provide a clear |                 |
| the specific    |                 | understanding   |                 |
| documentation   |                 | of its purpose  |                 |
| requirements?   |                 | and source and  |                 |
| (AU 339.01-.05, |                 | the conclusions |                 |
| GAGAS           |                 | the auditors    |                 |
| 4.22-4.27,      |                 | reached, and it |                 |
| 6.22-6.24,      |                 | should be       |                 |
| 7.41-7.43,      |                 | appropriately   |                 |
| 7.67-7.68)      |                 | organized to    |                 |
|                 |                 | provide a clear |                 |
|                 |                 | link to the     |                 |
|                 |                 | findings,       |                 |
|                 |                 | conclusions,    |                 |
|                 |                 | and             |                 |
|                 |                 | recommendations |                 |
|                 |                 | contained in    |                 |
|                 |                 | the audit       |                 |
|                 |                 | report. Audit   |                 |
|                 |                 | documentation   |                 |
|                 |                 | for performance |                 |
|                 |                 | audits should   |                 |
|                 |                 | contain the     |                 |
|                 |                 | following items |                 |
|                 |                 | not explicitly  |                 |
|                 |                 | addressed       |                 |
|                 |                 | elsewhere in    |                 |
|                 |                 | GAGAS:          |                 |
|                 |                 |                 |                 |
|                 |                 | > **a.** the    |                 |
|                 |                 | > objectives,   |                 |
|                 |                 | > scope, and    |                 |
|                 |                 | > methodology   |                 |
|                 |                 | > of the audit, |                 |
|                 |                 | > including     |                 |
|                 |                 | > sampling and  |                 |
|                 |                 | > other         |                 |
|                 |                 | > selection     |                 |
|                 |                 | > criteria      |                 |
|                 |                 | > used;         |                 |
|                 |                 | >               |                 |
|                 |                 | > **b.** the    |                 |
|                 |                 | > auditors'     |                 |
|                 |                 | > determination |                 |
|                 |                 | > that certain  |                 |
|                 |                 | > standards do  |                 |
|                 |                 | > not apply or  |                 |
|                 |                 | > that an       |                 |
|                 |                 | > applicable    |                 |
|                 |                 | > standard was  |                 |
|                 |                 | > not followed, |                 |
|                 |                 | > the reasons   |                 |
|                 |                 | > therefor, and |                 |
|                 |                 | > the known     |                 |
|                 |                 | > effect that   |                 |
|                 |                 | > not following |                 |
|                 |                 | > the           |                 |
|                 |                 | > applicable    |                 |
|                 |                 | > standard had, |                 |
|                 |                 | > or could have |                 |
|                 |                 | > had, on the   |                 |
|                 |                 | > audit;        |                 |
|                 |                 | >               |                 |
|                 |                 | > **c.** the    |                 |
|                 |                 | > work          |                 |
|                 |                 | > performed to  |                 |
|                 |                 | > support       |                 |
|                 |                 | > significant   |                 |
|                 |                 | > judgments and |                 |
|                 |                 | > conclusions,  |                 |
|                 |                 | > including     |                 |
|                 |                 | > descriptions  |                 |
|                 |                 | > of            |                 |
|                 |                 | > transactions  |                 |
|                 |                 | > and records   |                 |
|                 |                 | >               |                 |
|                 |                 | examined;^ ^and |                 |
|                 |                 | >               |                 |
|                 |                 | > **d.**        |                 |
|                 |                 | > evidence of   |                 |
|                 |                 | > supervisory   |                 |
|                 |                 | > reviews,      |                 |
|                 |                 | > before the    |                 |
|                 |                 | > audit report  |                 |
|                 |                 | > is issued, of |                 |
|                 |                 | > the work      |                 |
|                 |                 | > performed     |                 |
|                 |                 | > that supports |                 |
|                 |                 | > findings,     |                 |
|                 |                 | > conclusions,  |                 |
|                 |                 | > and           |                 |
|                 |                 | >               |                 |
|                 |                 | recommendations |                 |
|                 |                 | > contained in  |                 |
|                 |                 | > the audit     |                 |
|                 |                 | > report.       |                 |
+-----------------+-----------------+-----------------+-----------------+
|                 |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **8. [INTERNAL  |                 |                 |                 |
| CONTROL         |                 |                 |                 |
| ]{.underline}** |                 |                 |                 |
|                 |                 |                 |                 |
| **Financial     |                 |                 |                 |
| Statement       |                 |                 |                 |
| Audits**        |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 8.1 What are    |                 | **4.04**        |                 |
| your policies   |                 | Auditors should |                 |
| and procedures  |                 | use             |                 |
| regarding the   |                 | professional    |                 |
| understanding   |                 | judgment and    |                 |
| of each element |                 | consider the    |                 |
| of the internal |                 | needs of users  |                 |
| control         |                 | in applying the |                 |
| structure (the  |                 | AICPA standards |                 |
| control         |                 | and related     |                 |
| environment,    |                 | guidance to     |                 |
| accounting      |                 | audits of a     |                 |
| system, and     |                 | government      |                 |
| control         |                 | entity or an    |                 |
| procedures) and |                 | entity that     |                 |
| whether it has  |                 | receives        |                 |
| been            |                 | government      |                 |
| implemented?    |                 | awards. For     |                 |
| Does the policy |                 | example,        |                 |
| or procedure    |                 | auditors may    |                 |
| require that an |                 | need to set     |                 |
| auditor gain an |                 | lower           |                 |
| understanding   |                 | materiality     |                 |
| of the five     |                 | levels than in  |                 |
| components of   |                 | audits in the   |                 |
| internal        |                 | private sector  |                 |
| control         |                 | because of the  |                 |
| (control        |                 | public          |                 |
| environment,    |                 | accountability  |                 |
| risk            |                 | of the audited  |                 |
| assessment,     |                 | entity, various |                 |
| control         |                 | legal and       |                 |
| activities,     |                 | regulatory      |                 |
| information and |                 | requirements,   |                 |
| communication   |                 | and the         |                 |
| and monitoring) |                 | visibility and  |                 |
| by performing   |                 | sensitivity of  |                 |
| procedures to   |                 | government      |                 |
| understand the  |                 | programs. Also, |                 |
| design of the   |                 | auditors need   |                 |
| controls        |                 | to be sensitive |                 |
| relevant to an  |                 | to the concerns |                 |
| audit? (GAGAS   |                 | of oversight    |                 |
| 4.04, AU        |                 | officials       |                 |
| 319.19,         |                 | regarding       |                 |
| 319A.16)        |                 | previously      |                 |
|                 |                 | reported        |                 |
|                 |                 | internal        |                 |
|                 |                 | control         |                 |
|                 |                 | deficiencies of |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity and,     |                 |
|                 |                 | accordingly,    |                 |
|                 |                 | may need to     |                 |
|                 |                 | test the        |                 |
|                 |                 | effectiveness   |                 |
|                 |                 | of internal     |                 |
|                 |                 | control that    |                 |
|                 |                 | have been       |                 |
|                 |                 | changed in      |                 |
|                 |                 | response to     |                 |
|                 |                 | reported        |                 |
|                 |                 | deficiencies    |                 |
|                 |                 | even if         |                 |
|                 |                 | auditors do not |                 |
|                 |                 | plan to rely on |                 |
|                 |                 | the             |                 |
|                 |                 | effectiveness   |                 |
|                 |                 | of such         |                 |
|                 |                 | internal        |                 |
|                 |                 | control.        |                 |
+-----------------+-----------------+-----------------+-----------------+
| 8.2 What are    |                 |                 |                 |
| your policies   |                 |                 |                 |
| and procedures  |                 |                 |                 |
| regarding how   |                 |                 |                 |
| the auditor's   |                 |                 |                 |
| understanding   |                 |                 |                 |
| of the control  |                 |                 |                 |
| structure is    |                 |                 |                 |
| documented? (AU |                 |                 |                 |
| 319.44,         |                 |                 |                 |
| 319.A26)        |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 8.3 What are    |                 |                 |                 |
| your policies   |                 |                 |                 |
| and procedures  |                 |                 |                 |
| that require    |                 |                 |                 |
| assessing       |                 |                 |                 |
| control risk in |                 |                 |                 |
| terms of        |                 |                 |                 |
| financial       |                 |                 |                 |
| statement       |                 |                 |                 |
| assertions and  |                 |                 |                 |
| (where          |                 |                 |                 |
| applicable)     |                 |                 |                 |
| compliance with |                 |                 |                 |
| laws and        |                 |                 |                 |
| regulations?    |                 |                 |                 |
| (AU 319.45,     |                 |                 |                 |
| 319.A29)        |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 8.4 When        |                 |                 |                 |
| seeking to      |                 |                 |                 |
| reduce the      |                 |                 |                 |
| assessed level  |                 |                 |                 |
| of control risk |                 |                 |                 |
| for certain     |                 |                 |                 |
| financial       |                 |                 |                 |
| statement       |                 |                 |                 |
| assertions,     |                 |                 |                 |
| what are your   |                 |                 |                 |
| policies and    |                 |                 |                 |
| procedures for  |                 |                 |                 |
| considering the |                 |                 |                 |
| availability of |                 |                 |                 |
| additional      |                 |                 |                 |
| sufficient      |                 |                 |                 |
| evidential      |                 |                 |                 |
| matter and the  |                 |                 |                 |
| need to test    |                 |                 |                 |
| controls? (AU   |                 |                 |                 |
| 319.61,         |                 |                 |                 |
| 319A.43)        |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 8.5 When        |                 |                 |                 |
| assessing       |                 |                 |                 |
| control risk    |                 |                 |                 |
| below the       |                 |                 |                 |
| maximum, what   |                 |                 |                 |
| are your        |                 |                 |                 |
| policies and    |                 |                 |                 |
| procedures for: |                 |                 |                 |
| (AU 319.48,     |                 |                 |                 |
| 319A.30)        |                 |                 |                 |
|                 |                 |                 |                 |
| > a\.           |                 |                 |                 |
| > Identifying   |                 |                 |                 |
| > specific      |                 |                 |                 |
| > internal      |                 |                 |                 |
| > control       |                 |                 |                 |
| > structure     |                 |                 |                 |
| > policies and  |                 |                 |                 |
| > procedures    |                 |                 |                 |
| > relevant to   |                 |                 |                 |
| > specific      |                 |                 |                 |
| > assertions or |                 |                 |                 |
| > objectives of |                 |                 |                 |
| > internal      |                 |                 |                 |
| > control?      |                 |                 |                 |
| >               |                 |                 |                 |
| > b\.           |                 |                 |                 |
| > Performing    |                 |                 |                 |
| > tests of      |                 |                 |                 |
| > controls to   |                 |                 |                 |
| > evaluate the  |                 |                 |                 |
| > effectiveness |                 |                 |                 |
| > of such       |                 |                 |                 |
| > policies and  |                 |                 |                 |
| > procedures?   |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 8.6 What are    |                 |                 |                 |
| your policies   |                 |                 |                 |
| and procedures  |                 |                 |                 |
| for requiring   |                 |                 |                 |
| your auditors   |                 |                 |                 |
| to document     |                 |                 |                 |
| their basis for |                 |                 |                 |
| conclusions     |                 |                 |                 |
| about the       |                 |                 |                 |
| assessed level  |                 |                 |                 |
| of control      |                 |                 |                 |
| risk? (AU       |                 |                 |                 |
| 319.57,         |                 |                 |                 |
| 319A.39)        |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **Attestation   |                 |                 |                 |
| Engagements**   |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 8.7 What        |                 | **6.13** The    |                 |
| procedures are  |                 | standard        |                 |
| used to ensure  |                 | related to      |                 |
| that auditors   |                 | internal        |                 |
| obtain a        |                 | control for     |                 |
| sufficient      |                 | ex              |                 |
| understanding   |                 | amination-level |                 |
| of internal     |                 | attestation     |                 |
| control that is |                 | engagements     |                 |
| material to the |                 | performed in    |                 |
| subject matter  |                 | accordance with |                 |
| or assertion to |                 | GAGAS is:       |                 |
| plan the        |                 |                 |                 |
| engagement and  |                 | > In planning   |                 |
| design          |                 | > ex            |                 |
| procedures to   |                 | amination-level |                 |
| achieve the     |                 | > attestation   |                 |
| objectives of   |                 | > engagements,  |                 |
| the attestation |                 | > auditors      |                 |
| engagements?    |                 | > should obtain |                 |
| (GAGAS          |                 | > a sufficient  |                 |
| 6.13-6.14)      |                 | > understanding |                 |
|                 |                 | > of internal   |                 |
|                 |                 | > control that  |                 |
|                 |                 | > is material   |                 |
|                 |                 | > to the        |                 |
|                 |                 | > subject       |                 |
|                 |                 | > matter or     |                 |
|                 |                 | > assertion to  |                 |
|                 |                 | > plan the      |                 |
|                 |                 | > engagement    |                 |
|                 |                 | > and design    |                 |
|                 |                 | > procedures to |                 |
|                 |                 | > achieve the   |                 |
|                 |                 | > objectives of |                 |
|                 |                 | > the           |                 |
|                 |                 | > attestation   |                 |
|                 |                 | > engagement.   |                 |
+-----------------+-----------------+-----------------+-----------------+
| **Performance   |                 |                 |                 |
| Audits**        |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 8.8 What are    |                 | **7.11** The    |                 |
| your policies   |                 | lack of         |                 |
| and procedures  |                 | administrative  |                 |
| to ensure that  |                 | continuity in   |                 |
| auditors obtain |                 | government      |                 |
| an              |                 | units because   |                 |
| understanding   |                 | of changes in   |                 |
| of internal     |                 | elected         |                 |
| control as it   |                 | legislative     |                 |
| relates to the  |                 | bodies and in   |                 |
| specific        |                 | other           |                 |
| objectives and  |                 | government      |                 |
| scope of the    |                 | officials       |                 |
| audit? (GAGAS   |                 | increases the   |                 |
| 7.11-7.16)      |                 | need for        |                 |
|                 |                 | effective       |                 |
|                 |                 | internal        |                 |
|                 |                 | control.        |                 |
|                 |                 | Auditors should |                 |
|                 |                 | obtain an       |                 |
|                 |                 | understanding   |                 |
|                 |                 | of internal     |                 |
|                 |                 | control         |                 |
|                 |                 | significant to  |                 |
|                 |                 | the audit       |                 |
|                 |                 | objectives and  |                 |
|                 |                 | consider        |                 |
|                 |                 | whether         |                 |
|                 |                 | specific        |                 |
|                 |                 | internal        |                 |
|                 |                 | control         |                 |
|                 |                 | procedures have |                 |
|                 |                 | been properly   |                 |
|                 |                 | designed and    |                 |
|                 |                 | placed in       |                 |
|                 |                 | operation.      |                 |
|                 |                 | Auditors also   |                 |
|                 |                 | need to         |                 |
|                 |                 | consider        |                 |
|                 |                 | whether they    |                 |
|                 |                 | plan to modify  |                 |
|                 |                 | the nature,     |                 |
|                 |                 | timing, or      |                 |
|                 |                 | extent of their |                 |
|                 |                 | audit           |                 |
|                 |                 | procedures      |                 |
|                 |                 | based on the    |                 |
|                 |                 | effectiveness   |                 |
|                 |                 | of internal     |                 |
|                 |                 | controls. If    |                 |
|                 |                 | so, auditors    |                 |
|                 |                 | should include  |                 |
|                 |                 | specific tests  |                 |
|                 |                 | of the          |                 |
|                 |                 | effectiveness   |                 |
|                 |                 | of internal     |                 |
|                 |                 | control and     |                 |
|                 |                 | consider the    |                 |
|                 |                 | results in      |                 |
|                 |                 | designing audit |                 |
|                 |                 | procedur        |                 |
|                 |                 | es.^ ^Officials |                 |
|                 |                 | of the audited  |                 |
|                 |                 | entity are      |                 |
|                 |                 | responsible for |                 |
|                 |                 | establishing    |                 |
|                 |                 | effective       |                 |
|                 |                 | internal        |                 |
|                 |                 | control.        |                 |
+-----------------+-----------------+-----------------+-----------------+
|                 |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **9. [LEGAL AND |                 |                 |                 |
| REGULATORY      |                 |                 |                 |
| REQUIREMENTS    |                 |                 |                 |
| ]{.underline}** |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **Financial     |                 |                 |                 |
| Audits**        |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 9.1 For         |                 |                 |                 |
| determining     |                 |                 |                 |
| compliance with |                 |                 |                 |
| laws and        |                 |                 |                 |
| regulations in  |                 |                 |                 |
| financial       |                 |                 |                 |
| audits, what    |                 |                 |                 |
| are your        |                 |                 |                 |
| policies and    |                 |                 |                 |
| procedures that |                 |                 |                 |
| require:        |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| > a\. Auditors  |                 | **4.17** The    |                 |
| > design the    |                 | standard        |                 |
| > audit to      |                 | related to      |                 |
| > provide       |                 | violations of   |                 |
| > reasonable    |                 | contract        |                 |
| > assurance of  |                 | provisions or   |                 |
| > detecting     |                 | grant           |                 |
| > material      |                 | agreements or   |                 |
| > misstatements |                 | abuse for       |                 |
| > resulting     |                 | financial       |                 |
| > from          |                 | audits          |                 |
| > violations of |                 | performed in    |                 |
| > provisions of |                 | accordance with |                 |
| > contracts or  |                 | GAGAS is:       |                 |
| > grant         |                 |                 |                 |
| > agreements or |                 | > a\. Auditors  |                 |
| > from abuse?   |                 | > should design |                 |
| > (GAGAS        |                 | > the audit to  |                 |
| > 4.17-4.20)    |                 | > provide       |                 |
|                 |                 | > reasonable    |                 |
|                 |                 | > assurance of  |                 |
|                 |                 | > detecting     |                 |
|                 |                 | > material      |                 |
|                 |                 | > misstatements |                 |
|                 |                 | > resulting     |                 |
|                 |                 | > from          |                 |
|                 |                 | > violations of |                 |
|                 |                 | > provisions of |                 |
|                 |                 | > contracts or  |                 |
|                 |                 | > grant         |                 |
|                 |                 | > agreements    |                 |
|                 |                 | > that have a   |                 |
|                 |                 | > direct and    |                 |
|                 |                 | > material      |                 |
|                 |                 | > effect on the |                 |
|                 |                 | > determination |                 |
|                 |                 | > of financial  |                 |
|                 |                 | > statement     |                 |
|                 |                 | > amounts or    |                 |
|                 |                 | > other         |                 |
|                 |                 | > financial     |                 |
|                 |                 | > data          |                 |
|                 |                 | > significant   |                 |
|                 |                 | > to the audit  |                 |
|                 |                 | > objectives.   |                 |
|                 |                 | > If specific   |                 |
|                 |                 | > information   |                 |
|                 |                 | > comes to the  |                 |
|                 |                 | > auditors'     |                 |
|                 |                 | > attention     |                 |
|                 |                 | > that provides |                 |
|                 |                 | > evidence      |                 |
|                 |                 | > concerning    |                 |
|                 |                 | > the existence |                 |
|                 |                 | > of possible   |                 |
|                 |                 | > violations of |                 |
|                 |                 | > provisions of |                 |
|                 |                 | > contracts or  |                 |
|                 |                 | > grant         |                 |
|                 |                 | > agreements    |                 |
|                 |                 | > that could    |                 |
|                 |                 | > have a        |                 |
|                 |                 | > material      |                 |
|                 |                 | > indirect      |                 |
|                 |                 | > effect on the |                 |
|                 |                 | > determination |                 |
|                 |                 | > of financial  |                 |
|                 |                 | > statement     |                 |
|                 |                 | > amounts or    |                 |
|                 |                 | > other         |                 |
|                 |                 | > financial     |                 |
|                 |                 | > data          |                 |
|                 |                 | > significant   |                 |
|                 |                 | > to the audit  |                 |
|                 |                 | > objectives,   |                 |
|                 |                 | > auditors      |                 |
|                 |                 | > should apply  |                 |
|                 |                 | > audit         |                 |
|                 |                 | > procedures    |                 |
|                 |                 | > specifically  |                 |
|                 |                 | > directed to   |                 |
|                 |                 | > ascertain     |                 |
|                 |                 | > whether       |                 |
|                 |                 | > violations of |                 |
|                 |                 | > provisions of |                 |
|                 |                 | > contracts or  |                 |
|                 |                 | > grant         |                 |
|                 |                 | > agreements    |                 |
|                 |                 | > have occurred |                 |
|                 |                 | > or are likely |                 |
|                 |                 | > to have       |                 |
|                 |                 | > occurred.     |                 |
|                 |                 | >               |                 |
|                 |                 | > b\. Auditors  |                 |
|                 |                 | > should be     |                 |
|                 |                 | > alert to      |                 |
|                 |                 | > situations or |                 |
|                 |                 | > transactions  |                 |
|                 |                 | > that could be |                 |
|                 |                 | > indicative of |                 |
|                 |                 | > abuse, and if |                 |
|                 |                 | > indications   |                 |
|                 |                 | > of abuse      |                 |
|                 |                 | > exist that    |                 |
|                 |                 | > could         |                 |
|                 |                 | > significantly |                 |
|                 |                 | > affect the    |                 |
|                 |                 | > financial     |                 |
|                 |                 | > statement     |                 |
|                 |                 | > amounts or    |                 |
|                 |                 | > other         |                 |
|                 |                 | > financial     |                 |
|                 |                 | > data,         |                 |
|                 |                 | > auditors      |                 |
|                 |                 | > should apply  |                 |
|                 |                 | > audit         |                 |
|                 |                 | > procedures    |                 |
|                 |                 | > specifically  |                 |
|                 |                 | > directed to   |                 |
|                 |                 | > ascertain     |                 |
|                 |                 | > whether abuse |                 |
|                 |                 | > has occurred  |                 |
|                 |                 | > and the       |                 |
|                 |                 | > effect on the |                 |
|                 |                 | > financial     |                 |
|                 |                 | > statement     |                 |
|                 |                 | > amounts or    |                 |
|                 |                 | > other         |                 |
|                 |                 | > financial     |                 |
|                 |                 | > data.         |                 |
+-----------------+-----------------+-----------------+-----------------+
| > b\. The       |                 | **4.18** AICPA  |                 |
| > auditor is    |                 | standards and   |                 |
| > aware of the  |                 | GAGAS require   |                 |
| > possibility   |                 | auditors to     |                 |
| > of illegal    |                 | assess the risk |                 |
| > acts that     |                 | of material to  |                 |
| > could have an |                 | the audit       |                 |
| > indirect and  |                 | objectives due  |                 |
| > material      |                 | to fraud and to |                 |
| > effect on the |                 | consider that   |                 |
| > financial     |                 | assessment in   |                 |
| > statements    |                 | designing the   |                 |
| > and, if       |                 | audit           |                 |
| > evidence      |                 | procedures to   |                 |
| > indicates     |                 | be              |                 |
| > that such     |                 | performed.^ ^   |                 |
| > acts may have |                 | Auditors are    |                 |
| > occurred, to  |                 | also required   |                 |
| > perform       |                 | to design the   |                 |
| > procedures to |                 | audit to        |                 |
| > determine if  |                 | provide         |                 |
| > such acts     |                 | reasonable      |                 |
| > occurred?     |                 | assurance of    |                 |
| > (GAGAS 4.18)  |                 | detecting       |                 |
| >               |                 | material        |                 |
| > c\. When      |                 | misstatements   |                 |
| > information   |                 | resulting from  |                 |
| > comes to the  |                 | direct and      |                 |
| > auditor's     |                 | material        |                 |
| > attention     |                 | illegal acts    |                 |
| > indicating    |                 | (violations of  |                 |
| > that abuse    |                 | laws and        |                 |
| > may have      |                 | regulations)    |                 |
| > occurred, do  |                 | and to be aware |                 |
| > auditors      |                 | of the          |                 |
| > consider      |                 | possibility     |                 |
| > whether the   |                 | that indirect   |                 |
| > possible      |                 | illegal         |                 |
| > abuse could   |                 | acts^ ^may have |                 |
| > significantly |                 | occurred. Under |                 |
| > affect the    |                 | GAGAS, auditors |                 |
| > financial     |                 | have the same   |                 |
| > statement     |                 | r               |                 |
| > amounts or    |                 | esponsibilities |                 |
| > other         |                 | for detecting   |                 |
| > financial     |                 | material        |                 |
| > data? (GAGAS  |                 | misstatements   |                 |
| > 4.19)         |                 | arising from    |                 |
|                 |                 | violations of   |                 |
|                 |                 | provisions of   |                 |
|                 |                 | contracts or    |                 |
|                 |                 | grant           |                 |
|                 |                 | agreements as   |                 |
|                 |                 | they do for     |                 |
|                 |                 | detecting those |                 |
|                 |                 | arising from    |                 |
|                 |                 | fraud and       |                 |
|                 |                 | illegal acts.   |                 |
|                 |                 | Auditors should |                 |
|                 |                 | design the      |                 |
|                 |                 | audit to        |                 |
|                 |                 | provide         |                 |
|                 |                 | reasonable      |                 |
|                 |                 | assurance of    |                 |
|                 |                 | detecting       |                 |
|                 |                 | material        |                 |
|                 |                 | misstatements   |                 |
|                 |                 | resulting from  |                 |
|                 |                 | direct and      |                 |
|                 |                 | material        |                 |
|                 |                 | violations of   |                 |
|                 |                 | provisions of   |                 |
|                 |                 | contracts or    |                 |
|                 |                 | grant           |                 |
|                 |                 | agreements. If  |                 |
|                 |                 | specific        |                 |
|                 |                 | information     |                 |
|                 |                 | comes to the    |                 |
|                 |                 | auditors'       |                 |
|                 |                 | attention that  |                 |
|                 |                 | provides        |                 |
|                 |                 | evidence        |                 |
|                 |                 | concerning the  |                 |
|                 |                 | existence of    |                 |
|                 |                 | possible        |                 |
|                 |                 | violations of   |                 |
|                 |                 | provisions of   |                 |
|                 |                 | contracts or    |                 |
|                 |                 | grant           |                 |
|                 |                 | agreements that |                 |
|                 |                 | could have a    |                 |
|                 |                 | material        |                 |
|                 |                 | indirect effect |                 |
|                 |                 | on the          |                 |
|                 |                 | financial       |                 |
|                 |                 | statements or   |                 |
|                 |                 | significant     |                 |
|                 |                 | indirect effect |                 |
|                 |                 | on other        |                 |
|                 |                 | financial data  |                 |
|                 |                 | needed to       |                 |
|                 |                 | achieve audit   |                 |
|                 |                 | objectives,     |                 |
|                 |                 | auditors should |                 |
|                 |                 | apply audit     |                 |
|                 |                 | procedures      |                 |
|                 |                 | specifically    |                 |
|                 |                 | directed to     |                 |
|                 |                 | ascertain       |                 |
|                 |                 | whether         |                 |
|                 |                 | violations have |                 |
|                 |                 | occurred or are |                 |
|                 |                 | likely to have  |                 |
|                 |                 | occurred.       |                 |
+-----------------+-----------------+-----------------+-----------------+
| **Attestation   |                 |                 |                 |
| Engagements**   |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 9.2 What are    |                 | **6.15** The    |                 |
| your policies   |                 | standard        |                 |
| and procedures  |                 | related to      |                 |
| for providing   |                 | fraud, illegal  |                 |
| reasonable      |                 | acts,           |                 |
| assurance of    |                 | violations of   |                 |
| detecting that  |                 | provisions of   |                 |
| fraud, illegal  |                 | contracts or    |                 |
| acts,           |                 | grant           |                 |
| violations of   |                 | agreements, and |                 |
| provisions of   |                 | abuse for       |                 |
| contract or     |                 | attestation     |                 |
| grant           |                 | engagements     |                 |
| agreements and  |                 | performed in    |                 |
| abuse that      |                 | accordance with |                 |
| could have a    |                 | GAGAS.          |                 |
| material effect |                 |                 |                 |
| on the subject  |                 |                 |                 |
| matter is       |                 |                 |                 |
| detected        |                 |                 |                 |
| consistent with |                 |                 |                 |
| the level of    |                 |                 |                 |
| the engagement? |                 |                 |                 |
| (GAGAS          |                 |                 |                 |
| 6.15-6.20)      |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **Performance   |                 |                 |                 |
| Audits**        |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 9.3 What are    |                 | **7.17** When   |                 |
| your policies   |                 | laws,           |                 |
| and procedures  |                 | regulations, or |                 |
| for detecting   |                 | provisions of   |                 |
| violations of   |                 | contracts or    |                 |
| contract        |                 | grant           |                 |
| provisions, or  |                 | agreements are  |                 |
| grant           |                 | significant to  |                 |
| agreements or   |                 | the audit       |                 |
| fraud that      |                 | objectives,     |                 |
| could           |                 | auditors should |                 |
| significantly   |                 | design the      |                 |
| affect the      |                 | audit           |                 |
| audit results?  |                 | methodology and |                 |
| Include         |                 | procedures to   |                 |
| policies and    |                 | provide         |                 |
| procedures      |                 | reasonable      |                 |
| relating to     |                 | assurance of    |                 |
| obtaining       |                 | detecting       |                 |
| applicable laws |                 | violations that |                 |
| and regulations |                 | could have a    |                 |
| (etc.)          |                 | significant     |                 |
| conducting and  |                 | effect on the   |                 |
| documenting     |                 | audit results.  |                 |
| risk            |                 | Auditors should |                 |
| assessments and |                 | determine which |                 |
| developing      |                 | laws,           |                 |
| applicable      |                 | regulations,    |                 |
| audit steps to  |                 | and provisions  |                 |
| provide         |                 | of contracts or |                 |
| reasonable      |                 | grant           |                 |
| assurance of    |                 | agreements are  |                 |
| detection.      |                 | significant to  |                 |
| (GAGAS          |                 | the audit       |                 |
| 7.17-7.27).     |                 | objectives and  |                 |
|                 |                 | assess the risk |                 |
|                 |                 | that illegal    |                 |
|                 |                 | acts or         |                 |
|                 |                 | violations of   |                 |
|                 |                 | provisions of   |                 |
|                 |                 | contracts or    |                 |
|                 |                 | grant           |                 |
|                 |                 | agreements      |                 |
|                 |                 | could occur.    |                 |
|                 |                 | Based on that   |                 |
|                 |                 | risk            |                 |
|                 |                 | assessment, the |                 |
|                 |                 | auditors design |                 |
|                 |                 | and perform     |                 |
|                 |                 | procedures to   |                 |
|                 |                 | provide         |                 |
|                 |                 | reasonable      |                 |
|                 |                 | assurance of    |                 |
|                 |                 | detecting       |                 |
|                 |                 | significant     |                 |
|                 |                 | instances of    |                 |
|                 |                 | illegal acts or |                 |
|                 |                 | violations of   |                 |
|                 |                 | provisions of   |                 |
|                 |                 | contracts or    |                 |
|                 |                 | grant           |                 |
|                 |                 | agreements.     |                 |
|                 |                 | Auditors should |                 |
|                 |                 | include audit   |                 |
|                 |                 | ocumentation on |                 |
|                 |                 | their           |                 |
|                 |                 | assessment of   |                 |
|                 |                 | risk.           |                 |
+-----------------+-----------------+-----------------+-----------------+
|                 |                 | **7.21** In     |                 |
|                 |                 | planning the    |                 |
|                 |                 | audit, auditors |                 |
|                 |                 | should consider |                 |
|                 |                 | risks due to    |                 |
|                 |                 | fraud that      |                 |
|                 |                 | could           |                 |
|                 |                 | significantly   |                 |
|                 |                 | affect their    |                 |
|                 |                 | audit           |                 |
|                 |                 | objectives and  |                 |
|                 |                 | the results of  |                 |
|                 |                 | their audit.    |                 |
|                 |                 | The audit team  |                 |
|                 |                 | should discuss  |                 |
|                 |                 | potential fraud |                 |
|                 |                 | risks,          |                 |
|                 |                 | considering     |                 |
|                 |                 | fraud factors   |                 |
|                 |                 | such as         |                 |
|                 |                 | individuals'    |                 |
|                 |                 | incentives or   |                 |
|                 |                 | pressures to    |                 |
|                 |                 | commit fraud,   |                 |
|                 |                 | the opportunity |                 |
|                 |                 | for fraud to    |                 |
|                 |                 | occur, and      |                 |
|                 |                 | r               |                 |
|                 |                 | ationalizations |                 |
|                 |                 | or attitudes    |                 |
|                 |                 | that could      |                 |
|                 |                 | allow           |                 |
|                 |                 | individuals to  |                 |
|                 |                 | commit fraud.   |                 |
|                 |                 | Auditors should |                 |
|                 |                 | gather and      |                 |
|                 |                 | assess          |                 |
|                 |                 | information     |                 |
|                 |                 | necessary to    |                 |
|                 |                 | identify fraud  |                 |
|                 |                 | risks which     |                 |
|                 |                 | could be        |                 |
|                 |                 | relevant to the |                 |
|                 |                 | audit           |                 |
|                 |                 | objectives or   |                 |
|                 |                 | affect the      |                 |
|                 |                 | results of      |                 |
|                 |                 | their audit.    |                 |
|                 |                 | For example,    |                 |
|                 |                 | auditors may    |                 |
|                 |                 | need to obtain  |                 |
|                 |                 | information     |                 |
|                 |                 | through         |                 |
|                 |                 | discussion with |                 |
|                 |                 | officials of    |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity or       |                 |
|                 |                 | through other   |                 |
|                 |                 | means to        |                 |
|                 |                 | determine the   |                 |
|                 |                 | susceptibility  |                 |
|                 |                 | of the program  |                 |
|                 |                 | to fraud, the   |                 |
|                 |                 | status of       |                 |
|                 |                 | internal        |                 |
|                 |                 | controls the    |                 |
|                 |                 | entity has      |                 |
|                 |                 | established to  |                 |
|                 |                 | detect and      |                 |
|                 |                 | prevent fraud,  |                 |
|                 |                 | or the risk     |                 |
|                 |                 | that officials  |                 |
|                 |                 | of the audited  |                 |
|                 |                 | entity could    |                 |
|                 |                 | override        |                 |
|                 |                 | internal        |                 |
|                 |                 | control.        |                 |
|                 |                 | Auditors should |                 |
|                 |                 | exercise        |                 |
|                 |                 | professional    |                 |
|                 |                 | skepticism in   |                 |
|                 |                 | assessing these |                 |
|                 |                 | risks to        |                 |
|                 |                 | determine which |                 |
|                 |                 | factors or      |                 |
|                 |                 | risks could     |                 |
|                 |                 | significantly   |                 |
|                 |                 | affect the      |                 |
|                 |                 | results of      |                 |
|                 |                 | their work if   |                 |
|                 |                 | fraud has       |                 |
|                 |                 | occurred or is  |                 |
|                 |                 | likely to have  |                 |
|                 |                 | occurred.       |                 |
+-----------------+-----------------+-----------------+-----------------+
| 9.4 What        |                 | **7.23**        |                 |
| policies or     |                 | Auditors should |                 |
| procedures do   |                 | also be alert   |                 |
| you have for    |                 | to situations   |                 |
| assuring that   |                 | or transactions |                 |
| audit staff     |                 | that could be   |                 |
| members are     |                 | indicative of   |                 |
| alert to        |                 | fraud. When     |                 |
| situations or   |                 | information     |                 |
| transactions    |                 | comes to the    |                 |
| that are        |                 | auditors'       |                 |
| indicative of   |                 | attention       |                 |
| illegal acts or |                 | (through audit  |                 |
| abuse? What     |                 | procedures,     |                 |
| actions are     |                 | allegations     |                 |
| auditors        |                 | received        |                 |
| required to     |                 | through fraud   |                 |
| take when fraud |                 | hotlines, or    |                 |
| indicators are  |                 | other means)    |                 |
| present? (GAGAS |                 | indicating that |                 |
| 7.23-7.25)      |                 | fraud may have  |                 |
|                 |                 | occurred,       |                 |
|                 |                 | auditors should |                 |
|                 |                 | consider        |                 |
|                 |                 | whether the     |                 |
|                 |                 | possible fraud  |                 |
|                 |                 | could           |                 |
|                 |                 | significantly   |                 |
|                 |                 | affect the      |                 |
|                 |                 | audit results.  |                 |
|                 |                 | If the fraud    |                 |
|                 |                 | could           |                 |
|                 |                 | significantly   |                 |
|                 |                 | affect the      |                 |
|                 |                 | audit results,  |                 |
|                 |                 | auditors should |                 |
|                 |                 | extend the      |                 |
|                 |                 | audit steps and |                 |
|                 |                 | procedures, as  |                 |
|                 |                 | necessary, to   |                 |
|                 |                 | (1) determine   |                 |
|                 |                 | if fraud likely |                 |
|                 |                 | has occurred    |                 |
|                 |                 | and (2) if so,  |                 |
|                 |                 | determine its   |                 |
|                 |                 | effect on the   |                 |
|                 |                 | audit results.  |                 |
+-----------------+-----------------+-----------------+-----------------+
| 9.5 What are    |                 | **7.19**        |                 |
| your policies   |                 | Auditors may    |                 |
| and procedures  |                 | find it         |                 |
| for consulting  |                 | necessary to    |                 |
| with legal      |                 | rely on the     |                 |
| counsel when    |                 | work of legal   |                 |
| questions arise |                 | counsel to (1)  |                 |
| about the       |                 | determine those |                 |
| application or  |                 | laws and        |                 |
| interpretation  |                 | regulations     |                 |
| of laws and     |                 | that are        |                 |
| regulations?    |                 | significant to  |                 |
| (GAGAS 7.19)    |                 | the audit       |                 |
|                 |                 | objectives, (2) |                 |
|                 |                 | design tests of |                 |
|                 |                 | compliance with |                 |
|                 |                 | laws and        |                 |
|                 |                 | regulations, or |                 |
|                 |                 | (3) evaluate    |                 |
|                 |                 | the results of  |                 |
|                 |                 | those tests.    |                 |
|                 |                 | Auditors also   |                 |
|                 |                 | may find it     |                 |
|                 |                 | necessary to    |                 |
|                 |                 | rely on the     |                 |
|                 |                 | work of legal   |                 |
|                 |                 | counsel when    |                 |
|                 |                 | audit           |                 |
|                 |                 | objectives      |                 |
|                 |                 | require testing |                 |
|                 |                 | compliance with |                 |
|                 |                 | provisions of   |                 |
|                 |                 | contracts or    |                 |
|                 |                 | grant           |                 |
|                 |                 | agreements.     |                 |
|                 |                 | Depending on    |                 |
|                 |                 | the             |                 |
|                 |                 | circumstances   |                 |
|                 |                 | of the audit,   |                 |
|                 |                 | auditors may    |                 |
|                 |                 | find it         |                 |
|                 |                 | necessary to    |                 |
|                 |                 | obtain          |                 |
|                 |                 | information on  |                 |
|                 |                 | compliance      |                 |
|                 |                 | matters from    |                 |
|                 |                 | others, such as |                 |
|                 |                 | investigative   |                 |
|                 |                 | staff, other    |                 |
|                 |                 | audit           |                 |
|                 |                 | organizations   |                 |
|                 |                 | or government   |                 |
|                 |                 | entities that   |                 |
|                 |                 | provided        |                 |
|                 |                 | assistance to   |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity, or the  |                 |
|                 |                 | applicable law  |                 |
|                 |                 | enforcement     |                 |
|                 |                 | authority.      |                 |
+-----------------+-----------------+-----------------+-----------------+
|                 |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **10.           |                 |                 |                 |
| [REPORTING      |                 |                 |                 |
| STANDARDS       |                 |                 |                 |
| ]{.underline}** |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **All Audits**  |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.1 What are   |                 |                 |                 |
| your policies   |                 |                 |                 |
| and procedures  |                 |                 |                 |
| regarding a     |                 |                 |                 |
| statement in    |                 |                 |                 |
| audit reports   |                 |                 |                 |
| that the audit  |                 |                 |                 |
| was made in     |                 |                 |                 |
| accordance with |                 |                 |                 |
| generally       |                 |                 |                 |
| accepted        |                 |                 |                 |
| government      |                 |                 |                 |
| auditing        |                 |                 |                 |
| standards?      |                 |                 |                 |
| (GAGAS 5.05,    |                 |                 |                 |
| 6.29, 8.30)     |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.2 What are   |                 |                 |                 |
| your policies   |                 |                 |                 |
| and procedures  |                 |                 |                 |
| requiring the   |                 |                 |                 |
| reporting of    |                 |                 |                 |
| (1)             |                 |                 |                 |
| irregularities  |                 |                 |                 |
| and illegal     |                 |                 |                 |
| acts, except    |                 |                 |                 |
| those that are  |                 |                 |                 |
| clearly         |                 |                 |                 |
| i               |                 |                 |                 |
| nconsequential, |                 |                 |                 |
| (2) other       |                 |                 |                 |
| material        |                 |                 |                 |
| noncompliance,  |                 |                 |                 |
| and (3)         |                 |                 |                 |
| reportable      |                 |                 |                 |
| conditions,     |                 |                 |                 |
| including (for  |                 |                 |                 |
| financial       |                 |                 |                 |
| statement       |                 |                 |                 |
| audits only)    |                 |                 |                 |
| identification  |                 |                 |                 |
| of those that   |                 |                 |                 |
| are             |                 |                 |                 |
| individually or |                 |                 |                 |
| in the          |                 |                 |                 |
| aggregate       |                 |                 |                 |
| considered to   |                 |                 |                 |
| be material     |                 |                 |                 |
| weaknesses?     |                 |                 |                 |
| (GAGAS          |                 |                 |                 |
| 5.12-5.14,      |                 |                 |                 |
| 6.32-6.40,      |                 |                 |                 |
| 8.16-8.18)      |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.3 What are   |                 |                 |                 |
| your policies   |                 |                 |                 |
| and procedures  |                 |                 |                 |
| regarding the   |                 |                 |                 |
| preparation of  |                 |                 |                 |
| appropriate     |                 |                 |                 |
| documentation   |                 |                 |                 |
| for audits and  |                 |                 |                 |
| attestation     |                 |                 |                 |
| engagements     |                 |                 |                 |
| that are        |                 |                 |                 |
| terminated      |                 |                 |                 |
| prior to        |                 |                 |                 |
| completion?     |                 |                 |                 |
| (GAGAS 4.09,    |                 |                 |                 |
| 6.09, 7.40)     |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.4 What are   |                 | **8.54** The    |                 |
| your policies   |                 | reporting       |                 |
| and procedures  |                 | standard        |                 |
| regarding       |                 | related to      |                 |
| report issuance |                 | report issuance |                 |
| and             |                 | and             |                 |
| distribution?   |                 | distribution    |                 |
| (GAGAS          |                 | for performance |                 |
| 8.54-8.57)      |                 | audits          |                 |
|                 |                 | performed in    |                 |
|                 |                 | accordance with |                 |
|                 |                 | GAGAS is:       |                 |
|                 |                 |                 |                 |
|                 |                 | > Government    |                 |
|                 |                 | > auditors      |                 |
|                 |                 | > should submit |                 |
|                 |                 | > audit reports |                 |
|                 |                 | > to the        |                 |
|                 |                 | > appropriate   |                 |
|                 |                 | > officials of  |                 |
|                 |                 | > the audited   |                 |
|                 |                 | > entity and to |                 |
|                 |                 | > the           |                 |
|                 |                 | > appropriate   |                 |
|                 |                 | > officials of  |                 |
|                 |                 | > the           |                 |
|                 |                 | > organizations |                 |
|                 |                 | > requiring or  |                 |
|                 |                 | > arranging for |                 |
|                 |                 | > the audits,   |                 |
|                 |                 | > including     |                 |
|                 |                 | > external      |                 |
|                 |                 | > funding       |                 |
|                 |                 | >               |                 |
|                 |                 |  organizations, |                 |
|                 |                 | > such as       |                 |
|                 |                 | > legislative   |                 |
|                 |                 | > bodies,       |                 |
|                 |                 | > unless legal  |                 |
|                 |                 | > restrictions  |                 |
|                 |                 | > prevent it.   |                 |
|                 |                 | > Auditors      |                 |
|                 |                 | > should also   |                 |
|                 |                 | > send copies   |                 |
|                 |                 | > of the        |                 |
|                 |                 | > reports to    |                 |
|                 |                 | > other         |                 |
|                 |                 | > officials who |                 |
|                 |                 | > have legal    |                 |
|                 |                 | > oversight     |                 |
|                 |                 | > authority or  |                 |
|                 |                 | > who may be    |                 |
|                 |                 | > responsible   |                 |
|                 |                 | > for acting on |                 |
|                 |                 | > audit         |                 |
|                 |                 | > findings and  |                 |
|                 |                 | > r             |                 |
|                 |                 | ecommendations, |                 |
|                 |                 | > and also to   |                 |
|                 |                 | > others        |                 |
|                 |                 | > authorized to |                 |
|                 |                 | > receive such  |                 |
|                 |                 | > reports.      |                 |
|                 |                 | > Unless the    |                 |
|                 |                 | > report is     |                 |
|                 |                 | > restricted by |                 |
|                 |                 | > law or        |                 |
|                 |                 | > regulation,   |                 |
|                 |                 | > or contains   |                 |
|                 |                 | > privileged or |                 |
|                 |                 | > confidential  |                 |
|                 |                 | > information,  |                 |
|                 |                 | > auditors      |                 |
|                 |                 | > should        |                 |
|                 |                 | > clarify that  |                 |
|                 |                 | > copies are    |                 |
|                 |                 | > made          |                 |
|                 |                 | > available for |                 |
|                 |                 | > public        |                 |
|                 |                 | > inspection.   |                 |
|                 |                 | > Nongovernment |                 |
|                 |                 | > auditors      |                 |
|                 |                 | > should        |                 |
|                 |                 | > clarify       |                 |
|                 |                 | > report        |                 |
|                 |                 | > distribution  |                 |
|                 |                 | > r             |                 |
|                 |                 | esponsibilities |                 |
|                 |                 | > with the      |                 |
|                 |                 | > party         |                 |
|                 |                 | > contracting   |                 |
|                 |                 | > for the audit |                 |
|                 |                 | > and follow    |                 |
|                 |                 | > the           |                 |
|                 |                 | > agreements    |                 |
|                 |                 | > reached.      |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.5 What are   |                 | **8.31**        |                 |
| your policies   |                 | Auditors should |                 |
| and procedures  |                 | report the      |                 |
| regarding       |                 | views of        |                 |
| reporting the   |                 | responsible     |                 |
| views of        |                 | officials of    |                 |
| responsible     |                 | the audited     |                 |
| officials?      |                 | program         |                 |
| (GAGAS          |                 | concerning      |                 |
| 5.26-5.30,6.41- |                 | auditors'       |                 |
| 6.45,8.31-8.34) |                 | findings,       |                 |
|                 |                 | conclusions,    |                 |
|                 |                 | and             |                 |
|                 |                 | r               |                 |
|                 |                 | ecommendations; |                 |
|                 |                 | as well as      |                 |
|                 |                 | planned         |                 |
|                 |                 | corrective      |                 |
|                 |                 | actions. One of |                 |
|                 |                 | the most        |                 |
|                 |                 | effective ways  |                 |
|                 |                 | to ensure that  |                 |
|                 |                 | a report is     |                 |
|                 |                 | fair, complete, |                 |
|                 |                 | and objective   |                 |
|                 |                 | is to obtain    |                 |
|                 |                 | advance review  |                 |
|                 |                 | and comments by |                 |
|                 |                 | responsible     |                 |
|                 |                 | officials of    |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity and      |                 |
|                 |                 | others, as may  |                 |
|                 |                 | be appropriate. |                 |
|                 |                 | Including the   |                 |
|                 |                 | views of        |                 |
|                 |                 | responsible     |                 |
|                 |                 | officials       |                 |
|                 |                 | results in a    |                 |
|                 |                 | report that     |                 |
|                 |                 | presents not    |                 |
|                 |                 | only the        |                 |
|                 |                 | auditors'       |                 |
|                 |                 | findings,       |                 |
|                 |                 | conclusions,    |                 |
|                 |                 | and             |                 |
|                 |                 | r               |                 |
|                 |                 | ecommendations, |                 |
|                 |                 | but also what   |                 |
|                 |                 | the responsible |                 |
|                 |                 | officials of    |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity think    |                 |
|                 |                 | about the audit |                 |
|                 |                 | results and     |                 |
|                 |                 | what corrective |                 |
|                 |                 | actions         |                 |
|                 |                 | officials of    |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity plan to  |                 |
|                 |                 | take. Auditors  |                 |
|                 |                 | should include  |                 |
|                 |                 | in their report |                 |
|                 |                 | a copy of the   |                 |
|                 |                 | officials'      |                 |
|                 |                 | written         |                 |
|                 |                 | comments or a   |                 |
|                 |                 | summary of the  |                 |
|                 |                 | comments        |                 |
|                 |                 | received.       |                 |
+-----------------+-----------------+-----------------+-----------------+
| **Financial**   |                 | **5.03** The    |                 |
| **Audits**      |                 | four AICPA      |                 |
|                 |                 | generally       |                 |
| 10.6 What are   |                 | accepted        |                 |
| your policies   |                 | standards of    |                 |
| and procedures  |                 | reporting are   |                 |
| that ensure     |                 | as follows:     |                 |
| AICPA reporting |                 |                 |                 |
| standards are   |                 | > a\. The       |                 |
| followed,       |                 | > report shall  |                 |
| including SAS   |                 | > state whether |                 |
| 58 and 60? (AU  |                 | > the financial |                 |
| 508.01-508.85,  |                 | > statements    |                 |
| 623.01-623.34;  |                 | > are presented |                 |
| GAGAS 5.03)     |                 | > in accordance |                 |
|                 |                 | > with          |                 |
|                 |                 | > generally     |                 |
|                 |                 | > accepted      |                 |
|                 |                 | > accounting    |                 |
|                 |                 | > principles.   |                 |
|                 |                 | >               |                 |
|                 |                 | > b\. The       |                 |
|                 |                 | > report shall  |                 |
|                 |                 | > identify      |                 |
|                 |                 | > those         |                 |
|                 |                 | > circumstances |                 |
|                 |                 | > in which such |                 |
|                 |                 | > principles    |                 |
|                 |                 | > have not been |                 |
|                 |                 | > consistently  |                 |
|                 |                 | > observed in   |                 |
|                 |                 | > the current   |                 |
|                 |                 | > period in     |                 |
|                 |                 | > relation to   |                 |
|                 |                 | > the preceding |                 |
|                 |                 | > period.       |                 |
|                 |                 | >               |                 |
|                 |                 | > c\.           |                 |
|                 |                 | > Informative   |                 |
|                 |                 | > disclosures   |                 |
|                 |                 | > in the        |                 |
|                 |                 | > financial     |                 |
|                 |                 | > statements    |                 |
|                 |                 | > are to be     |                 |
|                 |                 | > regarded as   |                 |
|                 |                 | > reasonably    |                 |
|                 |                 | > adequate      |                 |
|                 |                 | > unless        |                 |
|                 |                 | > otherwise     |                 |
|                 |                 | > stated in the |                 |
|                 |                 | > report.       |                 |
|                 |                 | >               |                 |
|                 |                 | > d\. The       |                 |
|                 |                 | > report shall  |                 |
|                 |                 | > either        |                 |
|                 |                 | > contain an    |                 |
|                 |                 | > expression of |                 |
|                 |                 | > opinion       |                 |
|                 |                 | > regarding the |                 |
|                 |                 | > financial     |                 |
|                 |                 | > statements,   |                 |
|                 |                 | > taken as a    |                 |
|                 |                 | > whole, or an  |                 |
|                 |                 | > assertion to  |                 |
|                 |                 | > the effect    |                 |
|                 |                 | > that an       |                 |
|                 |                 | > opinion       |                 |
|                 |                 | > cannot be     |                 |
|                 |                 | > expressed.    |                 |
|                 |                 | > When an       |                 |
|                 |                 | > overall       |                 |
|                 |                 | > opinion       |                 |
|                 |                 | > cannot be     |                 |
|                 |                 | > expressed,    |                 |
|                 |                 | > the reasons   |                 |
|                 |                 | > therefor      |                 |
|                 |                 | > should be     |                 |
|                 |                 | > stated. In    |                 |
|                 |                 | > all cases     |                 |
|                 |                 | > where an      |                 |
|                 |                 | > auditor's     |                 |
|                 |                 | > name is       |                 |
|                 |                 | > associated    |                 |
|                 |                 | > with          |                 |
|                 |                 | > financial     |                 |
|                 |                 | > statements,   |                 |
|                 |                 | > the report    |                 |
|                 |                 | > should        |                 |
|                 |                 | > contain a     |                 |
|                 |                 | > clear-cut     |                 |
|                 |                 | > indication of |                 |
|                 |                 | > the character |                 |
|                 |                 | > of the        |                 |
|                 |                 | > auditor's     |                 |
|                 |                 | > work, if any, |                 |
|                 |                 | > and the       |                 |
|                 |                 | > degree of     |                 |
|                 |                 | >               |                 |
|                 |                 |  responsibility |                 |
|                 |                 | > the auditor   |                 |
|                 |                 | > is taking.    |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.7 What are   |                 | **5.09** For    |                 |
| your policies   |                 | audits of       |                 |
| and procedures  |                 | financial       |                 |
| that require a  |                 | statements in   |                 |
| written report  |                 | which auditors  |                 |
| on compliance   |                 | provide an      |                 |
| with laws and   |                 | opinion or      |                 |
| regulations and |                 | disclaimer,     |                 |
| internal        |                 | auditors should |                 |
| controls that   |                 | report the      |                 |
| includes the    |                 | scope of their  |                 |
| following:      |                 | testing of      |                 |
|                 |                 | internal        |                 |
| a.  A           |                 | control over    |                 |
|     description |                 | financial       |                 |
|     of the      |                 | reporting and   |                 |
|     scope of    |                 | of compliance   |                 |
|     testing     |                 | with laws,      |                 |
|     compliance  |                 | regulations,    |                 |
|     with laws   |                 | and provisions  |                 |
|     and         |                 | of contracts or |                 |
|     regulations |                 | grant           |                 |
|     and         |                 | agreements      |                 |
|     internal    |                 | including       |                 |
|     controls?   |                 | whether or not  |                 |
|     (GAGAS      |                 | the tests they  |                 |
|     5.08-5.09)  |                 | performed       |                 |
|                 |                 | provided        |                 |
| > b\. A         |                 | sufficient      |                 |
| > statement     |                 | evidence to     |                 |
| > about whether |                 | support an      |                 |
| > the tests     |                 | opinion on the  |                 |
| > provided      |                 | effectiveness   |                 |
| > sufficient    |                 | of internal     |                 |
| > evidence to   |                 | control over    |                 |
| > support an    |                 | financial       |                 |
| > opinion on    |                 | reporting and   |                 |
| > the           |                 | on compliance   |                 |
| > effectiveness |                 | with laws,      |                 |
| > of internal   |                 | regulations,    |                 |
| > control on    |                 | and provisions  |                 |
| > compliance    |                 | of contracts or |                 |
| > with laws,    |                 | grant           |                 |
| > regulations,  |                 | agreements.     |                 |
| > and           |                 |                 |                 |
| > provisions of |                 |                 |                 |
| > contracts or  |                 |                 |                 |
| > grant         |                 |                 |                 |
| > agreements?   |                 |                 |                 |
| > (GAGAS 5.09)  |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **Attestation** |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.8 What are   |                 |                 |                 |
| your policies   |                 |                 |                 |
| and procedures  |                 |                 |                 |
| to ensure       |                 |                 |                 |
| standards are   |                 |                 |                 |
| met? (GAGAS     |                 |                 |                 |
| 6.27-6.28)      |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **Performance   |                 |                 |                 |
| Audits**        |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.9 What are   |                 |                 |                 |
| your policies   |                 |                 |                 |
| and procedures  |                 |                 |                 |
| for             |                 |                 |                 |
| communicating   |                 |                 |                 |
| the results of  |                 |                 |                 |
| each audit?     |                 |                 |                 |
| (GAGAS          |                 |                 |                 |
| 8.02-8.05)      |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.10 What are  |                 | **8.02** The    |                 |
| your policies   |                 | reporting       |                 |
| and procedures  |                 | standard        |                 |
| regarding an    |                 | related to the  |                 |
| audit report's  |                 | form of the     |                 |
| contents?       |                 | report for      |                 |
| (GAGAS 8.07,    |                 | performance     |                 |
| 8.21)           |                 | audits          |                 |
|                 |                 | performed in    |                 |
|                 |                 | accordance with |                 |
|                 |                 | GAGAS is:       |                 |
|                 |                 | Auditors should |                 |
|                 |                 | prepare audit   |                 |
|                 |                 | reports         |                 |
|                 |                 | communicating   |                 |
|                 |                 | the results of  |                 |
|                 |                 | each audit.     |                 |
|                 |                 |                 |                 |
|                 |                 | **8.05** Audit  |                 |
|                 |                 | reports (1)     |                 |
|                 |                 | communicate the |                 |
|                 |                 | results of      |                 |
|                 |                 | audits to       |                 |
|                 |                 | officials at    |                 |
|                 |                 | various levels  |                 |
|                 |                 | of government,  |                 |
|                 |                 | (2) make the    |                 |
|                 |                 | results less    |                 |
|                 |                 | susceptible to  |                 |
|                 |                 | mi              |                 |
|                 |                 | sunderstanding, |                 |
|                 |                 | (3) make the    |                 |
|                 |                 | results         |                 |
|                 |                 | available for   |                 |
|                 |                 | public          |                 |
|                 |                 | inspection,     |                 |
|                 |                 | and\            |                 |
|                 |                 | (4) facilitate  |                 |
|                 |                 | follow-up to    |                 |
|                 |                 | determine       |                 |
|                 |                 | whether         |                 |
|                 |                 | appropriate     |                 |
|                 |                 | corrective      |                 |
|                 |                 | actions have    |                 |
|                 |                 | been taken. The |                 |
|                 |                 | need to         |                 |
|                 |                 | maintain public |                 |
|                 |                 | accountability  |                 |
|                 |                 | for government  |                 |
|                 |                 | programs        |                 |
|                 |                 | demands that    |                 |
|                 |                 | audit reports   |                 |
|                 |                 | be retrievable. |                 |
|                 |                 |                 |                 |
|                 |                 | **8.07** The    |                 |
|                 |                 | reporting       |                 |
|                 |                 | standard        |                 |
|                 |                 | related to the  |                 |
|                 |                 | contents of the |                 |
|                 |                 | report for      |                 |
|                 |                 | performance     |                 |
|                 |                 | audits          |                 |
|                 |                 | conducted in    |                 |
|                 |                 | accordance with |                 |
|                 |                 | GAGAS is:       |                 |
|                 |                 |                 |                 |
|                 |                 | > The audit     |                 |
|                 |                 | > report should |                 |
|                 |                 | > include the   |                 |
|                 |                 | > objectives,   |                 |
|                 |                 | > scope, and    |                 |
|                 |                 | > methodology;  |                 |
|                 |                 | > the audit     |                 |
|                 |                 | > results,      |                 |
|                 |                 | > including     |                 |
|                 |                 | > findings,     |                 |
|                 |                 | > conclusions,  |                 |
|                 |                 | > and           |                 |
|                 |                 | > r             |                 |
|                 |                 | ecommendations, |                 |
|                 |                 | > as            |                 |
|                 |                 | > appropriate;  |                 |
|                 |                 | > a reference   |                 |
|                 |                 | > to compliance |                 |
|                 |                 | > with          |                 |
|                 |                 | > generally     |                 |
|                 |                 | > accepted      |                 |
|                 |                 | > government    |                 |
|                 |                 | > auditing      |                 |
|                 |                 | > standards;    |                 |
|                 |                 | > the views of  |                 |
|                 |                 | > responsible   |                 |
|                 |                 | > officials;    |                 |
|                 |                 | > and, if       |                 |
|                 |                 | > applicable,   |                 |
|                 |                 | > the nature of |                 |
|                 |                 | > any           |                 |
|                 |                 | > privileged    |                 |
|                 |                 | > and           |                 |
|                 |                 | > confidential  |                 |
|                 |                 | > information   |                 |
|                 |                 | > omitted.      |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.11 What are  |                 |                 |                 |
| your policies   |                 |                 |                 |
| and procedures  |                 |                 |                 |
| regarding       |                 |                 |                 |
| reporting the   |                 |                 |                 |
| audit's         |                 |                 |                 |
| objectives,     |                 |                 |                 |
| scope, and      |                 |                 |                 |
| methodology?    |                 |                 |                 |
| (GAGAS          |                 |                 |                 |
| 8.08-8.12)      |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.12 What are  |                 | **8.19** When   |                 |
| your policies   |                 | auditors        |                 |
| and procedures  |                 | conclude, based |                 |
| regarding the   |                 | on evidence     |                 |
| reporting of    |                 | obtained, that  |                 |
| fraud, illegal  |                 | fraud, illegal  |                 |
| acts, and       |                 | acts,           |                 |
| abuse? (GAGAS   |                 | significant     |                 |
| 8.19-8.26)      |                 | violations of   |                 |
|                 |                 | provisions of   |                 |
|                 |                 | contracts or    |                 |
|                 |                 | grant           |                 |
|                 |                 | agreements, or  |                 |
|                 |                 | significant     |                 |
|                 |                 | abuse either    |                 |
|                 |                 | has occurred or |                 |
|                 |                 | is likely to    |                 |
|                 |                 | have occurred,  |                 |
|                 |                 | they should     |                 |
|                 |                 | include in      |                 |
|                 |                 | their audit     |                 |
|                 |                 | report relevant |                 |
|                 |                 | infor           |                 |
|                 |                 | mation.^ ^Abuse |                 |
|                 |                 | occurs when the |                 |
|                 |                 | conduct of a    |                 |
|                 |                 | government      |                 |
|                 |                 | program or      |                 |
|                 |                 | entity falls    |                 |
|                 |                 | far short of    |                 |
|                 |                 | behavior that   |                 |
|                 |                 | is expected to  |                 |
|                 |                 | be reasonable   |                 |
|                 |                 | and necessary   |                 |
|                 |                 | business        |                 |
|                 |                 | practices by a  |                 |
|                 |                 | prudent person. |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.13 What are  |                 | **8.27**        |                 |
| your policies   |                 | Auditors should |                 |
| and procedures  |                 | report          |                 |
| regarding       |                 | conclusions     |                 |
| presentation of |                 | when called for |                 |
| the auditor's   |                 | by the audit    |                 |
| conclusions in  |                 | objectives and  |                 |
| the audit       |                 | the results of  |                 |
| report? (GAGAS  |                 | the audit.      |                 |
| 8.27)           |                 | Conclusions are |                 |
|                 |                 | logical         |                 |
|                 |                 | inferences      |                 |
|                 |                 | about the       |                 |
|                 |                 | program based   |                 |
|                 |                 | on the          |                 |
|                 |                 | auditors'       |                 |
|                 |                 | findings and    |                 |
|                 |                 | should          |                 |
|                 |                 | represent more  |                 |
|                 |                 | than just a     |                 |
|                 |                 | summary of the  |                 |
|                 |                 | findings.       |                 |
|                 |                 | Conclusions     |                 |
|                 |                 | should be       |                 |
|                 |                 | clearly stated, |                 |
|                 |                 | not implied.    |                 |
|                 |                 | The strength of |                 |
|                 |                 | the auditors'   |                 |
|                 |                 | conclusions     |                 |
|                 |                 | depends on the  |                 |
|                 |                 | persuasiveness  |                 |
|                 |                 | of the evidence |                 |
|                 |                 | supporting the  |                 |
|                 |                 | findings and    |                 |
|                 |                 | the soundness   |                 |
|                 |                 | of the logic    |                 |
|                 |                 | used to         |                 |
|                 |                 | formulate the   |                 |
|                 |                 | conclusions.    |                 |
|                 |                 | Conclusions are |                 |
|                 |                 | stronger if     |                 |
|                 |                 | they set up the |                 |
|                 |                 | report's        |                 |
|                 |                 | recommendations |                 |
|                 |                 | and convince    |                 |
|                 |                 | the             |                 |
|                 |                 | knowledgeable   |                 |
|                 |                 | user of the     |                 |
|                 |                 | report that     |                 |
|                 |                 | action is       |                 |
|                 |                 | necessary       |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.14 What are  |                 | **8.15** To the |                 |
| your policies   |                 | extent          |                 |
| and procedures  |                 | possible, in    |                 |
| regarding       |                 | presenting      |                 |
| reporting fully |                 | findings,       |                 |
| developed       |                 | auditors should |                 |
| findings?       |                 | develop the     |                 |
| (GAGAS          |                 | elements of     |                 |
| 8.13-8.15)      |                 | criteria,       |                 |
|                 |                 | condition,      |                 |
|                 |                 | cause, and      |                 |
|                 |                 | effect to       |                 |
|                 |                 | assist          |                 |
|                 |                 | officials of    |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity or       |                 |
|                 |                 | oversight       |                 |
|                 |                 | officials of    |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity in       |                 |
|                 |                 | understanding   |                 |
|                 |                 | the need for    |                 |
|                 |                 | taking          |                 |
|                 |                 | corrective      |                 |
|                 |                 | action. In      |                 |
|                 |                 | addition, if    |                 |
|                 |                 | auditors are    |                 |
|                 |                 | able to         |                 |
|                 |                 | sufficiently    |                 |
|                 |                 | develop the     |                 |
|                 |                 | findings,       |                 |
|                 |                 | auditors should |                 |
|                 |                 | provide         |                 |
|                 |                 | recommendations |                 |
|                 |                 | for corrective  |                 |
|                 |                 | action.         |                 |
|                 |                 | Following is    |                 |
|                 |                 | guidance for    |                 |
|                 |                 | reporting on    |                 |
|                 |                 | elements of     |                 |
|                 |                 | findings:       |                 |
|                 |                 |                 |                 |
|                 |                 | > **a.**        |                 |
|                 |                 | > Criteria      |                 |
|                 |                 | > provides      |                 |
|                 |                 | > information   |                 |
|                 |                 | > so that the   |                 |
|                 |                 | > report user   |                 |
|                 |                 | > will be able  |                 |
|                 |                 | > to determine  |                 |
|                 |                 | > what is the   |                 |
|                 |                 | > required or   |                 |
|                 |                 | > desired state |                 |
|                 |                 | > or what is    |                 |
|                 |                 | > expected from |                 |
|                 |                 | > the program   |                 |
|                 |                 | > or operation. |                 |
|                 |                 | > The criteria  |                 |
|                 |                 | > are easier to |                 |
|                 |                 | > understand    |                 |
|                 |                 | > when stated   |                 |
|                 |                 | > fairly,       |                 |
|                 |                 | > explicitly,   |                 |
|                 |                 | > and           |                 |
|                 |                 | > completely    |                 |
|                 |                 | > and when the  |                 |
|                 |                 | > source of the |                 |
|                 |                 | > criteria is   |                 |
|                 |                 | > identified in |                 |
|                 |                 | > the audit     |                 |
|                 |                 | > report.^ ^    |                 |
|                 |                 | >               |                 |
|                 |                 | > **b.**        |                 |
|                 |                 | > Condition     |                 |
|                 |                 | > provides      |                 |
|                 |                 | > evidence on   |                 |
|                 |                 | > what the      |                 |
|                 |                 | > auditors      |                 |
|                 |                 | > found         |                 |
|                 |                 | > regarding the |                 |
|                 |                 | > actual        |                 |
|                 |                 | > situation.    |                 |
|                 |                 | > Reporting the |                 |
|                 |                 | > scope or      |                 |
|                 |                 | > extent of the |                 |
|                 |                 | > condition     |                 |
|                 |                 | > allows the    |                 |
|                 |                 | > report user   |                 |
|                 |                 | > to gain an    |                 |
|                 |                 | > accurate      |                 |
|                 |                 | > perspective.  |                 |
|                 |                 | >               |                 |
|                 |                 | > **c.** Cause  |                 |
|                 |                 | > provides      |                 |
|                 |                 | > persuasive    |                 |
|                 |                 | > evidence on   |                 |
|                 |                 | > the factor or |                 |
|                 |                 | > factors       |                 |
|                 |                 | > responsible   |                 |
|                 |                 | > for the       |                 |
|                 |                 | > difference    |                 |
|                 |                 | > between       |                 |
|                 |                 | > condition and |                 |
|                 |                 | > criteria. In  |                 |
|                 |                 | > reporting the |                 |
|                 |                 | > cause,        |                 |
|                 |                 | > auditors may  |                 |
|                 |                 | > consider      |                 |
|                 |                 | > whether the   |                 |
|                 |                 | > evidence      |                 |
|                 |                 | > provides a    |                 |
|                 |                 | > reasonable    |                 |
|                 |                 | > and           |                 |
|                 |                 | > convincing    |                 |
|                 |                 | > argument for  |                 |
|                 |                 | > why the       |                 |
|                 |                 | > stated cause  |                 |
|                 |                 | > is the key    |                 |
|                 |                 | > factor or     |                 |
|                 |                 | > factors       |                 |
|                 |                 | > contributing  |                 |
|                 |                 | > to the        |                 |
|                 |                 | > difference as |                 |
|                 |                 | > opposed to    |                 |
|                 |                 | > other         |                 |
|                 |                 | > possible      |                 |
|                 |                 | > causes, such  |                 |
|                 |                 | > as poorly     |                 |
|                 |                 | > designed      |                 |
|                 |                 | > criteria or   |                 |
|                 |                 | > factors       |                 |
|                 |                 | >               |                 |
|                 |                 |  uncontrollable |                 |
|                 |                 | > by program    |                 |
|                 |                 | > management.   |                 |
|                 |                 | > The auditors  |                 |
|                 |                 | > also may      |                 |
|                 |                 | > consider      |                 |
|                 |                 | > whether the   |                 |
|                 |                 | > identified    |                 |
|                 |                 | > cause could   |                 |
|                 |                 | > serve as a    |                 |
|                 |                 | > basis for the |                 |
|                 |                 | > r             |                 |
|                 |                 | ecommendations. |                 |
|                 |                 | >               |                 |
|                 |                 | > **d.** Effect |                 |
|                 |                 | > provides a    |                 |
|                 |                 | > clear,        |                 |
|                 |                 | > logical link  |                 |
|                 |                 | > to establish  |                 |
|                 |                 | > the impact of |                 |
|                 |                 | > the           |                 |
|                 |                 | > difference    |                 |
|                 |                 | > between what  |                 |
|                 |                 | > the auditors  |                 |
|                 |                 | > found         |                 |
|                 |                 | > (condition)   |                 |
|                 |                 | > and what      |                 |
|                 |                 | > should be     |                 |
|                 |                 | > (criteria).   |                 |
|                 |                 | > Effect is     |                 |
|                 |                 | > easier to     |                 |
|                 |                 | > understand    |                 |
|                 |                 | > when it is    |                 |
|                 |                 | > stated        |                 |
|                 |                 | > clearly,      |                 |
|                 |                 | > concisely,    |                 |
|                 |                 | > and, if       |                 |
|                 |                 | > possible, in  |                 |
|                 |                 | > quantifiable  |                 |
|                 |                 | > terms. The    |                 |
|                 |                 | > significance  |                 |
|                 |                 | > of the        |                 |
|                 |                 | > reported      |                 |
|                 |                 | > effect can be |                 |
|                 |                 | > demonstrated  |                 |
|                 |                 | > through       |                 |
|                 |                 | > credible      |                 |
|                 |                 | > evidence.     |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.15 What are  |                 | **8.18** In a   |                 |
| your policies   |                 | performance     |                 |
| and procedures  |                 | audit, auditors |                 |
| regarding       |                 | may identify    |                 |
| reporting       |                 | significant     |                 |
| deficiencies in |                 | deficiencies in |                 |
| internal        |                 | internal        |                 |
| controls?       |                 | control as the  |                 |
| (GAGAS          |                 | cause of        |                 |
| 8.16-8.18)      |                 | deficient       |                 |
|                 |                 | performance. In |                 |
|                 |                 | reporting this  |                 |
|                 |                 | type of         |                 |
|                 |                 | finding, the    |                 |
|                 |                 | internal        |                 |
|                 |                 | control         |                 |
|                 |                 | weakness would  |                 |
|                 |                 | be described as |                 |
|                 |                 | the cause.      |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.16 What are  |                 | **8.29**        |                 |
| your policies   |                 | Constructive    |                 |
| and procedures  |                 | recommendations |                 |
| regarding the   |                 | can encourage   |                 |
| development and |                 | improvements in |                 |
| issuance of     |                 | the conduct of  |                 |
| r               |                 | government      |                 |
| ecommendations? |                 | programs and    |                 |
| (GAGAS          |                 | operations. For |                 |
| 8.28-8.29)      |                 | recommendations |                 |
|                 |                 | to be most      |                 |
|                 |                 | constructive,   |                 |
|                 |                 | they should be  |                 |
|                 |                 | directed at     |                 |
|                 |                 | resolving the   |                 |
|                 |                 | cause of        |                 |
|                 |                 | identified      |                 |
|                 |                 | problems,       |                 |
|                 |                 | action oriented |                 |
|                 |                 | and specific,   |                 |
|                 |                 | addressed to    |                 |
|                 |                 | parties that    |                 |
|                 |                 | have the        |                 |
|                 |                 | authority to    |                 |
|                 |                 | act, practical  |                 |
|                 |                 | and, to the     |                 |
|                 |                 | extent          |                 |
|                 |                 | feasible, cost  |                 |
|                 |                 | effective, and  |                 |
|                 |                 | measurable.     |                 |
+-----------------+-----------------+-----------------+-----------------+
| 10.17 What are  |                 | **8.38** The    |                 |
| your policies   |                 | reporting       |                 |
| and procedures  |                 | standard        |                 |
| to ensure       |                 | related to      |                 |
| report quality  |                 | report quality  |                 |
| elements are    |                 | for performance |                 |
| met? (GAGAS     |                 | audits          |                 |
| 8.38-8.53)      |                 | performed in    |                 |
|                 |                 | accordance with |                 |
|                 |                 | GAGAS is: the   |                 |
|                 |                 | report should   |                 |
|                 |                 | be timely,      |                 |
|                 |                 | complete,       |                 |
|                 |                 | accurate,       |                 |
|                 |                 | objective,      |                 |
|                 |                 | convincing,     |                 |
|                 |                 | clear, and as   |                 |
|                 |                 | concise as the  |                 |
|                 |                 | subject         |                 |
|                 |                 | permits.        |                 |
+-----------------+-----------------+-----------------+-----------------+
|                 |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| **11. [AUDIT    |                 |                 |                 |
| FOLLOW-UP       |                 |                 |                 |
| PROCESS         |                 |                 |                 |
| ]{.underline}** |                 |                 |                 |
+-----------------+-----------------+-----------------+-----------------+
| 11.1 What are   |                 | **7.30**        |                 |
| your policies   |                 | Providing       |                 |
| and procedures  |                 | continuing      |                 |
| for             |                 | attention to    |                 |
| trac            |                 | significant     |                 |
| king/monitoring |                 | findings and    |                 |
| agency          |                 | recommendations |                 |
| officials'      |                 | is important to |                 |
| response,       |                 | ensure that the |                 |
| management      |                 | benefits of     |                 |
| decision, and   |                 | audit work are  |                 |
| final action on |                 | realized.       |                 |
| the reports'    |                 | Ultimately, the |                 |
| r               |                 | benefits of     |                 |
| ecommendations? |                 | audit work      |                 |
| (GAGAS 4.16,    |                 | occur when      |                 |
| 6.12, 7.30)     |                 | officials of    |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity take     |                 |
|                 |                 | meaningful and  |                 |
|                 |                 | effective       |                 |
|                 |                 | corrective      |                 |
|                 |                 | action in       |                 |
|                 |                 | response to the |                 |
|                 |                 | auditors'       |                 |
|                 |                 | findings and    |                 |
|                 |                 | r               |                 |
|                 |                 | ecommendations. |                 |
|                 |                 | Officials of    |                 |
|                 |                 | the audited     |                 |
|                 |                 | entity are      |                 |
|                 |                 | responsible for |                 |
|                 |                 | resolving audit |                 |
|                 |                 | findings and    |                 |
|                 |                 | recommendations |                 |
|                 |                 | directed to     |                 |
|                 |                 | them and for    |                 |
|                 |                 | having a        |                 |
|                 |                 | process to      |                 |
|                 |                 | track their     |                 |
|                 |                 | status. If the  |                 |
|                 |                 | audited entity  |                 |
|                 |                 | does not have   |                 |
|                 |                 | such a process, |                 |
|                 |                 | auditors may    |                 |
|                 |                 | wish to         |                 |
|                 |                 | establish their |                 |
|                 |                 | own process.    |                 |
+-----------------+-----------------+-----------------+-----------------+

  -----------------------------------------------------------------------
  **END OF CHECKLIST**

  -----------------------------------------------------------------------