Page 1 GAGAS Audit Alert

August 2020

The audit community has been affected by the Coronavirus Disease 2019 

(COVID-19) pandemic. This alert provides considerations and 

reminders—given the circumstances related to the pandemic—for audits 

of new government programs arising from the pandemic response as well 

as ongoing audits.

To consult other alerts, visit www.gao.gov/yellowbook.

This alert, prepared by GAO staff, is for informational purposes. It does 

not amend Government Auditing Standards, commonly referred to as 

generally accepted government auditing standards (GAGAS) or the 

Yellow Book.1 Reading this alert is not a substitute for reading GAGAS 

and, as applicable, the American Institute of Certified Public Accountants’

(AICPA) standards incorporated by reference.2

This alert does not contain requirements and is not considered 

interpretive guidance, as defined in chapter 2 of GAGAS. 

Procedures to be performed as part of an engagement should be 

developed to the extent they are necessary to the engagement objectives 

and in light of the context of a particular engagement. The considerations 

in this alert may be useful for auditors conducting any type of 

engagement in accordance with GAGAS, including financial audits, 

attestation engagements, reviews of financial statements, and 

performance audits. 

 1GAO, Government Auditing Standards: 2018 Revision, GAO-18-568G (Washington, 

D.C.: July 2018). 

2See Yellow Book paras. 2.13a, 6.01, and 7.01. For financial audits and attestation 

engagements, GAGAS incorporates by reference AICPA Statements on Auditing 

Standards and Statements on Standards for Attestation Engagements. For reviews of 

financial statements, GAGAS incorporates by reference AR-C, section 90, Review of 

Financial Statements.

Letter
Page 2 GAGAS Audit Alert

Auditors and audit organizations conducting engagements in accordance 

with GAGAS are required to comply with all applicable requirements of 

the Yellow Book. Auditors and audit organizations conducting GAGAS 

financial audits, attestation engagements, and reviews of financial 

statements are required to comply with the AICPA auditing standards, 

attestation standards, and standards for reviews of financial statements, 

incorporated in GAGAS by reference.

For GAGAS engagements, auditors may need to pay particular attention 

to certain areas of audit work because of potentially compressed 

reporting time frames and possible limitations on the means of obtaining 

evidence during the COVID-19 pandemic. Some of the areas follow:

• Audit risk 

• Risk of fraud

• Internal control

• Evidence

• Quality control

These areas are discussed in more detail below.

Auditors have a responsibility to reduce audit risk to an acceptably low 

level when planning an engagement and assessing the sufficiency and 

appropriateness of evidence within the context of the audit objectives.

For financial audits, audit risk is the risk that the auditor expresses an 

inappropriate audit opinion when the financial statements are materially 

misstated. Audit risk is a function of the risks of material misstatement 

and detection risk. Risk of material misstatement is the risk that the 

financial statements are materially misstated prior to the audit and 

consists of inherent risk and control risk.

For performance audits, audit risk is the possibility that the auditors’ 

findings, conclusions, recommendations, or assurance may be improper 

or incomplete as a result of factors such as evidence that is not sufficient 

or appropriate, an inadequate audit process, or intentional omissions or 

misleading information because of misrepresentation or fraud. Audit risk 

includes the risk that auditors will not detect a mistake, inconsistency, 

significant error, or fraud in the evidence supporting the audit.

Responsibility to 

Comply with the 

Yellow Book

GAGAS 

Engagements

Audit Risk
Page 3 GAGAS Audit Alert

The circumstances related to the COVID-19 pandemic may increase audit 

risk. Auditors are working under tight time frames and examining complex 

or sensitive programs. The sizes of programs in terms of dollar amounts 

and numbers of citizens served may be substantial, and the adequacy of 

the audited entity’s systems and processes for preventing and detecting 

inconsistencies, significant errors, or fraud may be in question.

Depending on the circumstances of a particular engagement, audit risk 

can be reduced by taking actions such as ensuring a scope of work 

sufficient to address the audit objectives, adding specialists and other 

resources to conduct the audit, changing the methodology to obtain 

alternative forms of corroborating evidence, and carefully aligning the 

findings and conclusions to reflect the evidence obtained.

For financial audits and certain attestation engagements, auditors assess 

the risk of material misstatement due to potential fraud. For performance 

audits, auditors assess the risk of potential fraud occurring that is 

significant within the context of the audit objectives.3 If the engagement 

began prior to the COVID-19 pandemic, auditors may need to revisit their 

assessments of the risk of fraud, given the changing environment in 

which entities are operating.

Risk of potential fraud involving new or expanded programs may exist at 

entities responsible for disbursing government funds made available for 

the COVID-19 pandemic response and the related economic stimulus 

plans. Auditors may consider conditions that may indicate increased risks 

when identifying and assessing fraud risks. Specifically, the following 

conditions related to the COVID-19 pandemic may indicate an increased 

risk of fraud:

• Management or other personnel have an incentive or are under 

pressure to commit fraud because of, for example, economic 

conditions that threaten the entity’s financial stability or the need to 

execute a new program quickly.

• Management or other personnel have the opportunity to commit fraud 

because of, for example, a large number of payments or high dollar 

value payments being disbursed with no or ineffective controls in 

place.

 3Fraud involves obtaining something of value through willful misrepresentation. Whether 

an act is, in fact, fraud is determined through the judicial or other adjudicative system and 

is beyond auditors’ professional responsibility.

Reasons for Attention

Key Steps

Risk of Fraud

Reasons for Attention
Page 4 GAGAS Audit Alert

• Management or other personnel are able to rationalize their actions 

under the circumstances.

Auditors gather and assess information to identify fraud risks that are 

significant within the scope of audit objectives or that could affect the 

audit findings and conclusions. Auditors may consider the audited entity’s

• most recent fraud risk assessment of the program and, if the fraud risk 

assessment has been revisited in response to the COVID-19 

pandemic, its economic impacts or related legislation;

• controls or measures, if any, implemented (or planned) to mitigate the 

risks of fraud (through prevention, detection, and response) in the 

program’s response to the COVID-19 pandemic;

• mechanisms or indicators, if any, used to identify potential fraud 

associated with the response to the pandemic and related conditions; 

and

• identified attempts to defraud the program’s response to the COVID19 pandemic.

Additional key steps related to fraud risk include the following:

• For performance audits, if information comes to the auditors’ attention 

indicating that fraud, significant within the context of the audit 

objectives, may have occurred, extending the audit steps and 

procedures to (1) determine whether fraud has likely occurred and (2) 

if so, determine its effect on the audit findings.4

• For performance audits, reporting a matter as a finding when the 

auditors conclude based on sufficient, appropriate evidence, that 

fraud either has occurred or is likely to have occurred that is 

significant to the audit objectives.5

• For financial audits, including in the report on internal control or 

compliance the relevant information about fraud when auditors, based 

on sufficient, appropriate evidence, identify or suspect fraud that is 

material, either quantitatively or qualitatively, to the financial 

statements or other financial data significant to the audit objectives.6

 4See Yellow Book para. 8.72. 

5See Yellow Book para. 9.40.

6See Yellow Book para. 6.41. 

Key Steps
Page 5 GAGAS Audit Alert

Auditors’ responsibilities related to internal control vary depending on the 

type of GAGAS engagement. Auditors may be required to consider 

internal control deficiencies in evaluating identified findings when 

developing the cause element of the findings and reporting on internal 

control.

Increased risks may exist for audited entities and programs created in 

response to the COVID-19 pandemic. Audited entities address risks 

through systems of internal control but may not have made the necessary 

changes to their systems of internal control, or properly documented or 

effectively communicated new internal control procedures, to respond to 

these risks.

When performing internal control procedures, auditors obtain an 

understanding of internal control significant to the audit objectives, 

including determining whether audited entities have made the necessary 

changes to their systems of internal control. Questions auditors may 

consider include the following:

• Has the audited entity recently created a new program or process to 

use or disburse government funds made available for the COVID-19 

pandemic response?

• Has the audited entity updated its system of internal control for 

applicable new laws, regulations, and responsibilities related to the 

use or disbursement of government funds made available as part of 

the response to the COVID-19 pandemic?

• If key employees have been furloughed or laid off, has the audited 

entity made the appropriate changes to its internal control system?

• Are there additional pressures on management that may affect the 

auditors’ assessment of the audited entity’s control environment and 

system of internal control? For example, did management not design 

or implement controls effectively, or did management override existing 

controls to execute a COVID-19 pandemic–related program quickly?

• Have the auditors become aware of waste or abuse of COVID-19 

pandemic–related funds that could be the result of internal control 

deficiencies?

• Were controls operating effectively throughout the period given 

pressures and accelerated timelines in the COVID-19 pandemic 

environment?

Internal Control

Reasons for Attention

Key Steps
Page 6 GAGAS Audit Alert

For financial audits and certain attestation engagements, and for 

performance audits where internal control is significant to the audit 

objectives, other key engagement procedures include, as applicable,

• assessing whether controls were properly designed, implemented, 

and operating effectively (including, if applicable, assessing the 

controls in place both before the COVID-19 pandemic began and 

after);

• evaluating the significance of identified internal control deficiencies;

and

• reporting on internal control as required by GAGAS.

Auditors are required to obtain sufficient, appropriate evidence to support 

findings and conclusions. Circumstances related to the COVID-19 

pandemic may prevent auditors from performing engagement procedures 

at audited entity facilities and may necessitate that audit organizations 

consider alternative methods to conduct engagements and obtain 

evidence. 

Auditors may face challenges such as (1) difficultly accessing audited 

entity records, automated information systems, and personnel; (2) 

difficulty observing an entity’s inventory and property; (3) restrictions on 

auditor travel; and (4) limited ability to access sensitive or classified data. 

Auditors may have to change the methodology used in prior 

engagements to overcome these challenges and comply with GAGAS 

requirements.

Auditors may need to determine whether circumstances related to the 

COVID-19 pandemic prevent them from obtaining sufficient, appropriate 

evidence. In determining the sufficiency and appropriateness of evidence, 

auditors exercise professional skepticism.7

Audit organizations are required to establish policies and procedures for

the continuance of engagements that are designed to provide reasonable 

 7See Yellow Book para. 3.110 for a discussion of professional skepticism. Attributes of 

professional skepticism include a questioning mind, awareness of conditions that may 

indicate possible misstatement owing to error or fraud, and a critical assessment of 

evidence. Professional skepticism includes being alert to, for example, evidence that 

contradicts other evidence obtained or information that brings into question the reliability 

of documents or responses to inquiries to be used as evidence.

Evidence

Reasons for Attention

Key Steps
Page 7 GAGAS Audit Alert

assurance that the audit organization complies with GAGAS, including 

obtaining sufficient, appropriate evidence.8 The procedures would include

processes for such decisions as delaying the audit; terminating the audit;

or changing the objectives, scope, and methodology of the audit.

Audit organizations are required to establish and maintain systems of 

quality control designed to provide the organizations with reasonable 

assurance that they and their personnel comply with professional 

standards and applicable legal and regulatory requirements.9

Audit organizations’ systems of quality control are key in the complex 

COVID-19 pandemic environment. The pandemic has changed the way 

many auditors are working. Further, new or changing government 

programs may exist that are subject to audit. 

Audit organizations should take care to ensure that their systems of 

quality control are working effectively for all engagements and that all 

policies and procedures for ensuring quality, including assessments of 

evidence and supervisory review of audit documentation, are being 

followed.

Other resources that may be helpful to auditors conducting GAGAS 

engagements affected by the COVID-19 pandemic include the following:

• GAO: COVID-19: GAGAS CPE Alert

• GAO: GAO Coronavirus Oversight

• AICPA: COVID-19 Audit and Assurance Resources

• Federal Accounting Standards Advisory Board (FASAB): FASAB’s 

Response to COVID-19

• Governmental Accounting Standards Board (GASB): GASB 

Response to COVID-19

• International Auditing and Assurance Standards Board: Guidance for 

Auditor’s During the Coronavirus Pandemic

• National Association of State Auditors, Comptrollers, and Treasurers: 

COVID-19 Resources for States

 8See Yellow Book para. 5.12.

9See Yellow Book paras. 5.02 through 5.59 for quality control requirements and guidance.

Quality Control

Other Resources
Page 8 GAGAS Audit Alert

• Public Company Accounting Oversight Board (PCAOB): PCAOB 

Response to COVID-19

To view the 2018 revision of the Yellow Book, visit 

https://www.gao.gov/yellowbook.

For technical assistance, call (202) 512-9535 or email 

yellowbook@gao.gov.

For More Information