0:'government auditing standards 2018 revision technical update april 2021 by the comptroller general of the united states april 2021 gao21368g',
1:'united states government accountability office government auditing standards 2018 revisiontechnical update april 2021 by the comptroller general of the united',
2:'states april 2021 gao21368g united states government accountability office the 2018 revision of government auditing standards is effective for financial',
3:'audits, attestation engagements, and reviews of financial statements for periods ending on or after june 30, 2020, and for performance',
4:'audits beginning on or after july 1, 2019. early implementation is not permitted. the 2018 revision of government auditing standards',
5:'supersedes the 2011 revision gao12331g, december 2011, the 2005 government auditing standards: guidance on gagas requirements for continuing professional education',
6:'gao05568g, april 2005, and the 2014 government auditing standards: guidance for understanding the new peer review ratings d06602, january 2014.',
7:'the 2018 revision should be used until further updates and revisions are made. an electronic version of this document can',
8:'be accessed on gao’s yellow book web page at http://www.gao.gov/yellowbook. 2021 technical updates to the 2018 revision of government auditing',
9:'standards the following technical updates have been made to the 2018 revision of government auditing standards known as the yellow',
10:'book. these technical updates to the 2018 revision of government auditing standards are effective upon issuance. 2018 revision of government',
11:'auditing standards 2021 technical updates 1.02 the concept of accountability for use of public resources and government authority is key',
12:'to our nation’s governing processes. management and officials entrusted with public resources are responsible for carrying out public functions and',
13:'providing service to the public effectively, efficiently, economically, and ethically within the context of the statutory boundaries of the specific',
14:'government program. 1.02 the concept of accountability for use of public resources and government authority is key to our nation’s',
15:'governing processes. management and officials entrusted with public resources are responsible for carrying out public functions and providing service to',
16:'the public effectively, efficiently, economically, ethically, and equitably within the context of the statutory boundaries of the specific government program.',
17:'1.03 as reflected in applicable laws, regulations, agreements, and standards, management and officials of government programs are responsible for providing',
18:'reliable, useful, and timely information for transparency and accountability of these programs and their operations. legislators, oversight bodies, those charged',
19:'with governance, and the public need to know whether 1 management and officials manage government resources and use their authority',
20:'properly and in compliance with laws and regulations; 2 government programs are achieving their objectives and desired outcomes; and 3',
21:'government services are provided effectively, efficiently, economically, and ethically. 1.03 as reflected in applicable laws, regulations, agreements, and standards, management',
22:'and officials of government programs are responsible for providing reliable, useful, and timely information for transparency and accountability of these',
23:'programs and their operations. legislators, oversight bodies, those charged with governance, and the public need to know whether 1 management',
24:'and officials manage government resources and use their authority properly and in compliance with laws and regulations; 2 government programs',
25:'are achieving their objectives and desired outcomes; and 3 government services are provided effectively, efficiently, economically, ethically, and equitably. 1.23',
26:'examples of program effectiveness and results audit objectives include f. determining whether a program provides access to or distribution of',
27:'public resources within the context of statutory parameters; 1.23 examples of program effectiveness and results audit objectives include f. determining',
28:'whether a program provides equitable access to or distribution of public resources within the context of statutory parameters; 3.83 auditors',
29:'who previously provided nonaudit services for an entity that is a prospective subject of an engagement should evaluate the effect',
30:'of those nonaudit services on independence before agreeing to conduct a gagas engagement. if auditors provided a nonaudit service in',
31:'the period to be covered by the engagement, they should 1 determine if gagas expressly prohibits the nonaudit service; 2',
32:'if audited entity management requested the nonaudit service, determine whether the skills, knowledge, and experience of the individual responsible for',
33:'overseeing the nonaudit service were sufficient; and 3 determine whether a threat to independence exists and address any threats noted',
34:'in accordance with the conceptual framework. 3.83 auditors who previously provided nonaudit services for an entity that is a prospective',
35:'subject of an engagement should evaluate the effect of those nonaudit services on independence before agreeing to conduct a gagas',
36:'engagement. if auditors provided a nonaudit service in the period to be covered by the engagement, they should 1 determine',
37:'if gagas expressly prohibits the nonaudit service; 2 if audited entity management requested the nonaudit service, determine whether the skill,',
38:'knowledge, or experience of the individual responsible for overseeing the nonaudit service was sufficient; and 3 determine whether a threat',
39:'to independence exists and address any threats noted in accordance with the conceptual framework. 8.42 if internal control is significant',
40:'to the audit objectives, auditors determine which of the five components of internal control and underlying principles are significant to',
41:'the audit objectives, as all components of internal control are generally relevant, but not all components may be significant to',
42:'the audit objectives. this determination can also identify whether specific controls are significant to the audit objectives. determining which internal',
43:'control components and principles and/or specific controls are significant to the audit objectives is a matter of professional judgment. 8.42',
44:'if internal control is significant to the audit objectives, auditors determine which of the five components of internal control are',
45:'significant to the audit objectives, as all components of internal control are generally relevant, but not all components may be',
46:'significant to the audit objectives. this determination can also identify the underlying principles, control objectives, or specific controls that are',
47:'significant to the audit objectives. determining which internal control components, principles, control objectives, and/or specific controls are significant to the',
48:'audit objectives is a matter of professional judgment. 8.49 if internal control is determined to be significant to the audit',
49:'objectives, auditors should assess and document their assessment of the design, implementation, and/or operating effectiveness of such internal control to',
50:'the extent necessary to address the audit objectives. 8.49 if internal control is determined to be significant to the audit',
51:'objectives, auditors should plan and perform audit procedures to assess internal control to the extent necessary to address the audit',
52:'objectives. 9.30 if some but not all internal control components are significant to the audit objectives, the auditors should identify',
53:'as part of the scope those internal control components and underlying principles that are significant to the audit objectives. 9.30',
54:'when reporting on the scope of their work on internal control, auditors should identify the scope of internal control assessed',
55:'to the extent necessary for report users to reasonably interpret the findings, conclusions, and recommendations in the audit report. 9.32',
56:'control components and underlying principles that are not considered significant to the audit objectives may be identified in the scope',
57:'if, in the auditors’ professional judgment, doing so is necessary to preclude a misunderstanding of the breadth of the conclusions',
58:'of the audit report and to clarify that control effectiveness has not been evaluated as a whole. auditors may also',
59:'identify and describe the five components of internal control so that report users understand the scope of the work within',
60:'the context of the entity’s internal control system. 9.32 auditors may identify the control components, underlying principles, control objectives, or',
61:'specific controls assessed in describing the scope of their work on internal control. auditors may also identify the level of',
62:'internal control assessment performed, as discussed in paragraph 8.50. control components and underlying principles that are not considered significant to',
63:'the audit objectives may be identified in the scope if, in the auditors’ professional judgment, doing so is necessary to',
64:'preclude a misunderstanding of the breadth of the conclusions of the audit report and to clarify that control effectiveness has',
65:'not been evaluated as a whole. auditors may also identify and describe the five components of internal control so that',
66:'report users understand the scope of the work within the context of the entity’s internal control system. conforming changes have',
67:'been made to the figures to reflect the technical updates. contents letter 1 chapter 1: foundation and principles for the',
68:'use and application of government auditing standards 3 introduction 3 types of gagas users 6 types of gagas engagements 7',
69:'financial audits 7 attestation engagements and reviews of financial statements 9 performance audits 10 terms used in gagas 15 the',
70:'gagas format 16 chapter 2: general requirements for complying with government auditing standards 18 complying with gagas 18 relationship between',
71:'gagas and other professional standards 20 stating compliance with gagas in the audit report 22 chapter 3: ethics, independence, and',
72:'professional judgment 25 ethical principles 25 the public interest 26 integrity 26 objectivity 27 proper use of government information, resources,',
73:'and positions 27 professional behavior 28 independence 28 gagas conceptual framework approach to independence 31 provision of nonaudit services to',
74:'audited entities 43 consideration of specific nonaudit services 50 documentation 57 professional judgment 58 chapter 4: competence and continuing professional',
75:'education 63 competence 63 continuing professional education 67 chapter 5: quality control and peer review 81 quality control and assurance',
76:'81 system of quality control 81 leadership responsibilities for quality within the audit organization 82 independence, legal, and ethical requirements',
77:'82 initiation, acceptance, and continuance of engagements 84 human resources 84 engagement performance 86 monitoring of quality 91 external peer',
78:'review 96 additional requirements for audit organizations not affiliated with recognized organizations 102 chapter 6: standards for financial audits 109',
79:'additional gagas requirements for conducting financial audits 109 compliance with standards 109 licensing and certification 110 auditor communication 110 results',
80:'of previous engagements 111 investigations or legal proceedings 112 noncompliance with provisions of laws, regulations, contracts, and grant agreements 112',
81:'findings 113 audit documentation 116 availability of individuals and documentation 117 additional gagas requirements for reporting on financial audits 118',
82:'reporting the auditors’ compliance with gagas 118 reporting on internal control; compliance with provisions of laws, regulations, contracts, and grant',
83:'agreements; and instances of fraud 119 presenting findings in the audit report 121 reporting findings directly to parties outside the',
84:'audited entity 122 obtaining and reporting the views of responsible officials 123 reporting confidential or sensitive information 125 distributing reports',
85:'126 chapter 7: standards for attestation engagements and reviews of financial statements 127 examination engagements 128 compliance with standards 128',
86:'licensing and certification 129 auditor communication 129 results of previous engagements 130 investigations or legal proceedings 130 noncompliance with provisions',
87:'of laws, regulations, contracts, and grant agreements 131 findings 132 examination engagement documentation 135 availability of individuals and documentation 136',
88:'reporting the auditors’ compliance with gagas 136 reporting deficiencies in internal control 137 reporting on noncompliance with provisions of laws,',
89:'regulations, contracts, and grant agreements or instances of fraud 138 presenting findings in the report 139 reporting findings directly to',
90:'parties outside the audited entity 139 obtaining and reporting the views of responsible officials 140 reporting confidential or sensitive information',
91:'142 distributing reports 143 review engagements 144 compliance with standards 144 licensing and certification 144 noncompliance with provisions of laws,',
92:'regulations, contracts, and grant agreements 145 reporting auditors’ compliance with gagas 145 distributing reports 146 agreedupon procedures engagements 147 compliance',
93:'with standards 147 licensing and certification 147 noncompliance with provisions of laws, regulations, contracts, and grant agreements 148 reporting auditors’',
94:'compliance with gagas 148 distributing reports 149 reviews of financial statements 150 compliance with standards 150 licensing and certification 150',
95:'noncompliance with provisions of laws, regulations, contracts, and grant agreements 151 reporting auditors’ compliance with gagas 151 distributing reports 152',
96:'chapter 8: fieldwork standards for performance audits 154 planning 154 auditor communication 158 investigations or legal proceedings 159 results of',
97:'previous engagements 160 assigning auditors 160 preparing a written audit plan 161 conducting the engagement 162 nature and profile of',
98:'the program and user needs 162 determining significance and obtaining an understanding of internal control 165 assessing internal control 168',
99:'internal control deficiencies considerations 169 information systems controls considerations 171 provisions of laws, regulations, contracts, and grant agreements 174 fraud',
100:'175 identifying sources of evidence and the amount and type of evidence required 177 using the work of others 177',
101:'supervision 179 evidence 179 overall assessment of evidence 185 findings 186 audit documentation 190 availability of individuals and documentation 192',
102:'chapter 9: reporting standards for performance audits 194 reporting auditors’ compliance with gagas 194 report format 195 report content 195',
103:'reporting findings, conclusions, and recommendations 199 reporting on internal control 201 reporting on noncompliance with provisions of laws, regulations, contracts,',
104:'and grant agreements 203 reporting on instances of fraud 204 reporting findings directly to parties outside the audited entity 205',
105:'obtaining the views of responsible officials 206 report distribution 207 reporting confidential or sensitive information 208 discovery of insufficient evidence',
106:'after report release 210 glossary 211 acknowledgments 222 comptroller general’s advisory council on government auditing standards 20162020 222 gao project',
107:'team 223 staff acknowledgments 223 figures figure 1: generally accepted government auditing standards conceptual framework for independence 61 figure 2:',
108:'independence considerations for preparing accounting records and financial statements 62 figure 3: developing peer review communications for observed matters in',
109:'accordance with generally accepted government auditing standards 108 figure 4: consideration of internal control in a generally accepted government auditing',
110:'standards performance audit 193 abbreviations aicpa american institute of certified public accountants arc aicpa codification of statements on standards for',
111:'accounting and review services atc aicpa codification of statements on standards for attestation engagements auc aicpa codification of statements on',
112:'auditing standards cpa certified public accountant cpe continuing professional education gagas generally accepted government auditing standards iaasb international auditing and',
113:'assurance standards board it information technology omb office of management and budget pcaob public company accounting oversight board sas statements',
114:'on auditing standards ssae statements on standards for attestation engagements this is a work of the u.s. government and is',
115:'not subject to copyright protection in the united states. the published product may be reproduced and distributed in its entirety',
116:'without further permission from gao. however, because this work may contain copyrighted images or other material, permission from the copyright',
117:'holder may be necessary if you wish to reproduce this material separately. letter audits provide essential accountability and transparency over',
118:'government programs. given the current challenges facing governments and their programs, the oversight provided through auditing is more critical than',
119:'ever. government auditing provides the objective analysis and information needed to make the decisions necessary to help create a better',
120:'future. the professional standards presented in this 2018 revision of government auditing standards known as the yellow book provide a',
121:'framework for performing highquality audit work with competence, integrity, objectivity, and independence to provide accountability and to help improve government',
122:'operations and services. these standards, commonly referred to as generally accepted government auditing standards gagas, provide the foundation for government',
123:'auditors to lead by example in the areas of independence, transparency, accountability, and quality through the audit process. this revision',
124:'contains major changes from, and supersedes, the 2011 revision. these changes, summarized below, reinforce the principles of transparency and accountability',
125:'and strengthen the framework for high quality government audits. all chapters are presented in a revised format that differentiates requirements',
126:'and application guidance related to those requirements. supplemental guidance from the appendix of the 2011 revision is either removed or',
127:'incorporated into the individual chapters. the independence standard is expanded to state that preparing financial statements from a clientprovided trial',
128:'balance or underlying accounting records generally creates significant threats to auditors’ independence, and auditors should document the threats and safeguards',
129:'applied to eliminate and reduce threats to an acceptable level or decline to perform the service. the peer review standard',
130:'is modified to require that audit organizations comply with their respective affiliated organization’s peer review requirements and gagas peer review',
131:'requirements. additional requirements are provided for audit organizations not affiliated with recognized organizations. the standards include a definition for waste.',
132:'the performance audit standards are updated with specific considerations for when internal control is significant to the audit objectives. effective',
133:'with the implementation dates for the 2018 revision of government auditing standards, gao is also retiring government auditing standards: guidance',
134:'on gagas requirements for continuing professional education gao05568g, april 2005 and government auditing standards: guidance for understanding the new peer',
135:'review ratings d06602, january 2014. this revision of the standards has gone through an extensive deliberative process, including public comments',
136:'and input from the comptroller general’s advisory council on government auditing standards advisory council. the advisory council consists of experts',
137:'in financial and performance auditing and reporting from federal, state, and local government; the private sector; and academia. the views',
138:'of all parties were thoroughly considered in finalizing the standards. the 2018 revision of government auditing standards is effective for',
139:'financial audits, attestation engagements, and reviews of financial statements for periods ending on or after june 30, 2020, and for',
140:'performance audits beginning on or after july 1, 2019. early implementation is not permitted. an electronic version of this document',
141:'can be accessed at http://www.gao.gov/yellowbook. i extend special thanks to the members of the advisory council for their extensive input',
142:'and feedback throughout the process of developing and finalizing the standards. gene l. dodaro comptroller general of the united states',
143:'july 2018 chapter 1: foundation and principles for the use and application of government auditing standards 1.01 this chapter provides',
144:'guidance for engagements conducted in accordance with generally accepted government auditing standards gagas. this chapter also a. explains the types',
145:'of auditors and audit organizations that may employ gagas to conduct their work, b. identifies the types of engagements that',
146:'may be conducted in accordance with gagas, and c. explains terminology that is commonly used in gagas. introduction 1.02 the',
147:'concept of accountability for use of public resources and government authority is key to our nation’s governing processes. management and',
148:'officials entrusted with public resources are responsible for carrying out public functions and providing service to the public effectively, efficiently,',
149:'economically, ethically, and equitably within the context of the statutory boundaries of the specific government program. 1.03 as reflected in',
150:'applicable laws, regulations, agreements, and standards, management and officials of government programs are responsible for providing reliable, useful, and timely',
151:'information for transparency and accountability of these programs and their operations. legislators, oversight bodies, those charged with governance, and the',
152:'public need to know whether 1 management and officials manage government resources and use their authority properly and in compliance',
153:'with laws and regulations; 2 government programs are achieving their objectives and desired outcomes; and 3 government services are provided',
154:'effectively, efficiently, economically, ethically, and equitably. 1.04 “those charged with governance” refers to the individuals responsible for overseeing the strategic',
155:'direction of the entity and obligations related to the accountability of the entity. this includes overseeing the financial reporting process,',
156:'subject matter, or program under audit, including related internal controls. those charged with governance may also be part of the',
157:'entity’s management. in some audited entities, multiple parties may be charged with governance, including oversight bodies, members or staff of',
158:'legislative committees, boards of directors, audit committees, or parties contracting for the engagement. 1.05 government auditing is essential in providing',
159:'accountability to legislators, oversight bodies, those charged with governance, and the public. gagas engagements provide an independent, objective, nonpartisan assessment',
160:'of the stewardship, performance, or cost of government policies, programs, or operations, depending upon the type and scope of the',
161:'engagement. 1.06 the professional standards and guidance contained in this document provide a framework for conducting highquality engagements with competence,',
162:'integrity, objectivity, and independence. auditors of government entities, entities that receive government awards, and other entities, as required by law',
163:'or regulation or as they elect, may use these standards. overall, gagas contains standards for engagements comprising individual requirements that',
164:'are identified by terminology as discussed in paragraphs 2.02 through 2.10. gagas contains requirements and guidance dealing with ethics, independence,',
165:'auditors’ professional judgment and competence, quality control, peer review, conducting the engagement, and reporting. 1.07 engagements conducted in accordance with',
166:'gagas provide information used for oversight, accountability, transparency, and improvements of government programs and operations. gagas contains requirements and guidance',
167:'to assist auditors in objectively obtaining and evaluating sufficient, appropriate evidence and reporting the results. when auditors conduct their work',
168:'in this manner and comply with gagas in reporting the results, their work can lead to improved government management, better',
169:'decision making and oversight, effective and efficient operations, and accountability and transparency for resources and results. 1.08 laws, regulations, contracts,',
170:'grant agreements, and policies frequently require that engagements be conducted in accordance with gagas. in addition, many auditors and audit',
171:'organizations voluntarily choose to conduct their work in accordance with gagas. the requirements and guidance in gagas in totality apply',
172:'to engagements pertaining to government entities, programs, activities, and functions, and to government assistance administered by contractors, nonprofit entities, and',
173:'other nongovernmental entities when the use of gagas is required or voluntarily adopted. 1.09 the following are some of the',
174:'laws, regulations, and other authoritative sources that require the use of gagas: a. the inspector general act of 1978, as',
175:'amended 5 u.s.c. app., requires that the federal inspectors general appointed under that act comply with gagas for audits of',
176:'federal establishments, organizations, programs, activities, and functions. the act further states that the inspectors general shall take appropriate steps to',
177:'assure that any work performed by nonfederal auditors complies with gagas. b. the chief financial officers act of 1990 public',
178:'law 101576, as expanded by the government management reform act of 1994 public law 103356, requires that gagas be followed',
179:'in audits of major executive branch departments’ and agencies’ financial statements. the accountability of tax dollars act of 2002 public',
180:'law 107289 generally extends this requirement to most executive agencies not subject to the chief financial officers act. c. the',
181:'single audit act amendments of 1996 public law 104156 requires that gagas be followed in audits of state and local',
182:'governments and nonprofit entities that receive federal awards. subpart f of omb’s uniform administrative requirements, cost principles, and audit requirements',
183:'for federal awards 2 c.f.r. part 200, which provides the governmentwide guidelines and policies on conducting audits to comply with',
184:'the single audit act, reiterates the requirement to use gagas. 1.10 other laws, regulations, or authoritative sources may require the',
185:'use of gagas. for example, auditors at the state and local government levels may be required by state and local',
186:'laws and regulations to follow gagas. also, auditors may be required by the terms of an agreement or contract to',
187:'follow gagas. auditors may also be required to follow gagas by federal audit guidelines pertaining to program requirements. being aware',
188:'of such other laws, regulations, or authoritative sources may assist auditors in performing their work in accordance with the required',
189:'standards. 1.11 even if not required to do so, auditors may find it useful to follow gagas in conducting engagements',
190:'pertaining to federal, state, and local government programs as well as engagements pertaining to state and local government awards that',
191:'contractors, nonprofit entities, and other nongovernmental entities administer. though not formally required to do so, many audit organizations, both in',
192:'the united states and in other countries, voluntarily follow gagas. types of gagas users 1.12 gagas provides standards that are',
193:'used by a wide range of auditors and audit organizations that audit government entities, entities that receive government awards, and',
194:'other entities. these auditors and audit organizations may also be subject to additional requirements unique to their environments. examples of',
195:'the various types of users who may be required or may elect to use gagas include the following: a. contract',
196:'auditors: audit organizations that specialize in conducting engagements pertaining to government acquisitions and contract administration b. certified public accounting firms:',
197:'public accounting organizations in the private sector that provide audit, attestation, or review services under contract to government entities or',
198:'recipients of government funds c. federal inspectors general: government audit organizations within federal agencies that conduct engagements and investigations relating',
199:'to the programs and operations of their agencies and issue reports both to agency management and to third parties external',
200:'to the audited entity d. federal agency internal auditors: internal government audit organizations associated with federal agencies that conduct engagements',
201:'and investigations relating to the programs and operations of their agencies e. municipal auditors: elected or appointed officials in government',
202:'audit organizations in the united states at the city, county, and other local government levels f. state auditors: elected or',
203:'appointed officials in audit organizations in the governments of the 50 states, the district of columbia, and the u.s. territories',
204:'g. supreme audit institutions: national government audit organizations, in the united states or elsewhere, typically headed by a comptroller general',
205:'or auditor general types of gagas engagements 1.13 this section describes the types of engagements that audit organizations may conduct',
206:'in accordance with gagas. this description is not intended to limit or require the types of engagements that may be',
207:'conducted in accordance with gagas. 1.14 all gagas engagements begin with objectives, and those objectives determine the type of engagement',
208:'to be conducted and the applicable standards to be followed. this document classifies financial audits, attestation engagements, reviews of financial',
209:'statements, and performance audits, as defined by their objectives, as the types of engagements that are covered by gagas. 1.15',
210:'in some gagas engagements, the standards applicable to the specific objective will be apparent. for example, if the objective is',
211:'to express an opinion on financial statements, the standards for financial audits apply. however, some engagements may have objectives that',
212:'could be met using more than one approach. for example, if the objective is to determine the reliability of performance',
213:'measures, auditors can perform this work in accordance with either the standards for attestation engagements or performance audits. 1.16 gagas',
214:'requirements and guidance apply to the types of engagements that auditors may conduct in accordance with gagas as follows: a.',
215:'financial audits: the requirements and guidance in chapters 1 through 6 apply. b. attestationlevel examination, review, and agreedupon procedures engagements',
216:'and reviews of financial statements: the requirements and guidance in chapters 1 through 5 and 7 apply. c. performance audits:',
217:'the requirements and guidance in chapters 1 through 5, 8, and 9 apply. financial audits 1.17 financial audits provide independent',
218:'assessments of whether entities’ reported financial information e.g., financial condition, results, and use of resources is presented fairly, in all',
219:'material respects, in accordance with recognized criteria. financial audits conducted in accordance with gagas include financial statement audits and other',
220:'related financial audits. a. financial statement audits: the primary purpose of a financial statement audit is to provide financial statement',
221:'users with an opinion by an auditor on whether an entity’s financial statements are presented fairly, in all material respects,',
222:'in accordance with an applicable financial reporting framework. reporting on financial statement audits conducted in accordance with gagas also includes',
223:'reports on internal control over financial reporting and on compliance with provisions of laws, regulations, contracts, and grant agreements that',
224:'have a material effect on the financial statements. b. other types of financial audits: other types of financial audits conducted',
225:'in accordance with gagas entail various scopes of work, including 1 obtaining sufficient, appropriate evidence to form an opinion on',
226:'a single financial statement or specified elements, accounts, or line items of a financial statement;1 2 issuing letters commonly referred',
227:'to as comfort letters for underwriters and certain other requesting parties;2 3 auditing applicable compliance and internal control requirements relating',
228:'to one or more government programs;3 and 4 conducting an audit of internal control over financial reporting that is integrated',
229:'with an audit of financial statements integrated audit.4 1see auc section 805, special considerations – audits of single financial statements',
230:'and specific elements, accounts, or items of a financial statement aicpa, professional standards. 2see auc section 920, letters for underwriters',
231:'and certain other requesting parties aicpa, professional standards. 3see auc section 935, compliance audits aicpa, professional standards. 4see auc section',
232:'940, an audit of internal control over financial reporting that is integrated with an audit of financial statements aicpa, professional',
233:'standards. attestation engagements and reviews of financial statements 1.18 attestation engagements can cover a broad range of financial or nonfinancial',
234:'objectives about the subject matter or assertion depending on the users’ needs. in an attestation engagement, the subject matter or',
235:'an assertion by a party other than the auditors is measured or evaluated in accordance with suitable criteria. the work',
236:'the auditors perform and the level of assurance associated with the report vary based on the type of attestation engagement.',
237:'the three types of attestation engagements are as follows: a. examination: an auditor obtains reasonable assurance by obtaining sufficient, appropriate',
238:'evidence about the measurement or evaluation of subject matter against criteria in order to be able to draw reasonable conclusions',
239:'on which to base the auditor’s opinion about whether the subject matter is in accordance with or based on the',
240:'criteria or the assertion is fairly stated, in all material respects. the auditor obtains the same level of assurance in',
241:'an examination as in a financial statement audit.5 b. review: an auditor obtains limited assurance by obtaining sufficient, appropriate review',
242:'evidence about the measurement or evaluation of subject matter against criteria in order to express a conclusion about whether any',
243:'material modification should be made to the subject matter in order for it to be in accordance with or based',
244:'on the criteria or to the assertion in order for it to be fairly stated. reviewlevel work does not include',
245:'reporting on internal control or compliance with provisions of laws, regulations, contracts, and grant agreements. the auditor obtains the same',
246:'level of assurance in a review engagement as in a review of financial statements.6 c. agreedupon procedures engagement: an auditor',
247:'performs specific procedures on subject matter or an assertion and reports the findings without providing an opinion or a conclusion',
248:'on it. the specified parties to the engagement agree upon and are responsible for the sufficiency of the procedures for',
249:'their 5see atc section 205, examination engagements aicpa, professional standards. 6see atc section 210, review engagements aicpa, professional standards. purposes.',
250:'the specified parties are the intended users to whom use of the report is limited.7 7see atc section 215, agreedupon',
251:'procedures engagements aicpa, professional standards. 8see arc section 90, review of financial statements aicpa, professional standards. 1.19 the subject matter',
252:'of an attestation engagement may take many forms, including the following: a. historical or prospective performance or condition, historical or',
253:'prospective financial information, performance measurements, or backlog data; b. physical characteristics, for example, narrative descriptions or square footage of facilities;',
254:'c. historical events, for example, the price of a market basket of goods on a certain date; d. analyses, for',
255:'example, breakeven analyses; e. systems and processes, for example, internal control; and f. behavior, for example, corporate governance, compliance with',
256:'laws and regulations, and human resource practices. 1.20 the objective of the auditor when performing a review of financial statements',
257:'is to obtain limited assurance as a basis for reporting whether the auditor is aware of any material modifications that',
258:'should be made to financial statements in order for the financial statements to be in accordance with the applicable financial',
259:'reporting framework. a review of financial statements does not include obtaining an understanding of the entity’s internal control, assessing fraud',
260:'risk, or certain other procedures ordinarily performed in an audit.8 performance audits 1.21 performance audits provide objective analysis, findings, and',
261:'conclusions to assist management and those charged with governance and oversight with, among other things, improving program performance and operations,',
262:'reducing costs, facilitating decision making by parties responsible for overseeing or initiating corrective action, and contributing to public accountability. 1.22',
263:'performance audit objectives vary widely and include assessments of program effectiveness, economy, and efficiency; internal control; compliance; and prospective analyses.',
264:'audit objectives may also pertain to the current status or condition of a program. these overall objectives are not mutually',
265:'exclusive. for example, a performance audit with an objective of determining or evaluating program effectiveness may also involve an additional',
266:'objective of evaluating the program’s internal controls. key categories of performance audit objectives include the following: a. program effectiveness and',
267:'results audit objectives. these are frequently interrelated with economy and efficiency objectives. audit objectives that focus on program effectiveness and',
268:'results typically measure the extent to which a program is achieving its goals and objectives. audit objectives that focus on',
269:'economy and efficiency address the costs and resources used to achieve program results. b. internal control audit objectives. these relate',
270:'to an assessment of one or more aspects of an entity’s system of internal control that is designed to provide',
271:'reasonable assurance of achieving effective and efficient operations, reliability of reporting for internal and external use, or compliance with provisions',
272:'of applicable laws and regulations. internal control objectives also may be relevant when determining the cause of unsatisfactory program performance.',
273:'internal control is a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that',
274:'the objectives of an entity will be achieved. internal control comprises the plans, methods, policies, and procedures used to fulfill',
275:'the mission, strategic plan, goals, and objectives of the entity. c. compliance audit objectives. these relate to an assessment of',
276:'compliance with criteria established by provisions of laws, regulations, contracts, and grant agreements, or other requirements that could affect the',
277:'acquisition, protection, use, and disposition of the entity’s resources and the quantity, quality, timeliness, and cost of services the entity',
278:'produces and delivers. compliance requirements can be either financial or nonfinancial. d. prospective analysis audit objectives. these provide analysis or',
279:'conclusions about information that is based on assumptions about events that may occur in the future, along with possible actions',
280:'that the entity may take in response to the future events. 1.23 examples of program effectiveness and results audit objectives',
281:'include a. assessing the extent to which legislative, regulatory, or organizational goals and objectives are being achieved; b. assessing the',
282:'relative ability of alternative approaches to yield better program performance or eliminate factors that inhibit program effectiveness; c. analyzing the',
283:'relative costeffectiveness of a program or activity, focusing on combining cost information or other inputs with 1 information about outputs',
284:'or the benefit provided or 2 outcomes or the results achieved; d. determining whether a program produced intended results or',
285:'produced results that were not consistent with the program’s objectives; e. determining the current status or condition of program operations',
286:'or progress in implementing legislative requirements; f. determining whether a program provides equitable access to or distribution of public resources',
287:'within the context of statutory parameters; g. assessing the extent to which programs duplicate, overlap, or conflict with other related',
288:'programs; h. evaluating whether the entity is following sound procurement practices; i. assessing the reliability, validity, or relevance of performance',
289:'measures concerning program effectiveness and results or economy and efficiency; j. assessing the reliability, validity, or relevance of financial information',
290:'related to the performance of a program; k. determining whether government resources inputs are obtained at reasonable costs while meeting',
291:'timeliness and quality considerations; l. determining whether appropriate value was obtained based on the cost or amount paid or based',
292:'on the amount of revenue received; m. determining whether government services and benefits are accessible to those individuals who have',
293:'a right to access those services and benefits; n. determining whether fees assessed cover costs; o. determining whether and how',
294:'the program’s unit costs can be decreased or its productivity increased; and p. assessing the reliability, validity, or relevance of',
295:'budget proposals or budget requests to assist legislatures in the budget process. 1.24 examples of internal control audit objectives include',
296:'determining whether a. organizational missions, goals, and objectives are achieved effectively and efficiently; b. resources are used in compliance with',
297:'laws, regulations, or other requirements; c. resources, including sensitive information accessed or stored outside the organization’s physical perimeter, are safeguarded',
298:'against unauthorized acquisition, use, or disposition; d. management information, such as performance measures, and public reports are complete, accurate, and',
299:'consistent to support performance and decision making; e. the integrity of information from computerized systems is achieved; and f. contingency',
300:'planning for information systems provides essential backup to prevent unwarranted disruption of the activities and functions that the systems support.',
301:'1.25 examples of compliance objectives include determining whether a. the purpose of the program, the manner in which it is',
302:'to be conducted, the services delivered, the outcomes, or the population it serves is in compliance with provisions of laws,',
303:'regulations, contracts, or grant agreements or other requirements; b. government services and benefits are distributed or delivered to citizens based',
304:'on eligibility to obtain those services and benefits; c. incurred or proposed costs are in compliance with applicable laws, regulations,',
305:'contracts, or grant agreements; and d. revenues received are in compliance with applicable laws, regulations, contracts, or grant agreements. 1.26',
306:'examples of prospective analysis objectives include providing conclusions based on a. current and projected trends and future potential impact on',
307:'government programs and services and their implications for program or policy alternatives; b. program or policy alternatives, including forecasting program',
308:'outcomes under various assumptions; c. policy or legislative proposals, including advantages, disadvantages, and analysis of stakeholder views; d. prospective information',
309:'prepared by management; e. budgets and forecasts that are based on 1 assumptions about expected future events and 2 stakeholders’',
310:'and management’s expected reaction to those future events; and f. management’s assumptions on which prospective information is based. terms used',
311:'in gagas 1.27 this paragraph describes certain terms used in gagas. when terminology differs from that used at an organization',
312:'subject to gagas, auditors use professional judgment to determine if there is an equivalent term.9 9see the glossary for an',
313:'expanded list of terms used in gagas. a. attestation engagement: an examination, review, or agreedupon procedures engagement conducted under the',
314:'gagas attestation standards related to subject matter or an assertion that is the responsibility of another party. b. audit: either',
315:'a financial audit or performance audit conducted in accordance with gagas. c. audit organization: a government audit entity or a',
316:'public accounting firm or other audit entity that conducts gagas engagements. d. audit report: a report issued as a result',
317:'of a financial audit, attestation engagement, review of financial statements, or performance audit conducted in accordance with gagas. e. audited',
318:'entity: the entity that is subject to a gagas engagement, whether that engagement is a financial audit, attestation engagement, review',
319:'of financial statements, or performance audit. f. auditor: an individual assigned to planning, directing, performing engagement procedures, or reporting on',
320:'gagas engagements including work on audits, attestation engagements, and reviews of financial statements regardless of job title. therefore, individuals who',
321:'may have the title auditor, information technology auditor, analyst, practitioner, evaluator, inspector, or other similar titles are considered auditors under',
322:'gagas. g. control objective: the aim or purpose of specified controls; control objectives address the risks related to achieving an',
323:'entity’s objectives. h. engagement: a financial audit, attestation engagement, review of financial statements, or performance audit conducted in accordance with',
324:'gagas. i. engagement team or audit team: auditors assigned to planning, directing, performing engagement procedures, or reporting on gagas engagements.',
325:'j. engaging party: the party that engages the auditor to conduct the gagas engagement. k. entity objective: what an entity',
326:'wants to achieve; entity objectives are intended to meet the entity’s mission, strategic plan, and goals and the requirements of',
327:'applicable laws and regulations. l. external audit organization: an audit organization that issues reports to third parties external to the',
328:'audited entity, either exclusively or in addition to issuing reports to senior management and those charged with governance of the',
329:'audited entity. m. internal audit organization: an audit organization that is accountable to senior management and those charged with governance',
330:'of the audited entity and that does not generally issue reports to third parties external to the audited entity. n.',
331:'responsible party: the party responsible for a gagas engagement’s subject matter. o. review of financial statements: an engagement conducted under',
332:'gagas for review of financial statements. p. specialist: an individual or organization possessing special skill or knowledge in a particular',
333:'field other than accounting or auditing that assists auditors in conducting engagements. a specialist may be either an internal specialist',
334:'or an external specialist. the gagas format 1.28 gagas uses a format designed to allow auditors to quickly identify requirements',
335:'and application guidance related to those requirements. gagas requirements are differentiated from application guidance by borders surrounding the text. the',
336:'requirements are followed immediately by application guidance that relates directly to the preceding requirements. the auditors’ responsibilities related to requirements',
337:'and application guidance are discussed in paragraphs 2.02 through 2.10. chapter 2: general requirements for complying with government auditing standards',
338:'2.01 this chapter establishes general requirements for complying with generally accepted government auditing standards gagas that are applicable to all',
339:'gagas engagements. the information it contains relates to how auditors conducting gagas engagements identify and apply the requirements contained in',
340:'gagas. the chapter also contains requirements for using other audit standards in conjunction with gagas and for reporting compliance with',
341:'gagas in the audit report. complying with gagas requirements: complying with gagas 2.02 gagas uses two categories of requirements, identified',
342:'by specific terms, to describe the degree of responsibility they impose on auditors and audit organizations: a. unconditional requirements: auditors',
343:'and audit organizations must comply with an unconditional requirement in all cases where such requirement is relevant. gagas uses must',
344:'to indicate an unconditional requirement. b. presumptively mandatory requirements: auditors and audit organizations must comply with a presumptively mandatory requirement',
345:'in all cases where such a requirement is relevant except in rare circumstances discussed in paragraphs 2.03, 2.04, and 2.08.',
346:'gagas uses should to indicate a presumptively mandatory requirement.10 2.03 in rare circumstances, auditors and audit organizations may determine it',
347:'necessary to depart from a relevant presumptively mandatory requirement. in such rare circumstances, auditors should perform alternative procedures to achieve',
348:'the intent of that requirement. 2.04 if, in rare circumstances, auditors judge it necessary to depart from a relevant presumptively',
349:'mandatory requirement, they must document their justification for the departure and how the alternative 10see para. 2.19 for additional documentation',
350:'requirements for departures from gagas requirements. procedures performed in the circumstances were sufficient to achieve the intent of that requirement.',
351:'2.05 auditors should have an understanding of the entire text of applicable chapters of gagas, including application guidance, and any',
352:'amendments that gao issued, to understand the intent of the requirements and to apply the requirements properly.11 2.06 auditors should',
353:'consider applicable gaoissued gagas interpretive guidance in conducting and reporting on gagas engagements.12 11see http://www.gao.gov/yellowbook for gagas amendments. 12see http://www.gao.gov/yellowbook',
354:'for gagas interpretive guidance. 13see paras. 2.13, 6.01, and 7.01 for discussion of standards incorporated by reference. application guidance: complying',
355:'with gagas 2.07 gagas contains requirements together with related explanatory material in the form of application guidance. not every paragraph',
356:'of gagas carries a requirement. rather, gagas identifies the requirements through use of specific language. gagas also contains introductory material',
357:'that provides context relevant to a proper understanding of a gagas chapter or section. having an understanding of the entire',
358:'text of applicable gagas includes an understanding of any financial audit, attestation, and reviews of financial statement standards incorporated by',
359:'reference.13 2.08 the need for auditors to depart from a relevant presumptively mandatory requirement is expected to arise only when',
360:'the requirement is for a specific procedure to be performed and, in the specific circumstances of the engagement, that procedure',
361:'would be ineffective in achieving the intent of the requirement. 2.09 the application guidance provides further explanation of the requirements',
362:'and guidance for applying them. in particular, it may explain more precisely what a requirement means or is intended to',
363:'address or include examples of procedures that may be appropriate in the circumstances. although such guidance does not in itself',
364:'impose a requirement, it is relevant to the proper application of the requirements. “may,” “might,” and “could” are used to',
365:'describe these actions and procedures. the application guidance may also provide background information on matters addressed in gagas. 2.10 interpretive',
366:'guidance is not auditing standards. interpretive guidance provides guidance on the application of gagas and recommendations on the application of',
367:'gagas in specific circumstances. relationship between gagas and other professional standards requirement: relationship between gagas and other professional standards 2.11',
368:'when auditors cite compliance with both gagas and another set of standards, such as those listed in paragraphs 2.13, 2.15,',
369:'6.01, and 7.01, auditors should refer to paragraph 2.17 for the requirements for citing compliance with gagas. in addition to',
370:'citing gagas, auditors may also cite the use of other standards in their reports when they have also met the',
371:'requirements for citing compliance with the other standards. auditors should refer to the other set of standards for the basis',
372:'for citing compliance with those standards. application guidance: relationship between gagas and other professional standards 2.12 auditors may use gagas',
373:'in conjunction with professional standards issued by other authoritative bodies. 2.13 the relationship between gagas and other professional standards for',
374:'financial audits, attestation engagements, and reviews of financial statements is as follows: a. the american institute of certified public accountants',
375:'aicpa has established professional standards that apply to financial audits, attestation engagements, and reviews of financial statements for nonissuers entities',
376:'other than issuers under the sarbanesoxley act of 2002,14 such as privately held companies, 14see the sarbanesoxley act of 2002',
377:'public law 107204 for a discussion of issuers generally, publicly traded companies with a reporting obligation under the securities exchange',
378:'act of 1934. nonprofit entities, and government entities conducted by certified public accountants cpa. for financial audits and attestation engagements,',
379:'gagas incorporates by reference aicpa statements on auditing standards and statements on standards for attestation engagements.15 for reviews of financial',
380:'statements, gagas incorporates by reference arc, section 90, review of financial statements.16 b. the international auditing and assurance standards board',
381:'iaasb has established professional standards that apply to financial audits and assurance engagements. auditors may elect to use the iaasb',
382:'standards and the related international standards on auditing and international standards on assurance engagements in conjunction with gagas. c. the',
383:'public company accounting oversight board pcaob has established professional standards that apply to financial audits and attestation engagements for issuers.',
384:'auditors may elect to use the pcaob standards in conjunction with gagas. 15aicpa, professional standards. 16aicpa, professional standards. 2.14 for',
385:'financial audits, attestation engagements, and reviews of financial statements, gagas does not incorporate the aicpa code of professional conduct by',
386:'reference, but recognizes that certain cpas may use or may be required to use the code in conjunction with gagas.',
387:'2.15 for performance audits, gagas does not incorporate other standards by reference, but recognizes that auditors may use or may',
388:'be required to use other professional standards in conjunction with gagas, such as the following: a. international standards for the',
389:'professional practice of internal auditing, institute of internal auditors, inc.; b. international standards of supreme audit institutions, international organization of',
390:'supreme audit institutions; c. guiding principles for evaluators, american evaluation association; d. the program evaluation standards, joint committee on standards',
391:'for education evaluation; e. standards for educational and psychological testing, american psychological association; and f. it standards, guidelines, and tools',
392:'and techniques for audit and assurance and control professionals, information systems audit and control association. stating compliance with gagas in',
393:'the audit report requirements: stating compliance with gagas in the audit report 2.16 when auditors are required to conduct an',
394:'engagement in accordance with gagas or are representing to others that they did so, they should cite compliance with gagas',
395:'in the audit report as set forth in paragraphs 2.17 through 2.19. 2.17 auditors should include one of the following',
396:'types of gagas compliance statements in reports on gagas engagements, as appropriate. a. unmodified gagas compliance statement: stating that the',
397:'auditors conducted the engagement in accordance with gagas. auditors should include an unmodified gagas compliance statement in the audit report',
398:'when they have 1 followed unconditional and applicable presumptively mandatory gagas requirements or 2 followed unconditional requirements, documented justification for',
399:'any departures from applicable presumptively mandatory requirements, and achieved the objectives of those requirements through other means. b. modified gagas',
400:'compliance statement: stating either that 1 the auditors conducted the engagement in accordance with gagas, except for specific applicable requirements',
401:'that were not followed, or 2 because of the significance of the departures from the requirements, the auditors were unable',
402:'to and did not conduct the engagement in accordance with gagas. 2.18 when auditors use a modified gagas statement, they',
403:'should disclose in the report the applicable requirements not followed, the reasons for not following the requirements, and how not',
404:'following the requirements affected or could have affected the engagement and the assurance provided. 2.19 when auditors do not comply',
405:'with applicable requirements, they should 1 assess the significance of the noncompliance to the engagement objectives; 2 document the assessment,',
406:'along with their reasons for not following the requirements; and 3 determine the type of gagas compliance statement. application guidance:',
407:'stating compliance with gagas in the audit report 2.20 situations for using modified compliance statements include scope limitations, such as',
408:'restrictions on access to records, government officials, or other individuals needed to conduct the engagement. 2.21 the auditors’ determination of',
409:'noncompliance with applicable requirements is a matter of professional judgment, which is affected by the significance of the requirements not',
410:'followed in relation to the engagement objectives. 2.22 determining whether an unmodified or modified gagas compliance statement is appropriate is',
411:'based on the consideration of the individual and aggregate effect of the instances of noncompliance with gagas requirements. factors that',
412:'the auditor may consider include a. the pervasiveness of the instances of noncompliance; b. the potential effect of the instances',
413:'of noncompliance on the sufficiency and appropriateness of evidence supporting the findings, conclusions, and recommendations; and c. whether report users',
414:'might misunderstand the implications of a modified or unmodified gagas compliance statement. 2.23 if an audit report is issued in',
415:'situations described in paragraph 3.60 except in circumstances discussed in paragraphs 3.25 or 3.84, a modified gagas compliance statement as',
416:'discussed in paragraph 2.17b2 is used. chapter 3: ethics, independence, and professional judgment 3.01 the first section of this chapter',
417:'sets forth fundamental ethical principles for auditors in the government environment. the second section establishes independence standards and provides guidance',
418:'on this topic for auditors conducting financial audits, attestation engagements, reviews of financial statements, and performance audits under generally accepted',
419:'government auditing standards gagas. this section emphasizes the importance of independence of the auditor and the audit organization. the third',
420:'section establishes the standard for the auditor’s use of professional judgment and provides related application guidance. the requirements of this',
421:'chapter are intended to be followed in conjunction with all other applicable gagas requirements. ethical principles 3.02 the ethical principles',
422:'presented in this section provide the foundation, discipline, and structure, as well as the environment, that influence the application of',
423:'gagas.17 17see para. 5.08 for a discussion of ethical requirements in an audit organization’s system of quality control. 18see paras.',
424:'3.18 through 3.108 for requirements and guidance related to independence. 19see paras. 4.02 through 4.15 for additional information on competence.',
425:'3.03 because auditing is essential to government accountability to the public, the public expects audit organizations and auditors who perform',
426:'their work in accordance with gagas to follow ethical principles. management of the audit organization sets the tone for ethical',
427:'behavior throughout the organization by maintaining an ethical culture, clearly communicating acceptable behavior and expectations to each employee, and creating',
428:'an environment that reinforces and encourages ethical behavior throughout all levels of the organization. the ethical tone maintained and demonstrated',
429:'by management and personnel is an essential element of a positive ethical environment for the audit organization. 3.04 performing audit',
430:'work in accordance with ethical principles is a matter of personal and organizational responsibility. ethical principles apply in preserving auditor',
431:'independence,18 taking on only work that the audit organization is competent to perform,19 performing highquality work, and following the applicable',
432:'standards cited in the audit report. integrity and objectivity are maintained when auditors perform their work and make decisions that',
433:'are consistent with the broader interest of those relying on the audit report, including the public. 3.05 other ethical requirements',
434:'or codes of professional conduct may also be applicable to auditors who conduct engagements in accordance with gagas. for example,',
435:'individual auditors who are members of professional organizations or are licensed or certified professionals may also be subject to ethical',
436:'requirements of those professional organizations or licensing bodies. auditors employed by government entities may also be subject to government ethics',
437:'laws and regulations. 3.06 the ethical principles that guide the work of auditors who conduct engagements in accordance with gagas',
438:'are a. the public interest; b. integrity; c. objectivity; d. proper use of government information, resources, and positions; and e.',
439:'professional behavior. the public interest 3.07 the public interest is defined as the collective wellbeing of the community of people',
440:'and entities that the auditors serve. observing integrity, objectivity, and independence in discharging their professional responsibilities helps auditors serve the',
441:'public interest and honor the public trust. the principle of the public interest is fundamental to the responsibilities of auditors',
442:'and critical in the government environment. 3.08 a distinguishing mark of an auditor is acceptance of responsibility to serve the',
443:'public interest. this responsibility is critical when auditing in the government environment. gagas embodies the concept of accountability for public',
444:'resources, which is fundamental to serving the public interest. integrity 3.09 public confidence in government is maintained and strengthened by',
445:'auditors performing their professional responsibilities with integrity. integrity includes auditors performing their work with an attitude that is objective, factbased,',
446:'nonpartisan, and nonideological with regard to audited entities and users of the audit reports. within the constraints of applicable confidentiality',
447:'laws, regulations, or policies, communications with the audited entity, those charged with governance, and the individuals contracting for or requesting',
448:'the engagement are expected to be honest, candid, and constructive. 3.10 making decisions consistent with the public interest of the',
449:'program or activity under audit is an important part of the principle of integrity. in discharging their professional responsibilities, auditors',
450:'may encounter conflicting pressures from management of the audited entity, various levels of government, and other likely users. auditors may',
451:'also encounter pressures to inappropriately achieve personal or organizational gain. in resolving those conflicts and pressures, acting with integrity means',
452:'that auditors place priority on their responsibilities to the public interest. objectivity 3.11 auditors’ objectivity in discharging their professional responsibilities',
453:'is the basis for the credibility of auditing in the government sector. objectivity includes independence of mind and appearance when',
454:'conducting engagements, maintaining an attitude of impartiality, having intellectual honesty, and being free of conflicts of interest. maintaining objectivity includes',
455:'a continuing assessment of relationships with audited entities and other stakeholders in the context of the auditors’ responsibility to the',
456:'public. the concepts of objectivity and independence are closely related. independence impairments affect auditors’ objectivity.20 20see paras. 3.18 through 3.108',
457:'for independence requirements and guidance. proper use of government information, resources, and positions 3.12 government information, resources, and positions are',
458:'to be used for official purposes and not inappropriately for the auditors’ personal gain or in a manner contrary to',
459:'law or detrimental to the legitimate interests of the audited entity or the audit organization. this concept includes the proper',
460:'handling of sensitive or classified information or resources. 3.13 in the government environment, the public’s right to the transparency of',
461:'government information has to be balanced with the proper use of that information. in addition, many government programs are subject',
462:'to laws and regulations dealing with the disclosure of information. exercising discretion in using information acquired in the course of',
463:'auditors’ duties is an important part in achieving this balance. improperly disclosing any such information to third parties is not',
464:'an acceptable practice. 3.14 accountability to the public for the proper use and prudent management of government resources is an',
465:'essential part of auditors’ responsibilities. protecting and conserving government resources and using them appropriately for authorized activities are important elements',
466:'of the public’s expectations for auditors. 3.15 misusing the auditor position for financial gain or other benefits violates an auditor’s',
467:'fundamental responsibilities. an auditor’s credibility can be damaged by actions that could be perceived by an objective third party with',
468:'knowledge of the relevant information as improperly benefiting an auditor’s personal financial interests or those of an immediate or close',
469:'family member; a general partner; an entity for which the auditor serves as an officer, director, trustee, or employee; or',
470:'an entity with which the auditor is negotiating concerning future employment. professional behavior 3.16 high expectations for the auditing profession',
471:'include complying with all relevant legal, regulatory, and professional obligations and avoiding any conduct that could bring discredit to auditors’',
472:'work, including actions that would cause an objective third party with knowledge of the relevant information to conclude that the',
473:'auditors’ work was professionally deficient. professional behavior includes auditors putting forth an honest effort in performing their duties in accordance',
474:'with the relevant technical and professional standards. independence 3.17 gagas’s practical consideration of independence consists of four interrelated sections, providing',
475:'a. general requirements and application guidance; b. requirements for and guidance on a conceptual framework for making independence determinations based',
476:'on facts and circumstances that are often unique to specific environments; c. requirements for and guidance on independence for auditors',
477:'providing nonaudit services, including identification of specific nonaudit services that always impair independence and others that would not normally impair',
478:'independence; and d. requirements for and guidance on documentation necessary to support adequate consideration of auditor independence. requirements: general 3.18',
479:'in all matters relating to the gagas engagement, auditors and audit organizations must be independent from an audited entity. 3.19',
480:'auditors and audit organizations should avoid situations that could lead reasonable and informed third parties to conclude that the auditors',
481:'and audit organizations are not independent and thus are not capable of exercising objective and impartial judgment on all issues',
482:'associated with conducting the engagement and reporting on the work. 3.20 except under the limited circumstances discussed in paragraphs 3.66',
483:'and 3.67, auditors and audit organizations should be independent from an audited entity during a. any period of time that',
484:'falls within the period covered by the financial statements or subject matter of the engagement and b. the period of',
485:'professional engagement. application guidance: general 3.21 independence comprises the following: a. independence of mind: the state of mind that permits',
486:'the conduct of an engagement without being affected by influences that compromise professional judgment, thereby allowing an individual to act',
487:'with integrity and exercise objectivity and professional skepticism. b. independence in appearance: the absence of circumstances that would cause a',
488:'reasonable and informed third party to reasonably conclude that the integrity, objectivity, or professional skepticism of an audit organization or',
489:'member of the engagement team had been compromised. 3.22 auditors and audit organizations maintain their independence so that their opinions,',
490:'findings, conclusions, judgments, and recommendations will be impartial and will be viewed as impartial by reasonable and informed third parties.',
491:'3.23 the period of professional engagement begins when the auditors either sign an initial engagement letter or other agreement to',
492:'conduct an engagement or begin to conduct an engagement, whichever is earlier. the period lasts for the duration of the',
493:'professional relationship—which, for recurring engagements, could cover many periods—and ends with the formal or informal notification, either by the auditors',
494:'or the audited entity, of the termination of the professional relationship or with the issuance of a report, whichever is',
495:'later. accordingly, the period of professional engagement does not necessarily end with the issuance of a report and recommence with',
496:'the beginning of the following year’s engagement or a subsequent engagement with a similar objective. 3.24 under some conditions, the',
497:'party requesting or requiring an engagement, referred to as the engaging party, will differ from the party responsible for the',
498:'engagement’s subject matter, referred to as the responsible party. under such conditions, the gagas independence requirements apply to the relationship',
499:'between the auditors and the responsible party, not the relationship between the auditors and the engaging party. the following are',
500:'examples of conditions under which the party requesting an engagement may differ from the party responsible for the engagement’s subject',
501:'matter. a. a legislative body requires that auditors conduct, on the legislative body’s behalf, a performance audit of program operations',
502:'that are the responsibility of an executive agency. gagas requires that the auditors be independent of the executive agency. b.',
503:'a state agency engages an independent public accountant to conduct an examinationlevel attestation engagement to assess the validity of certain',
504:'information that a local government provided to the state agency. gagas requires that the independent public accountant be independent of',
505:'the local government. c. a government department works with a government agency that conducts examinationlevel attestation engagements of contractor compliance',
506:'with the terms and conditions of agreements between the department and the contractor. gagas requires that the auditors be independent',
507:'of the contractors. 3.25 auditors in government sometimes work under conditions that impair independence in accordance with this section. an',
508:'example of such a circumstance is a threat created by a statutory requirement for auditors to serve in official roles',
509:'that conflict with the independence requirements of this section, such as a law that requires an auditor to serve as',
510:'a voting member of an entity’s management committee or board of directors, for which there are no safeguards to eliminate',
511:'or reduce the threats to an acceptable level. paragraph 2.17b provides standard language for modified gagas compliance statements for auditors',
512:'who experience such impairments. determining how to modify the gagas compliance statement in these circumstances is a matter of professional',
513:'judgment. gagas conceptual framework approach to independence 3.26 many different circumstances, or combinations of circumstances, are relevant in evaluating threats',
514:'to independence. therefore, gagas establishes a conceptual framework that auditors use to identify, evaluate, and apply safeguards to address threats',
515:'to independence. the conceptual framework assists auditors in maintaining both independence of mind and independence in appearance. it can be',
516:'applied to many variations in circumstances that create threats to independence and allows auditors to address threats to independence that',
517:'result from activities that are not specifically prohibited by gagas. requirements: gagas conceptual framework approach to independence 3.27 auditors should',
518:'apply the conceptual framework21 at the audit organization, engagement team, and individual auditor levels to a. identify threats to independence;',
519:'b. evaluate the significance of the threats identified, both individually and in the aggregate; and c. apply safeguards as necessary',
520:'to eliminate the threats or reduce them to an acceptable level. 3.28 auditors should reevaluate threats to independence, including 21see',
521:'fig. 1 at the end of ch. 3 for a flowchart on applying the conceptual framework in accordance with gagas.',
522:'any safeguards applied, whenever the audit organization or the auditors become aware of new information or changes in facts and',
523:'circumstances that could affect whether a threat has been eliminated or reduced to an acceptable level. 3.29 auditors should use',
524:'professional judgment when applying the conceptual framework. 3.30 auditors should evaluate the following broad categories of threats to independence when',
525:'applying the gagas conceptual framework: a. selfinterest threat: the threat that a financial or other interest will inappropriately influence an',
526:'auditor’s judgment or behavior. b. selfreview threat: the threat that an auditor or audit organization that has provided nonaudit services',
527:'will not appropriately evaluate the results of previous judgments made or services provided as part of the nonaudit services when',
528:'forming a judgment significant to a gagas engagement. c. bias threat: the threat that an auditor will, as a result',
529:'of political, ideological, social, or other convictions, take a position that is not objective. d. familiarity threat: the threat that',
530:'aspects of a relationship with management or personnel of an audited entity, such as a close or long relationship, or',
531:'that of an immediate or close family member, will lead an auditor to take a position that is not objective.',
532:'e. undue influence threat: the threat that influences or pressures from sources external to the audit organization will affect an',
533:'auditor’s ability to make objective judgments. f. management participation threat: the threat that results from an auditor’s taking on the',
534:'role of management or otherwise performing management functions on behalf of the audited entity, which will lead an auditor to',
535:'take a position that is not objective. g. structural threat: the threat that an audit organization’s placement within a government',
536:'entity, in combination with the structure of the government entity being audited, will affect the audit organization’s ability to perform',
537:'work and report results objectively. 3.31 auditors should determine whether identified threats to independence are at an acceptable level or',
538:'have been eliminated or reduced to an acceptable level, considering both qualitative and quantitative factors to determine the significance of',
539:'a threat. 3.32 when auditors determine that threats to independence are not at an acceptable level, the auditors should determine',
540:'whether appropriate safeguards can be applied to eliminate the threats or reduce them to an acceptable level. 3.33 in cases',
541:'where auditors determine that threats to independence require the application of safeguards, auditors should document the threats identified and the',
542:'safeguards applied to eliminate or reduce the threats to an acceptable level. 3.34 if auditors initially identify a threat to',
543:'independence after the audit report is issued, auditors should evaluate the threat’s effect on the engagement and on gagas compliance.',
544:'if the auditors determine that the newly identified threat’s effect on the engagement would have resulted in the audit report',
545:'being different from the report issued had the auditors been aware of it, they should communicate in the same manner',
546:'as that used to originally distribute the report to those charged with governance, the appropriate officials of the audited entity,',
547:'the appropriate officials of the audit organization requiring or arranging for the engagements, and other known users, so that they',
548:'do not continue to rely on findings or conclusions that were affected by the threat to independence. if auditors previously',
549:'posted the report to their publicly accessible website, they should remove the report and post a public notification that the',
550:'report was removed. the auditors should then determine whether to perform the additional engagement work necessary to reissue the report,',
551:'including any revised findings or conclusions, or to repost the original report if the additional engagement work does not result',
552:'in a change in findings or conclusions. application guidance: gagas conceptual framework approach to independence 3.35 for consideration of auditor',
553:'independence, offices or units of an audit organization, or related or affiliated entities under common control, are not differentiated from',
554:'one another. consequently, for the purposes of evaluating independence using the conceptual framework, an audit organization that includes multiple offices',
555:'or units, or includes multiple entities related or affiliated through common control, is considered to be one audit organization. common',
556:'ownership may also affect independence in appearance regardless of the level of control. identifying threats 3.36 facts and circumstances that',
557:'create threats to independence can result from events such as the start of a new engagement, assignment of new personnel',
558:'to an ongoing engagement, and acceptance of a nonaudit service for an audited entity. 3.37 threats to independence may be',
559:'created by a wide range of relationships and circumstances. circumstances that result in a threat to independence in one of',
560:'the categories may result in other threats as well. 3.38 examples of circumstances that create selfinterest threats for an auditor',
561:'follow: a. an audit organization having undue dependence on income from a particular audited entity. b. a member of the',
562:'audit team entering into employment negotiations with an audited entity. c. an audit organization discovering a significant error when evaluating',
563:'the results of a previous professional service provided by the audit organization. d. a member of the audit team having',
564:'a direct financial interest in the audited entity. however, this would not preclude auditors from auditing pension plans that they',
565:'participate in if 1 the auditors have no control over the investment strategy, benefits, or other management issues associated with',
566:'the pension plan and 2 the auditors belong to such pension plan as part of their employment with the audit',
567:'organization or prior employment with the audited entity, provided that the plan is normally offered to all employees in equivalent',
568:'employment positions. 3.39 examples of circumstances that create selfreview threats for an auditor follow: a. an audit organization issuing a',
569:'report on the effectiveness of the operation of financial or performance management systems after designing or implementing the systems. b.',
570:'an audit organization having prepared the original data used to generate records that are the subject matter of the engagement.',
571:'c. an audit organization providing a service for an audited entity that directly affects the subject matter information of the',
572:'engagement. d. a member of the engagement team being, or having recently been, employed by the audited entity in a',
573:'position to exert significant influence over the subject matter of the engagement. 3.40 examples of circumstances that create bias threats',
574:'for an auditor follow: a. a member of the engagement team having preconceptions about the objectives of a program under',
575:'audit that are strong enough to affect the auditor’s objectivity. b. a member of the engagement team having biases associated',
576:'with political, ideological, or social convictions that result from membership or employment in, or loyalty to, a particular type of',
577:'policy, group, entity, or level of government that could affect the auditor’s objectivity. 3.41 examples of circumstances that create familiarity',
578:'threats for an auditor follow: a. a member of the engagement team having a close or immediate family member who',
579:'is a principal or senior manager of the audited entity. b. a member of the engagement team having a close',
580:'or immediate family member who is an employee of the audited entity and is in a position to exert significant',
581:'influence over the subject matter of the engagement. c. a principal or employee of the audited entity having recently served',
582:'on the engagement team in a position to exert significant influence over the subject matter of the engagement. d. an',
583:'auditor accepting gifts or preferential treatment from an audited entity, unless the value is trivial or inconsequential. e. senior engagement',
584:'personnel having a long association with the audited entity. 3.42 examples of circumstances that create undue influence threats for an',
585:'auditor or audit organization include existence of the following: a. external interference or influence that could improperly limit or modify',
586:'the scope of an engagement or threaten to do so, including exerting pressure to inappropriately reduce the extent of work',
587:'performed in order to reduce costs or fees. b. external interference with the selection or application of engagement procedures or',
588:'in the selection of transactions to be examined. c. unreasonable restrictions on the time allowed to complete an engagement or',
589:'issue the report. d. external interference over assignment, appointment, compensation, and promotion. e. restrictions on funds or other resources provided',
590:'to the audit organization that adversely affect the audit organization’s ability to carry out its responsibilities. f. authority to overrule',
591:'or to inappropriately influence the auditors’ judgment as to the appropriate content of the report. g. threat of replacing the',
592:'auditor or the audit organization based on a disagreement with the contents of an audit report, the auditors’ conclusions, or',
593:'the application of an accounting principle or other criteria. h. influences that jeopardize the auditors’ continued employment for reasons other',
594:'than incompetence, misconduct, or the audited entity’s need for gagas engagements. 3.43 examples of circumstances that create management participation threats',
595:'for an auditor follow: a. a member of the engagement team being, or having recently been, a principal or senior',
596:'manager of the audited entity. b. an auditor serving as a voting member of an entity’s management committee or board',
597:'of directors, making policy decisions that affect future direction and operation of an entity’s programs, supervising entity employees, developing or',
598:'approving programmatic policy, authorizing an entity’s transactions, or maintaining custody of an entity’s assets. c. an auditor or audit organization',
599:'recommending a single individual for a specific position that is key to the audited entity or program under audit, or',
600:'otherwise ranking or influencing management’s selection of the candidate. d. an auditor preparing management’s corrective action plan to deal with',
601:'deficiencies detected in the engagement. 3.44 examples of circumstances that create structural threats for an auditor follow: a. for both',
602:'external and internal audit organizations, structural placement of the audit function within the reporting line of the areas under audit.',
603:'b. for internal audit organizations, administrative direction from the audited entity’s management. evaluating threats 3.45 threats to independence are evaluated',
604:'both individually and in the aggregate, as threats can have a cumulative effect on auditors’ independence. 3.46 when evaluating threats',
605:'to independence, an acceptable level is a level at which a reasonable and informed third party would likely conclude that',
606:'the audit organization or auditor is independent. the concept of a reasonable and informed third party is a test that',
607:'involves an evaluation by a hypothetical person. such a person possesses skills, knowledge, and experience to objectively evaluate the appropriateness',
608:'of the auditor’s judgments and conclusions. this evaluation entails weighing all the relevant facts and circumstances, including any safeguards applied,',
609:'that the auditor knows, or could reasonably be expected to know, at the time that the evaluation is made. 3.47',
610:'a threat to independence is not at an acceptable level if it either a. could affect the auditors’ ability to',
611:'conduct an engagement without being affected by influences that compromise professional judgment or b. could expose the auditors or audit',
612:'organization to circumstances that would cause a reasonable and informed third party to conclude that the integrity, objectivity, or professional',
613:'skepticism of the audit organization, or an auditor, had been compromised. 3.48 the gagas section on nonaudit services in paragraphs',
614:'3.64 through 3.106 provides requirements and guidance on evaluating threats to independence related to nonaudit services that auditors provide to',
615:'audited entities. that section also enumerates specific nonaudit services that always impair auditor independence with respect to audited entities and',
616:'that auditors are prohibited from providing to audited entities. applying safeguards 3.49 safeguards are actions or other measures, individually or',
617:'in combination, that auditors and audit organizations take that effectively eliminate threats to independence or reduce them to an acceptable',
618:'level. safeguards vary depending on the facts and circumstances. 3.50 examples of safeguards include a. consulting an independent third party,',
619:'such as a professional organization, a professional regulatory body, or another auditor to discuss engagement issues or assess issues that',
620:'are highly technical or that require significant judgment; b. involving another audit organization to perform or reperform part of the',
621:'engagement; c. having an auditor who was not a member of the engagement team review the work performed; and d.',
622:'removing an auditor from an engagement team when that auditor’s financial or other interests or relationships pose a threat to',
623:'independence. 3.51 the lists of safeguards in 3.50 and 3.69 cannot provide safeguards for all circumstances. they may, however, provide',
624:'a starting point for auditors who have identified threats to independence and are considering what safeguards could eliminate those threats',
625:'or reduce them to an acceptable level. in some cases, multiple safeguards may be necessary to address a threat. audit',
626:'organizations in government entities 3.52 the ability of an audit organization structurally located in a government entity to perform work',
627:'and report the results objectively can be affected by its placement within the government entity and the structure of the',
628:'government entity being audited. the independence standard applies to auditors in both external audit organizations reporting to third parties externally',
629:'or to both internal and external parties and internal audit organizations reporting only to senior management within the audited entity.',
630:'such audit organizations are often subject to constitutional or statutory safeguards that mitigate the effects of structural threats to independence.',
631:'3.53 for external audit organizations, constitutional or statutory safeguards that mitigate the effects of structural threats to independence may include',
632:'governmental structures under which a government audit organization is a. at a level of government other than the one of',
633:'which the audited entity is part federal, state, or local—for example, federal auditors auditing a state government program—or b. placed',
634:'within a different branch of government from that of the audited entity—for example, legislative auditors auditing an executive branch program.',
635:'3.54 safeguards other than those described in paragraph 3.53 may mitigate threats resulting from governmental structures. for external audit organizations,',
636:'structural threats may be mitigated if the head of the audit organization meets any of the following criteria in accordance',
637:'with constitutional or statutory requirements: a. directly elected by voters of the jurisdiction being audited; b. elected or appointed by',
638:'a legislative body, subject to removal by a legislative body, and reporting the results of engagements to and accountable to',
639:'a legislative body; c. appointed by someone other than a legislative body, so long as the appointment is confirmed by',
640:'a legislative body and removal from the position is subject to oversight or approval by a legislative body, and reports',
641:'the results of engagements to and is accountable to a legislative body; or d. appointed by, accountable to, reports to,',
642:'and can only be removed by a statutorily created governing body, the majority of whose members are independently elected or',
643:'appointed and are outside the organization being audited. 3.55 in addition to the criteria in paragraphs 3.53 and 3.54, gagas',
644:'recognizes that there may be other organizational structures under which external audit organizations in government entities could be considered independent.',
645:'if appropriately designed and implemented, these structures provide safeguards that prevent the audited entity from interfering with the audit organization’s',
646:'ability to perform the work and report the results impartially. an external audit organization may be structurally independent under a',
647:'structure different from the ones listed in paragraphs 3.53 and 3.54 if the government audit organization is subject to all',
648:'of the following constitutional or statutory provisions. the following constitutional or statutory provisions may also be used as safeguards to',
649:'augment those listed in paragraphs 3.53 and 3.54: a. protections that prevent the audited entity from abolishing the audit organization;',
650:'b. protections requiring that if the head of the audit organization is removed from office, the head of the agency',
651:'reports this fact and the reasons for the removal to the legislative body; c. protections that prevent the audited entity',
652:'from interfering with the initiation, scope, timing, and completion of any engagement; d. protections that prevent the audited entity from',
653:'interfering with audit reporting, including the findings and conclusions or the manner, means, or timing of the audit organization’s reports;',
654:'e. protections that require the audit organization to report to a legislative body or other independent governing body on a',
655:'recurring basis; f. protections that give the audit organization sole authority over the selection, retention, advancement, and dismissal of its',
656:'personnel; and g. access to records and documents related to the agency, program, or function being audited and access to',
657:'government officials or other individuals as needed to conduct the engagement. 3.56 government internal auditors who work under the direction',
658:'of the audited entity’s management are considered structurally independent for the purposes of reporting internally, if the head of the',
659:'audit organization meets all of the following criteria: a. is accountable to the head or deputy head of the government',
660:'entity or to those charged with governance; b. reports the engagement results both to the head or deputy head of',
661:'the government entity and to those charged with governance; c. is located organizationally outside the staff or line management function',
662:'of the unit under audit; d. has access to those charged with governance; and e. is sufficiently removed from pressures',
663:'to conduct engagements and report findings, opinions, and conclusions objectively without fear of reprisal. internal auditors 3.57 certain entities employ',
664:'auditors to work for entity management. these auditors may be subject to administrative direction from persons involved in the entity',
665:'management process. such audit organizations are internal audit functions and are encouraged to use the institute of internal auditors’ international',
666:'standards for the professional practice of internal auditing, in conjunction with gagas. 3.58 when an internal audit organization conducts engagements',
667:'pertaining to external parties, such as contractors or entities subject to other outside agreements, and no impairments to independence exist,',
668:'the audit organization can be considered independent as an external audit organization of those external parties. requirements: independence impairments 3.59',
669:'auditors should conclude that independence is impaired if no safeguards have been effectively applied to eliminate an unacceptable threat or',
670:'reduce it to an acceptable level. 3.60 when auditors conclude that independence of the engagement team or the audit organization',
671:'is impaired under paragraph 3.59, auditors should decline to accept an engagement or should terminate an engagement in progress except',
672:'in circumstances discussed in paragraphs 3.25 or 3.84. application guidance: independence impairments 3.61 whether independence is impaired depends on the',
673:'nature of the threat, whether the threat is of such significance that it would compromise an auditor’s professional judgment or',
674:'create the appearance that the auditor’s integrity, objectivity, or professional skepticism may be compromised, and the specific safeguards applied to',
675:'eliminate the threat or reduce it to an acceptable level. 3.62 if auditors conclude that an individual auditor’s independence is',
676:'impaired under paragraph 3.59, it may be necessary to terminate the engagement or it may be possible to take action',
677:'that satisfactorily addresses the effect of the individual auditor’s independence impairment. 3.63 factors that are relevant in evaluating whether the',
678:'independence of the engagement team or the audit organization is impaired by an individual auditor’s independence impairment include a. the',
679:'nature and duration of the individual auditor’s impairment; b. the number and nature of any previous impairments with respect to',
680:'the current engagement; c. whether a member of the engagement team had knowledge of the interest or relationship that caused',
681:'the individual auditor’s impairment; d. whether the individual auditor whose independence is impaired is 1 a member of the engagement',
682:'team or 2 another individual for whom there are independence requirements; e. the role of the individual auditor on the',
683:'engagement team whose independence is impaired; f. the effect of the service, if any, on the accounting records or audited',
684:'entity’s financial statements if the individual auditor’s impairment was caused by the provision of a nonaudit service; g. whether a',
685:'partner or director of the audit organization had knowledge of the individual auditor’s impairment and failed to ensure that the',
686:'individual auditor’s impairment was promptly communicated to an appropriate individual within the audit organization; and h. the extent of the',
687:'selfinterest, undue influence, or other threats created by the individual auditor’s impairment. provision of nonaudit services to audited entities requirement:',
688:'nonaudit services 3.64 before auditors agree to provide a nonaudit service to an audited entity, they should determine whether providing',
689:'such a service would create a threat to independence, either by itself or in aggregate with other nonaudit services provided,',
690:'with respect to any gagas engagement they conduct. application guidance: nonaudit services 3.65 auditors have traditionally provided a range of',
691:'nonaudit services that are consistent with their skills and expertise. providing nonaudit services to audited entities may create threats to',
692:'the independence of auditors or audit organizations. 3.66 for performance audits and agreedupon procedures engagements, nonaudit services that are otherwise',
693:'prohibited by gagas may be provided when such services do not relate to the specific subject matter of the engagement.',
694:'3.67 for financial audits, examination or review engagements, and reviews of financial statements, a nonaudit service otherwise prohibited by gagas',
695:'and provided during the period covered by the financial statements may not threaten independence with respect to those financial statements',
696:'provided that the following conditions exist: a. the nonaudit service was provided prior to the period of professional engagement; b.',
697:'the nonaudit service related only to periods prior to the period covered by the financial statements; and c. the financial',
698:'statements for the period to which the nonaudit service did relate were audited by other auditors or in the case',
699:'of an examination, review, or review of financial statements, examined, reviewed, or audited by other auditors as appropriate. 3.68 nonaudit',
700:'services that auditors provide can affect independence of mind and in appearance in periods after the nonaudit services were provided.',
701:'for example, if auditors have designed and implemented an accounting and financial reporting system that is expected to be in',
702:'place for many years, a threat to independence in appearance may exist in subsequent periods for future engagements that those',
703:'auditors conduct. for recurring engagements, having another independent audit organization conduct an engagement over the areas affected by the nonaudit',
704:'service may provide a safeguard that allows the audit organization that provided the nonaudit service to mitigate the threat to',
705:'its independence. 3.69 the following are examples of actions that in certain circumstances could be safeguards in addressing threats to',
706:'independence related to nonaudit services: a. not including individuals who provided the nonaudit service as engagement team members; b. having',
707:'another auditor, not associated with the engagement, review the engagement and nonaudit work as appropriate; c. engaging another audit organization',
708:'to evaluate the results of the nonaudit service; or d. having another audit organization reperform the nonaudit service to the',
709:'extent necessary to enable that other audit organization to take responsibility for the service. routine activities 3.70 routine activities that',
710:'auditors perform related directly to conducting an engagement, such as providing advice and responding to questions as part of an',
711:'engagement, are not considered nonaudit services under gagas. such routine activities generally involve providing advice or assistance to the audited',
712:'entity on an informal basis as part of an engagement. routine activities typically are insignificant in terms of time incurred',
713:'or resources expended and generally do not result in a specific project or engagement or in the auditors producing a',
714:'formal report or other formal work product. however, activities such as financial statement preparation, cashtoaccrual conversions, and reconciliations are considered',
715:'nonaudit services under gagas, not routine activities related to the performance of an engagement, and are evaluated using the conceptual',
716:'framework as discussed in paragraphs 3.87 through 3.95. 3.71 routine activities directly related to an engagement may include the following:',
717:'a. providing advice to the audited entity on an accounting matter as an ancillary part of the overall financial audit;',
718:'b. providing advice to the audited entity on routine business matters; c. educating the audited entity about matters within the',
719:'technical expertise of the auditors; and d. providing information to the audited entity that is readily available to the auditors,',
720:'such as best practices and benchmarking studies. other services provided by government audit organizations 3.72 audit organizations in government entities',
721:'frequently provide services that differ from the traditional professional services that an accounting or consulting firm provides to or for',
722:'an audited entity. these types of services are often provided in response to a statutory requirement, at the discretion of',
723:'the authority of the audit organization, or to an engaging party such as a legislative oversight body or an independent',
724:'external organization rather than a responsible party, and would generally not create a threat to independence. examples of these types',
725:'of services include the following: a. providing information or data to a requesting party without auditor evaluation or verification of',
726:'the information or data; b. developing standards, methodologies, audit guides, audit programs, or criteria for use throughout the government or',
727:'for use in certain specified situations; c. collaborating with other professional organizations to advance auditing of government entities and programs;',
728:'d. developing question and answer documents to promote understanding of technical issues or standards; e. providing assistance and technical expertise',
729:'to legislative bodies or independent external organizations; f. assisting legislative bodies by developing questions for use at hearings; g. providing',
730:'training, speeches, and technical presentations; h. providing assistance in reviewing budget submissions; i. contracting for audit services on behalf of',
731:'an audited entity and overseeing the audit contract, as long as the overarching principles are not violated and the auditor',
732:'under contract reports to the audit organization and not to management; and j. providing audit, investigative, and oversightrelated services that',
733:'do not involve a gagas engagement, such as 1 investigations of alleged fraud, violation of contract provisions or grant agreements,',
734:'or abuse; 2 periodic audit recommendation followup engagements and reports; and 3 identifying best practices or leading practices for use',
735:'in advancing the practices of government organizations. requirements: management responsibilities 3.73 before auditors agree to provide nonaudit services to an',
736:'audited entity that the audited entity’s management requested and that could create a threat to independence, either by themselves or',
737:'in aggregate with other nonaudit services provided, with respect to any gagas engagement they conduct, auditors should determine that the',
738:'audited entity has designated an individual who possesses suitable skill, knowledge, or experience and that the individual understands the services',
739:'to be provided sufficiently to oversee them. 3.74 auditors should document consideration of management’s ability to effectively oversee nonaudit services',
740:'to be provided. 3.75 in cases where the audited entity is unable or unwilling to assume these responsibilities for example,',
741:'the audited entity does not have an individual with suitable skill, knowledge, or experience to oversee the nonaudit services provided,',
742:'or is unwilling to perform such functions because of lack of time or desire, auditors should conclude that the provision',
743:'of these services is an impairment to independence. 3.76 auditors providing nonaudit services to audited entities should obtain agreement from',
744:'audited entity management that audited entity management performs the following functions in connection with the nonaudit services: a. assumes all',
745:'management responsibilities; b. oversees the services, by designating an individual, preferably within senior management, who possesses suitable skill, knowledge, or',
746:'experience; c. evaluates the adequacy and results of the services provided; and d. accepts responsibility for the results of the',
747:'services. 3.77 in connection with nonaudit services, auditors should establish and document their understanding with the audited entity’s management or',
748:'those charged with governance, as appropriate, regarding the following: a. objectives of the nonaudit service, b. services to be provided,',
749:'c. audited entity’s acceptance of its responsibilities as discussed in paragraph 3.76, d. the auditors’ responsibilities, and e. any limitations',
750:'on the provision of nonaudit services. 3.78 auditors should conclude that management responsibilities that the auditors perform for an audited',
751:'entity are impairments to independence. if the auditors were to assume management responsibilities for an audited entity, the management participation',
752:'threats created would be so significant that no safeguards could reduce them to an acceptable level. application guidance: management responsibilities',
753:'3.79 a critical component of determining whether a threat to independence exists is consideration of management’s ability to effectively oversee',
754:'the nonaudit service to be provided. although the responsible individual in management is required to have sufficient expertise to oversee',
755:'the nonaudit services, management is not required to possess the expertise to perform or reperform the services. however, indicators of',
756:'management’s ability to effectively oversee the nonaudit service include management’s ability to determine the reasonableness of the results of the',
757:'nonaudit services provided and to recognize a material error, omission, or misstatement in the results of the nonaudit services provided.',
758:'3.80 management responsibilities involve leading and directing an entity, including making decisions regarding the acquisition, deployment, and control of human,',
759:'financial, physical, and intangible resources. 3.81 the following are considered management responsibilities: a. setting policies and strategic direction for the',
760:'audited entity; b. directing and accepting responsibility for the actions of the audited entity’s employees in the performance of their',
761:'routine, recurring activities; c. having custody of an audited entity’s assets; d. reporting to those charged with governance on behalf',
762:'of management; e. deciding which of the audit organization’s or outside third party’s recommendations to implement; f. accepting responsibility for',
763:'the management of an audited entity’s project; g. accepting responsibility for designing, implementing, or maintaining internal control; h. providing services',
764:'that are intended to be used as management’s primary basis for making decisions that are significant to the subject matter',
765:'of the engagement; i. developing an audited entity’s performance measurement system when that system is material or significant to the',
766:'subject matter of the engagement; and j. serving as a voting member of an audited entity’s management committee or board',
767:'of directors. 3.82 whether a specific activity is a management responsibility as identified in paragraph 3.81 or otherwise depends on',
768:'the facts and circumstances. requirements: providing nonaudit services 3.83 auditors who previously provided nonaudit services for an entity that is',
769:'a prospective subject of an engagement should evaluate the effect of those nonaudit services on independence before agreeing to conduct',
770:'a gagas engagement. if auditors provided a nonaudit service in the period to be covered by the engagement, they should',
771:'1 determine if gagas expressly prohibits the nonaudit service; 2 if audited entity management requested the nonaudit service, determine whether',
772:'the skill, knowledge, or experience of the individual responsible for overseeing the nonaudit service was sufficient; and 3 determine whether',
773:'a threat to independence exists and address any threats noted in accordance with the conceptual framework. 3.84 auditors in a',
774:'government entity may be required to provide a nonaudit service that impairs the auditors’ independence with respect to a required',
775:'engagement. if, because of constitutional or statutory requirements over which they have no control, the auditors can neither implement safeguards',
776:'to reduce the resulting threat to an acceptable level nor decline to provide or terminate a nonaudit service that is',
777:'incompatible with engagement responsibilities, auditors should disclose the nature of the threat that could not be eliminated or reduced to',
778:'an acceptable level and modify the gagas compliance statement as discussed in paragraph 2.17b accordingly. determining how to modify the',
779:'gagas compliance statement in these circumstances is a matter of professional judgment. consideration of specific nonaudit services 3.85 by their',
780:'nature, certain nonaudit services directly support an entity’s operations and, if provided to an audited entity, create a threat to',
781:'the auditors’ ability to maintain independence in mind and appearance. some aspects of these services will impair auditors’ ability to',
782:'conduct gagas engagements for the entities to which the services are provided. 3.86 auditors may be able to provide nonaudit',
783:'services in the broad areas indicated in paragraphs 3.87 through 3.106 without impairing independence if 1 the nonaudit services are',
784:'not expressly prohibited by gagas requirements, 2 the auditors have determined that the requirements for providing nonaudit services in paragraphs',
785:'3.73 through 3.78 and paragraph 3.83 have been met, and 3 any significant threats to independence have been eliminated or',
786:'reduced to an acceptable level through the application of safeguards. the conceptual framework enables auditors to evaluate independence given the',
787:'facts and circumstances of individual services that are not specifically prohibited. requirements: preparing accounting records and financial statements 3.87 auditors',
788:'should conclude that the following services involving preparation of accounting records impair independence with respect to an audited entity: a.',
789:'determining or changing journal entries, account codes or classifications for transactions, or other accounting records for the entity without obtaining',
790:'management’s approval; b. authorizing or approving the entity’s transactions; and c. preparing or making changes to source documents without management',
791:'approval. 3.88 auditors should conclude that preparing financial statements in their entirety from a clientprovided trial balance or underlying accounting',
792:'records creates significant threats to auditors’ independence, and should document the threats and safeguards applied to eliminate and reduce threats',
793:'to an acceptable level in accordance with paragraph 3.33 or decline to provide the services.22 3.89 auditors should identify as',
794:'threats to independence any services related to preparing accounting records and financial statements, other than those defined as impairments to',
795:'independence in paragraph 3.87 and significant threats in paragraph 3.88. these services include a. recording transactions for which management has',
796:'determined or approved the appropriate account classification, or posting coded transactions to an audited entity’s general ledger; b. preparing certain',
797:'line items or sections of the financial statements based on information in the trial balance; c. posting entries that an',
798:'audited entity’s management has approved to the entity’s trial balance; and 22see fig. 2 at the end of ch. 3',
799:'for a flowchart on independence considerations for preparing accounting records and financial statements. d. preparing account reconciliations that identify reconciling',
800:'items for the audited entity management’s evaluation. 3.90 auditors should evaluate the significance of threats to independence created by providing',
801:'any services discussed in paragraph 3.89 and should document the evaluation of the significance of such threats.23 23see para. 3.33',
802:'for additional requirements related to documenting threats identified and safeguards applied to eliminate or reduce threats to an acceptable level.',
803:'application guidance: preparing accounting records and financial statements 3.91 management is responsible for the preparation and fair presentation of the',
804:'financial statements in accordance with the applicable financial reporting framework, even if the auditor assisted in drafting those financial statements.',
805:'consequently, an auditor accepting responsibility for the preparation and fair presentation of financial statements that the auditor will subsequently audit',
806:'or that will otherwise be the subject matter of an engagement would impair the auditor’s independence. 3.92 source documents include',
807:'those providing evidence that transactions have occurred for example, purchase orders, payroll time records, customer orders, and contracts. such records',
808:'also include an audited entity’s general ledger and subsidiary records or equivalent. 3.93 determining whether services, as discussed in paragraph',
809:'3.89, are significant threats and require safeguards is a matter of professional judgment. 3.94 factors that are relevant in evaluating',
810:'the significance of any threats created by providing services as discussed in paragraph 3.89 include a. the extent to which',
811:'the outcome of the service could have a material effect on the financial statements, b. the degree of subjectivity involved',
812:'in determining the appropriate amounts or treatment for those matters reflected in the financial statements, and c. the extent of',
813:'the audited entity’s involvement in determining significant matters of judgment. 3.95 providing clerical assistance, such as typing, formatting, printing, and',
814:'binding financial statements, is unlikely to be a significant threat. requirement: internal audit assistance services provided by external auditors 3.96',
815:'internal audit assistance services involve assisting an entity in performing its internal audit activities. auditors should conclude that the following',
816:'internal audit assistance activities impair an external auditor’s independence with respect to an audited entity: a. setting internal audit policies',
817:'or the strategic direction of internal audit activities; b. performing procedures that form part of the internal control, such as',
818:'reviewing and approving changes to employee data access privileges; and c. determining the scope of the internal audit function and',
819:'resulting work. requirements: internal control evaluation as a nonaudit service 3.97 auditors should conclude that providing or supervising ongoing monitoring',
820:'procedures over an entity’s system of internal control impairs independence because the management participation threat created is so significant that',
821:'no safeguards could reduce the threat to an acceptable level. 3.98 separate evaluations are sometimes provided as a nonaudit service.',
822:'when providing separate evaluations as nonaudit services, auditors should evaluate the significance of the threat created by performing separate evaluations',
823:'and apply safeguards when necessary to eliminate the threat or reduce it to an acceptable level. application guidance: internal control',
824:'evaluation as a nonaudit service 3.99 accepting responsibility for designing, implementing, or maintaining internal control includes accepting responsibility for designing,',
825:'implementing, or maintaining monitoring procedures. monitoring involves the use of either ongoing monitoring procedures or separate evaluations to gather and',
826:'analyze persuasive information supporting conclusions about the effectiveness of the internal control system. ongoing monitoring procedures performed on behalf of',
827:'management are built into the routine, recurring operating activities of an entity. 3.100 factors relevant to evaluating the significance of',
828:'any threats created by providing separate evaluations as a nonaudit service include a. the frequency of the separate evaluations and',
829:'b. the scope or extent of the controls in relation to the scope of the engagement conducted being evaluated. 3.101',
830:'a separate evaluation provided as a nonaudit service is not a substitute for engagement procedures in a gagas engagement. requirement:',
831:'information technology services 3.102 auditors should conclude that providing information technology it services to an audited entity that relate to',
832:'the period under audit impairs independence if those services include a. designing or developing an audited entity’s financial information system',
833:'or other it system that will play a significant role in the management of an area of operations that is',
834:'or will be the subject matter of an engagement; b. making other than insignificant modifications to source code underlying an',
835:'audited entity’s existing financial information system or other it system that will play a significant role in the management of',
836:'an area of operations that is or will be the subject matter of an engagement; c. supervising audited entity personnel',
837:'in the daily operation of an audited entity’s information system; or d. operating an audited entity’s network, financial information system,',
838:'or other it system that will play a significant role in the management of an area of operations that is',
839:'or will be the subject matter of an engagement. application guidance: information technology services 3.103 services related to it systems',
840:'include the design or implementation of hardware or software systems. the systems may aggregate source data, form part of the',
841:'internal control over the subject matter of the engagement, or generate information that affects the subject matter of the engagement.',
842:'requirement: appraisal, valuation, and actuarial services 3.104 auditors should conclude that independence is impaired if an audit organization provides appraisal,',
843:'valuation, or actuarial services to an audited entity when 1 the services involve a significant degree of subjectivity and 2',
844:'the results of the service, individually or when combined with other valuation, appraisal, or actuarial services, are material to the',
845:'audited entity’s financial statements or other information on which the audit organization is reporting. application guidance: appraisal, valuation, and actuarial',
846:'services 3.105 a valuation comprises the making of assumptions with regard to future developments; the application of appropriate methodologies and',
847:'techniques; and the combination of both to compute a certain value, or range of values, for an asset, a liability,',
848:'or an entity as a whole. requirement: other nonaudit services 3.106 auditors should conclude that providing certain other nonaudit services',
849:'impairs an external auditor’s independence with respect to an audited entity. these activities include the following: a. advisory service 1',
850:'assuming any management responsibilities b. benefit plan administration 1 making policy decisions on behalf of management 2 interpreting the provisions',
851:'in a plan document for a plan participant on behalf of management without first obtaining management’s concurrence 3 making disbursements',
852:'on behalf of the plan 4 having custody of the plan’s assets 5 serving in a fiduciary capacity, as defined',
853:'under the employee retirement income security act of 197424 c. business risk consulting 1 making or approving business risk decisions',
854:'2 presenting business risk considerations to those charged with governance on behalf of management d. executive or employee recruiting 1',
855:'committing the audited entity to employee compensation or benefit arrangements 2 hiring or terminating the audited entity’s employees 24see section',
856:'2510.321 of title 29, code of federal regulations. e. investment advisory or management 1 making investment decisions on behalf of',
857:'management or otherwise having discretionary authority over an audited entity’s investments 2 executing a transaction to buy or sell an',
858:'audited entity’s investments 3 having custody of an audited entity’s assets, such as taking temporary possession of securities documentation requirement:',
859:'documentation 3.107 while insufficient documentation of an auditor’s compliance with the independence standard does not impair independence, auditors should prepare',
860:'appropriate documentation under the gagas quality control and assurance requirements.25 the independence standard includes the following documentation requirements, where applicable:',
861:'a. document threats to independence that require the application of safeguards, along with safeguards applied, in accordance with the conceptual',
862:'framework for independence as required by paragraph 3.33; b. document the safeguards in paragraphs 3.52 through 3.56 if an audit',
863:'organization is structurally located within a government entity and is considered structurally independent based on those safeguards; c. document consideration',
864:'of audited entity management’s ability to effectively oversee a nonaudit service to be provided by the auditor as indicated in',
865:'paragraph 3.74; 25see para. 5.04 for additional discussion of documenting compliance with quality control policies and procedures and paras. 5.08',
866:'through 5.11 for additional discussion of policies and procedures on independence, legal, and ethical requirements. d. document the auditor’s understanding',
867:'with an audited entity for which the auditor will provide a nonaudit service as indicated in paragraph 3.77; and e.',
868:'document the evaluation of the significance of the threats created by providing any of the services discussed in paragraph 3.89.',
869:'application guidance: documentation 3.108 documentation of independence considerations provides evidence of the auditor’s judgments in forming conclusions regarding compliance with',
870:'independence requirements. professional judgment requirement: professional judgment 3.109 auditors must use professional judgment in planning and conducting the engagement and',
871:'in reporting the results. application guidance: professional judgment 3.110 professional judgment includes exercising reasonable care and professional skepticism. reasonable care',
872:'includes acting diligently in accordance with applicable professional standards and ethical principles. attributes of professional skepticism include a questioning mind,',
873:'awareness of conditions that may indicate possible misstatement owing to error or fraud, and a critical assessment of evidence. professional',
874:'skepticism includes being alert to, for example, evidence that contradicts other evidence obtained or information that brings into question the',
875:'reliability of documents or responses to inquiries to be used as evidence. further, it includes a mindset in which auditors',
876:'assume that management is neither dishonest nor of unquestioned honesty. auditors may accept records and documents as genuine unless they',
877:'have reason to believe the contrary. auditors may consider documenting procedures undertaken to support their application of professional skepticism in',
878:'highly judgmental or subjective areas under audit. 3.111 using the auditor’s professional knowledge, skills, and abilities, in good faith and',
879:'with integrity, to diligently gather information and objectively evaluate the sufficiency and appropriateness of evidence is a critical component of',
880:'gagas engagements. professional judgment and competence are interrelated because judgments made depend upon the auditor’s competence, as discussed in chapter',
881:'4. 3.112 professional judgment represents the application of the collective knowledge, skills, and abilities of all the personnel involved with',
882:'an engagement, as well as the professional judgment of individual auditors. in addition, professional judgment may involve consultation with other',
883:'stakeholders, specialists, and management in the audit organization. 3.113 using professional judgment is important to auditors in carrying out all',
884:'aspects of their professional responsibilities, including following the independence standards and related conceptual framework; maintaining objectivity and credibility; assigning competent',
885:'personnel to the engagement; defining the scope of work; evaluating, documenting, and reporting the results of the work; and maintaining',
886:'appropriate quality control over the engagement process. 3.114 using professional judgment is important to auditors in applying the conceptual framework',
887:'to determine independence in a given situation. this includes identifying and evaluating any threats to independence, including threats to the',
888:'appearance of independence, and related safeguards that may mitigate the identified threats.26 26see para. 3.21b for a description of independence',
889:'in appearance. 27see paras. 4.02 through 4.15 for a discussion of competence. 3.115 using professional judgment is important to auditors',
890:'in determining the necessary level of understanding of the engagement subject matter and related circumstances. this includes considering whether the',
891:'audit team’s collective experience, training, knowledge, skills, abilities, and overall understanding are sufficient to assess the risks that the subject',
892:'matter of the engagement may contain a significant inaccuracy or could be misinterpreted.27 3.116 an auditor’s consideration of the risk',
893:'level of each engagement, including the risk of arriving at improper conclusions, is also important. within the context of audit',
894:'risk, exercising professional judgment in determining the sufficiency and appropriateness of evidence to be used to support the findings and',
895:'conclusions based on the engagement objectives and any recommendations reported is integral to the engagement process. 3.117 while this requirement',
896:'places responsibility on each auditor and audit organization to exercise professional judgment in planning and conducting an engagement, it does',
897:'not imply unlimited responsibility nor does it imply infallibility on the part of either the individual auditor or the audit',
898:'organization. absolute assurance is not attainable because of factors such as the nature of evidence and characteristics of fraud. professional',
899:'judgment does not mean eliminating all possible limitations or weaknesses associated with a specific engagement, but rather identifying, assessing, mitigating,',
900:'and concluding on them. figure 1: generally accepted government auditing standards conceptual framework for independence figure 2: independence considerations for',
901:'preparing accounting records and financial statements chapter 4: competence and continuing professional education 4.01 this chapter establishes the generally accepted',
902:'government auditing standards gagas requirements for competence and continuing professional education cpe. competence includes being knowledgeable about the specific gagas',
903:'requirements and having the skills and abilities to proficiently apply that knowledge on gagas engagements. cpe contributes to auditors’ competence.',
904:'the requirements of this chapter are intended to be followed in conjunction with all other applicable gagas requirements. competence requirements:',
905:'general 4.02 the audit organization’s management must assign auditors to conduct the engagement who before beginning work on the engagement',
906:'collectively possess the competence needed to address the engagement objectives and perform their work in accordance with gagas. 4.03 the',
907:'audit organization’s management must assign auditors who before beginning work on the engagement possess the competence needed for their assigned',
908:'roles. 4.04 the audit organization should have a process for recruitment, hiring, continuous development, assignment, and evaluation of personnel so',
909:'that the workforce has the essential knowledge, skills, and abilities necessary to conduct the engagement. the nature, extent, and formality',
910:'of the process will depend on various factors, such as the size of the audit organization, its structure, and its',
911:'work. application guidance: general 4.05 competence is the knowledge, skills, and abilities, obtained from education and experience, necessary to conduct',
912:'the gagas engagement. competence enables auditors to make sound professional judgments. competence includes possessing the technical knowledge and skills necessary',
913:'for the assigned role and the type of work being done. this includes possessing specific knowledge about gagas. 4.06 competence',
914:'is derived from a combination of education and experience. education is a structured and systematic process aimed at developing knowledge,',
915:'skills, and other abilities; it is a process that is typically but not exclusively conducted in academic or learning environments.',
916:'experience refers to workplace activities that are relevant to developing professional proficiency. competence is not necessarily measured by years of',
917:'auditing experience because such a quantitative measurement may not accurately reflect the kinds of experiences gained by auditors in any',
918:'given time period. maintaining competence through a commitment to learning and development throughout auditors’ professional lives is an important element',
919:'for auditors. application guidance: indicators of competence technical knowledge and skills 4.07 the knowledge, skills, and abilities needed when conducting',
920:'an engagement in accordance with gagas include the understanding necessary to proficiently apply a. gagas; b. standards, statutory requirements, regulations,',
921:'criteria, and guidance applicable to auditing or the objectives for the engagements being conducted; and c. techniques, tools, and guidance',
922:'related to professional expertise applicable to the work being performed. auditor proficiency in these areas helps ensure that engagements are',
923:'conducted in accordance with gagas. 4.08 achieving the knowledge, skills, and abilities needed to conduct a gagas engagement may include',
924:'a. having prior experience in the subject matter or type of engagement; b. completing cpe related to the subject matter',
925:'or type of engagement; and c. obtaining degrees or certifications relevant to the subject matter or type of engagement. competence',
926:'for assigned roles 4.09 the audit organization and engagement teams may consider the levels of proficiency needed for each role',
927:'on the engagement when assigning auditors to the engagement. 4.10 roles on the engagement generally include the following: a. nonsupervisory',
928:'auditors: auditors in these roles plan or perform engagement procedures. work situations for these auditors are characterized by low levels',
929:'of ambiguity, complexity, and uncertainty. the nonsupervisory auditor role necessitates at least a basic level of proficiency. b. supervisory auditors:',
930:'auditors in these roles plan engagements, perform engagement procedures, or direct engagements. work situations for these auditors are characterized by',
931:'moderate levels of ambiguity, complexity, and uncertainty. the supervisory auditor role necessitates at least an intermediate level of proficiency. c.',
932:'partners and directors: auditors in these roles plan engagements, perform engagement procedures, or direct or report on engagements. partners and',
933:'directors may also be responsible for reviewing engagement quality prior to issuing the report, for signing the report, or both.',
934:'work situations for these auditors are characterized by high levels of ambiguity, complexity, and uncertainty. the partner and director role',
935:'necessitates an advanced level of proficiency. 4.11 definitions of key terms follow: a. planning: determining engagement objectives, scope, and methodology;',
936:'establishing criteria to evaluate matters subject to audit; or coordinating the work of the other audit organizations. this definition excludes',
937:'auditors whose role is limited to gathering information used in planning the engagement. b. directing: supervising the efforts of others',
938:'who are involved in accomplishing the objectives of the engagement or reviewing engagement work to determine whether those objectives have',
939:'been accomplished. c. performing engagement procedures: performing tests and procedures necessary to accomplish the engagement objectives in accordance with gagas.',
940:'d. reporting: determining the report content and substance or reviewing reports to determine whether the engagement objectives have been accomplished',
941:'and the evidence supports the report’s technical content and substance prior to issuance. this includes signing the report. requirement: specialists',
942:'4.12 the engagement team should determine that specialists assisting the engagement team on a gagas engagement are qualified and competent',
943:'in their areas of specialization. application guidance: specialists 4.13 some engagements may necessitate the use of specialized techniques or methods',
944:'that call for the skills of specialists. specialists do not include individuals with special skill or knowledge related to specialized',
945:'areas within the field of accounting or auditing, such as income taxation and information technology. such individuals are considered auditors.',
946:'4.14 the competence and qualifications of specialists significantly affect whether their work will be adequate for the engagement team’s purposes',
947:'and will meet gagas requirements. competence of specialists relates to the nature and level of expertise. qualifications of specialists relate',
948:'to their professional certifications, reputations, and previous work in the subject matter. other relevant factors include the ability of specialists',
949:'to exercise competence in the circumstances of the engagement and the effects that bias, conflict of interest, or the influence',
950:'of others may have on the specialists’ professional judgment. 4.15 sources that may inform the auditors’ assessment of the competence',
951:'and professional qualifications of a specialist include the following: a. the professional certification, license, or other recognition of the competence',
952:'of the specialist in his or her field, as appropriate; b. the reputation and standing of the specialist in the',
953:'views of peers and others familiar with the specialist’s capability or performance; c. the specialist’s experience and previous work in',
954:'the subject matter; d. the auditors’ assessment of the specialist’s knowledge and qualification based on prior experience in using the',
955:'specialist’s work; e. the specialist’s knowledge of any technical performance standards or other professional or industry requirements in the specialist’s',
956:'field for example, ethical standards and other membership requirements of a professional body or industry association, accreditation standards of a',
957:'licensing body, or requirements imposed by law or regulation; f. the knowledge of the specialist with respect to relevant auditing',
958:'standards; and g. the assessment of unexpected events, changes in conditions, or the evidence obtained from the results of engagement',
959:'procedures that indicate it may be necessary to reconsider the initial evaluation of the competence and qualifications of a specialist',
960:'as the engagement progresses. continuing professional education requirements: general 4.16 auditors who plan, direct, perform engagement procedures for, or report',
961:'on an engagement conducted in accordance with gagas should develop and maintain their professional competence by completing at least 80',
962:'hours of cpe in every 2year period as follows. cpe hours subject matter categories of cpe 24 hours subject matter',
963:'directly related to the government environment, government auditing, or the specific or unique environment in which the audited entity operates',
964:'56 hours subject matter that directly enhance auditors’ professional expertise to conduct engagements 4.17 auditors should complete at least 20',
965:'hours of cpe in each year of the 2year periods. 4.18 the audit organization should maintain documentation of each auditor’s',
966:'cpe.28 28see paras. 4.51 and 5.16 for a discussion of cpe documentation. application guidance: general 4.19 the continuing competence of',
967:'the audit organization’s personnel depends, in part, on an appropriate level of cpe so that auditors maintain the knowledge, skills,',
968:'and abilities necessary to conduct the gagas engagement. obtaining cpe specifically on gagas, particularly during years in which there are',
969:'revisions to the standards, may assist auditors in maintaining the competence necessary to conduct gagas engagements. 4.20 cpe used to',
970:'fulfill the 24hour requirement may be taken at any time during the 2year measurement period. application guidance: subject matter categories',
971:'of cpe 4.21 determining what subjects are appropriate for individual auditors to satisfy the cpe requirements is a matter of',
972:'professional judgment to be exercised by auditors in consultation with appropriate officials in their audit organization. when determining what specific',
973:'subjects qualify for the cpe requirement, the auditors may consider the types of knowledge, skills, and abilities, and the level',
974:'of proficiency necessary, in order to be competent for their assigned roles. auditors may consider probable future engagements to which',
975:'they may be assigned when selecting specific cpe subjects to satisfy the 24hour and the 56hour cpe requirements. the audit',
976:'organization is ultimately responsible for determining whether a subject or topic qualifies as acceptable for its auditors. 4.22 the subject',
977:'matter categories for the 24hour requirement may be used to satisfy the 56hour cpe requirement. if cpe in any of',
978:'the subject matter and topics that would satisfy the 56hour requirement, as discussed in paragraph 4.24, is tailored specifically to',
979:'the government environment, such cpe may qualify toward satisfying the 24hour requirement. examples of cpe subjects that may qualify for',
980:'each of the categories are listed below. subject matter directly related to the government environment, government auditing, or the specific',
981:'or unique environment in which the audited entity operates 24hour requirement 4.23 subject matter directly related to the government environment,',
982:'government auditing, or the specific or unique environment in which the audited entity operates may include, but is not limited',
983:'to, the following: a. generally accepted government auditing standards gagas and related topics, such as internal control as addressed in',
984:'gagas; b. the applicable american institute of certified public accountants’ aicpa statements on auditing standards;29 c. the applicable aicpa statements',
985:'on standards for attestation engagements and statements on standards for accounting and review services;30 d. the applicable auditing standards issued',
986:'by the institute of internal auditors, the public company accounting and oversight board, the international auditing and assurance standards board,',
987:'or other auditing standardsetting body; e. u.s. generally accepted accounting principles, or the applicable financial reporting framework being used, such',
988:'as those issued by the federal accounting standards advisory board, the governmental accounting standards board, or the financial accounting standards',
989:'board; f. standards for internal control in the federal government;31 29see para. 6.01 for a discussion of the aicpa standards',
990:'incorporated into gagas for financial audits. 30see para. 7.01 for a discussion of the aicpa standards incorporated into gagas for',
991:'attestation engagements and reviews of financial statements. 31gao, standards for internal control in the federal government, gao14704g washington, d.c.: september',
992:'2014. g. internal control—integrated framework,32 as applicable; h. requirements for recipients of federal contracts or grants, such as single audits',
993:'under the uniform administrative requirements, cost principles, and audit requirements for federal awards;33 i. requirements for federal, state, or local',
994:'program audits; j. relevant or applicable audit standards or guides, including those for information technology auditing and forensic auditing; k.',
995:'information technology auditing topics applicable to the government environment; l. fraud topics applicable to a government environment; m. statutory requirements,',
996:'regulations, criteria, guidance, trends, risks, or topics relevant to the specific and unique environment in which the audited entity operates;',
997:'n. statutory requirements, regulations, criteria, guidance, trends, risks, or topics relevant to the subject matter of the engagement, such as',
998:'scientific, medical, environmental, educational, or any other specialized subject matter; o. topics directly related to the government environment, such as',
999:'the nature of government structures, financing, and operations, economic or other conditions and pressures facing governments, common government financial management',
1000:'issues, appropriations, measurement or evaluation of government financial or program performance, and application of general audit methodologies or techniques to',
1001:'a government environment or program; 32committee of sponsoring organizations of the treadway commission, internal control—integrated framework new york: american institute',
1002:'of certified public accountants, 2013. 33see part 200, subpart f, of title 2, code of federal regulations. p. specialized audit',
1003:'methodologies or analytical techniques, such as the use of complex survey instruments, actuarial estimates, statistical analysis tests, or statistical or',
1004:'nonstatistical sampling; q. performance auditing topics, such as obtaining evidence, professional skepticism, and other applicable audit skills;34 r. government ethics',
1005:'and independence; s. partnerships between governments, businesses, and citizens; t. legislative policies and procedures; u. topics related to fraud, waste,',
1006:'abuse, or improper payments affecting government entities; and v. compliance with laws and regulations. 34see chs. 8 and 9 for',
1007:'performance audit topics that may be included. subject matter that directly enhances auditors’ professional expertise to conduct engagements 56hour requirement',
1008:'4.24 subject matter that directly enhances auditors’ professional expertise to conduct engagements may include, but is not limited to, the',
1009:'following: a. subject matter categories for the 24hour requirement listed in paragraph 4.23; b. general ethics and independence; c. topics',
1010:'related to accounting, acquisitions management, asset management, budgeting, cash management, contracting, data analysis, program performance, or procurement; d. communicating clearly',
1011:'and effectively, both orally and in writing; e. managing time and resources; f. leadership; g. software applications used in conducting',
1012:'engagements; h. information technology; and i. economics, human capital management, social and political sciences, and other academic disciplines that may',
1013:'be applied in engagements, as applicable. application guidance: exemptions and exceptions 4.25 auditors may be exempted from the 56hour cpe',
1014:'requirement by the audit organization, but not the 24hour requirement, if they a. charge less than 20 percent of their',
1015:'time annually to engagements conducted in accordance with gagas and b. are only involved in performing engagement procedures, but not',
1016:'involved in planning, directing, or reporting on the engagement. the 20 percent may be based on historical or estimated charges',
1017:'in a year, provided that the audit organization has a basis for this determination and monitors actual time. for auditors',
1018:'who change status such that they are charging more than 20 percent of their time annually to engagements under gagas,',
1019:'the audit organization may prorate the required cpe hours similar to when auditors are assigned to gagas engagements after the',
1020:'beginning of a 2year cpe measurement period, as discussed in paragraph 4.42. 4.26 nonsupervisory auditors who charge less than 40',
1021:'hours of their time annually to engagements conducted in accordance with gagas may be exempted by the organization from all',
1022:'cpe requirements in paragraph 4.16. 4.27 the audit organization may exempt from the cpe requirements college and university students employed',
1023:'on a temporary basis for a limited period of time for example, an internship of limited duration or enrolled in',
1024:'a formal program sponsored by the college or university for a specific period of employment, such as a term or',
1025:'semester. 4.28 employees or contract employees performing support services within the audit organization, such as individuals who are assigned to',
1026:'positions in budgeting, human resources, training, and administrative functions, and who do not conduct engagement activities are not auditors subject',
1027:'to the gagas cpe requirements. employees or contract employees who assist in the engagement by performing support services, such as',
1028:'performing background research, data entry, writing and editing assistance, proofreading, or report production and distribution are not auditors subject to',
1029:'the gagas cpe requirements. 4.29 the audit organization, at its discretion, may grant exemptions from a portion of the cpe',
1030:'requirement in the event of extended absences or other extenuating circumstances if situations such as the following prevent auditors from',
1031:'fulfilling those requirements and conducting engagements: a. ill health, b. maternity or paternity leave, c. extended family leave, d. sabbaticals,',
1032:'e. leave without pay absences, f. foreign residency, g. military service, and h. disasters. the audit organization may not grant',
1033:'exceptions for reasons such as workload, budget, or travel constraints. application guidance: specialists 4.30 external specialists are not auditors subject',
1034:'to the gagas cpe requirements. also, internal specialists assisting on a gagas engagement who are not involved in planning, directing,',
1035:'performing engagement procedures, or reporting on a gagas engagement are not auditors subject to the gagas cpe requirements. 4.31 internal',
1036:'specialists who are performing work in accordance with gagas as part of the engagement team—including planning, directing, performing engagement procedures,',
1037:'or reporting on a gagas engagement—are considered auditors and are subject to the gagas cpe requirements. the gagas cpe requirements',
1038:'become effective for internal specialists when an audit organization first assigns an internal specialist to an engagement. because internal specialists',
1039:'apply specialized knowledge in government engagements, cpe in their areas of specialization qualifies under the requirement for 24 hours of',
1040:'cpe that directly relates to government auditing, the government environment, or the specific or unique environment in which the audited',
1041:'entity operates. application guidance: programs and activities that qualify for cpe 4.32 cpe programs are structured educational activities or programs',
1042:'with learning objectives designed to maintain or enhance the auditors’ competence to address engagement objectives and perform work in accordance',
1043:'with gagas. 4.33 the following are examples of structured educational programs and activities: a. internal training programs e.g., courses, seminars,',
1044:'and workshops; b. education and development programs presented at conferences, conventions, meetings, and seminars and meetings or workshops of professional',
1045:'organizations; c. training programs presented by other audit organizations, educational organizations, foundations, and associations; d. webbased seminars and individualstudy or',
1046:'elearning programs; e. audio conferences; f. accredited university and college courses credit and noncredit; g. standardsetting organization, professional organization, or',
1047:'audit organization staff meetings when a structured educational program with learning objectives is presented e.g., the portion of the meeting',
1048:'that is a structured educational program with learning objectives designed to maintain or enhance auditors’ competence; h. correspondence courses, individualstudy',
1049:'guides, and workbooks; i. serving as a speaker, panelist, instructor, or discussion leader at programs that qualify for cpe hours;',
1050:'j. developing or technical review of courses or the course materials for programs that qualify for cpe hours; and k.',
1051:'publishing articles and books that contribute directly to the author’s professional proficiency to conduct engagements. 4.34 individual auditors who are',
1052:'members of professional organizations or who are licensed professionals, such as certified public accountants, are cautioned that the gagas cpe',
1053:'requirements, while similar in many respects to those of professional organizations and of licensing bodies, may not be identical. some',
1054:'subjects and topics may be acceptable to state licensing bodies or professional organizations, but may not qualify as cpe under',
1055:'gagas. conversely, some cpe that qualifies for gagas may not qualify for state licensing bodies or professional organizations. careful consideration',
1056:'of auditors’ relevant professional organizations or licensing body requirements is encouraged to meet other relevant cpe requirements. 4.35 examples of',
1057:'training topics that may qualify as cpe for state licensing bodies or professional organizations but would not generally qualify as',
1058:'cpe for purposes of satisfying requirements under gagas include certain training in taxation, personal financial planning and investment, taxation strategies,',
1059:'estate planning, retirement planning, and practice management, unless such training directly enhances the auditors’ professional proficiency to perform engagements or',
1060:'relate to the subject matter of an engagement. however, if certain taxation or other topics relate to an objective or',
1061:'the subject matter of an engagement, training in those related topics could qualify as cpe under gagas. 4.36 examples of',
1062:'programs and activities that do not qualify for cpe hours under gagas include, but are not limited to, the following:',
1063:'a. onthejob training; b. basic or elementary courses in subjects or topics in which auditors already have the knowledge and',
1064:'skills being taught; c. programs that are designed for general personal development, such as résumé writing, improving parentchild relations, personal',
1065:'investments and money management, and retirement planning; d. programs that demonstrate office equipment or software that is not used in',
1066:'conducting engagements; e. programs that provide training on the audit organization’s administrative operations; f. business sessions at professional organization conferences,',
1067:'conventions, and meetings that do not have a structured educational program with learning objectives; g. conducting external quality control reviews;',
1068:'and h. sitting for professional certification examinations. basic or elementary courses would be acceptable in cases where they are deemed',
1069:'necessary as “refresher” courses to enhance the auditors’ proficiency to conduct audits and attestation engagements. application guidance: measurement of cpe',
1070:'4.37 a cpe hour may be granted for each 50 minutes of participation in programs and activities that qualify. 4.38',
1071:'for university or college credit courses, each unit of college credit under a semester system equals 15 cpe hours, and',
1072:'each unit of college credit under a quarter system equals 10 cpe hours. for university or college noncredit courses, cpe',
1073:'hours may be granted only for the actual classroom time. 4.39 for individualstudy programs where successful completion is measured by',
1074:'a summary examination, cpe credit may be granted if auditors complete the examination with a passing grade. auditors in other',
1075:'individualstudy programs may earn cpe hours when they satisfactorily complete the requirements of the selfstudy program. the number of hours',
1076:'granted may be based on the cpe provider’s recommended number of cpe hours for the program. 4.40 speakers, instructors, and',
1077:'discussion leaders at programs that qualify for cpe and auditors who develop or write the course materials may receive cpe',
1078:'hours for preparation and presentation time to the extent the subject matter contributes to auditors’ competence. one cpe hour may',
1079:'be granted for each 50 minutes of presentation time. up to 2 cpe hours may be granted for developing, writing,',
1080:'or advance preparation for each 50 minutes of the presentation. auditors may not receive cpe hours for either preparation or',
1081:'presentation time for repeated presentations that they make within the 2year period, unless the subject matter involved was changed significantly',
1082:'for each presentation. the maximum number of cpe hours that may be granted to an auditor as a speaker, instructor,',
1083:'discussion leader, or preparer of course materials may not exceed 40 hours for any 2year period. 4.41 articles, books, or',
1084:'materials written by auditors and published on subjects and topics that contribute directly to professional proficiency to conduct engagements qualify',
1085:'for cpe hours in the year they are published. one cpe hour may be granted for each hour devoted to',
1086:'writing articles, books, or materials that are published. however, cpe hours for published writings may not exceed 20 hours for',
1087:'any 2year period. 4.42 auditors hired or assigned to a gagas engagement after the beginning of an audit organization’s 2year',
1088:'cpe period may complete a prorated number of cpe hours. an audit organization may define a prorated number of hours',
1089:'based on the number of full 6month intervals remaining in the cpe period. for example, an audit organization has a',
1090:'2 year cpe period running from january 1, 2020, through december 31, 2021. the audit organization assigns a new auditor',
1091:'to a gagas engagement in may 2020. the audit organization may calculate the prorated cpe requirement for the auditor as',
1092:'follows: a. number of full 6month intervals remaining in the cpe period: 3 b. number of 6month intervals in the',
1093:'full 2year period: 4 c. newly assigned auditor’s cpe requirement: 3/4 x 80 hours = 60 hours when auditors are',
1094:'newly hired or newly assigned to gagas engagements and have had some previous cpe, the audit organization has flexibility and',
1095:'may choose between using a pro rata approach or evaluating whether and to what extent any cpe already taken in',
1096:'that period would satisfy gagas cpe requirements. 4.43 for newly assigned auditors who are subject to the 24hour requirement, the',
1097:'number of prorated hours may be calculated in a similar manner: 3/4 x 24 hours = 18 hours, in this',
1098:'example. the prorated amount of hours would be the total requirement over the partial period. the 20 hour minimum for',
1099:'each cpe year would not apply when the prorated number of hours is being used to cover a partial 2year',
1100:'cpe period. 4.44 at their discretion, audit organizations may give auditors who have not completed the 80hour cpe requirement for',
1101:'any 2year period up to 2 months immediately following the 2year period to make up the deficiency. audit organizations may',
1102:'also give auditors who have not completed the 20 hours of cpe in a 1year period up to 2 months',
1103:'immediately following the 1year period to make up the deficiency. any cpe hours completed toward a deficiency in one period',
1104:'may be documented in the cpe records and may not be counted toward the requirements for the next period. audit',
1105:'organizations that grant the 2 month grace period may not allow auditors who have not satisfied the cpe requirements after',
1106:'the grace period to participate in gagas engagements until those requirements are satisfied. 4.45 auditors may not carry over cpe',
1107:'hours earned in excess of the 80 hour and 24hour requirements from one 2year cpe measurement period to the next.',
1108:'4.46 if an audit organization discontinues conducting gagas engagements or reassigns auditors to nongagas assignments before auditors complete the cpe',
1109:'requirements, the auditors are not required to complete the number of hours to satisfy the cpe requirements. however, the audit',
1110:'organization may wish to have its auditors complete those requirements if it is foreseeable that the auditors will conduct gagas',
1111:'engagements in the future. 4.47 auditors who complete a professional certification review course may receive cpe hours only for those',
1112:'segments of the review course that are relevant to the standards, statutory requirements, regulations, criteria, and guidance applicable to auditing',
1113:'or to the engagement objectives being performed, or for subject matter that directly enhances auditors’ professional expertise to conduct engagements.',
1114:'4.48 to simplify administration of the cpe requirements, an audit organization may establish a standard 2year period for all of',
1115:'its auditors, which can be on either a fixedyear or rollingyear basis. a fixedyear measurement period, for example, would be',
1116:'the 2year periods 2019 through 2020, 2021 through 2022, and so forth, while a rollingyear measurement period would be 2019',
1117:'through 2020, 2020 through 2021, 2021 through 2022, and so forth. 4.49 an audit organization may use a measurement date',
1118:'other than the date it started its first gagas engagement, or the audit organization may choose to change its measurement',
1119:'date to coincide with a fiscal year or another reporting requirement, such as one established by a state licensing body',
1120:'or professional organization. for example, if an audit organization changes the end date of the measurement period from december 31',
1121:'to june 30, during the audit organization’s transition period january 1 to june 30, its auditors may complete at least',
1122:'a prorated number of cpe hours for the 6month transition period. the number of prorated hours required may be calculated',
1123:'using the method illustrated in paragraphs 4.42 and 4.43. application guidance: monitoring cpe 4.50 the audit organization’s policies and procedures',
1124:'for cpe may address the following: a. identifying all auditors required to meet the cpe requirements; b. providing auditors with',
1125:'the opportunity to attend internal cpe programs, external cpe programs, or both; c. assisting auditors in determining which programs, activities,',
1126:'and subjects qualify for cpe; d. documenting the number of cpe hours completed by each auditor; and e. monitoring auditor',
1127:'compliance with the cpe requirements to ensure that auditors complete sufficient cpe in qualifying programs and subjects. 4.51 policies and',
1128:'procedures for documentation may address maintaining documentation of the cpe hours completed by each auditor subject to the cpe requirements',
1129:'for an appropriate period of time to satisfy any legal and administrative requirements, including peer review. the audit organization may',
1130:'maintain documentation of cpe or may delegate the responsibility to the auditor and put in place adequate procedures to ensure',
1131:'that its records of cpe hours earned by auditors are supported by the documentation maintained by auditors. documentation may include',
1132:'the following information: a. the name of the organization providing the cpe; b. the title of the training program, including',
1133:'the subject matter or field of study; c. the dates attended for group programs or dates completed for individual study',
1134:'programs; d. the number of cpe hours earned toward the 56hour and 24hour requirements; e. any reasons for specific exceptions',
1135:'granted to the cpe requirement; and f. evidence of completion of cpe, such as a certificate or other evidence of',
1136:'completion from the cpe provider for group and individualstudy programs, if provided; documentation of cpe courses presented or copies of',
1137:'course materials developed by or for speakers, instructors, or discussion leaders, along with a written statement supporting the number of',
1138:'cpe hours claimed; or a copy of the published book, article, or other material that name the writer as author',
1139:'or contributor, or a written statement from the writer supporting the number of cpe hours claimed. 4.52 the audit organization',
1140:'may monitor cpe compliance through its internal inspections or other quality assurance monitoring activities. 4.53 the audit organization is not',
1141:'required to prepare reports on cpe. however, the audit organization may consider preparing a periodic cpe report for distribution to',
1142:'the auditors or maintaining or accessing training data online to monitor its auditors’ progress toward meeting the cpe requirements. chapter',
1143:'5: quality control and peer review 5.01 this chapter establishes the generally accepted government auditing standards gagas requirements and guidance',
1144:'for quality control and assurance, and for administering, planning, performing, and reporting on peer reviews of audit organizations that conduct',
1145:'engagements in accordance with gagas. the requirements of this chapter are intended to be followed in conjunction with those of',
1146:'all other applicable gagas requirements. quality control and assurance requirement: quality control and assurance 5.02 an audit organization conducting engagements',
1147:'in accordance with gagas must establish and maintain a system of quality control that is designed to provide the audit',
1148:'organization with reasonable assurance that the organization and its personnel comply with professional standards and applicable legal and regulatory requirements.',
1149:'application guidance: quality control and assurance 5.03 an audit organization’s system of quality control encompasses the organization’s leadership, emphasis on',
1150:'performing highquality work, and policies and procedures designed to provide reasonable assurance of complying with professional standards and applicable legal',
1151:'and regulatory requirements. the nature, extent, and formality of an audit organization’s quality control system will vary based on the',
1152:'audit organization’s circumstances, such as size, number of offices and geographic dispersion, knowledge and experience of its personnel, nature and',
1153:'complexity of its engagement work, and costbenefit considerations. system of quality control requirement: system of quality control 5.04 an audit',
1154:'organization should document its quality control policies and procedures and communicate those policies and procedures to its personnel. the audit',
1155:'organization should document compliance with its quality control policies and procedures and maintain such documentation for a period of time',
1156:'sufficient to enable those performing monitoring procedures and peer reviews to evaluate the extent to which the audit organization complies',
1157:'with its quality control policies and procedures. leadership responsibilities for quality within the audit organization requirements: leadership responsibilities for quality',
1158:'within the audit organization 5.05 the audit organization should establish policies and procedures on leadership responsibilities for quality within the',
1159:'audit organization that include designating responsibility for quality of engagements conducted in accordance with gagas and communicating policies and procedures',
1160:'relating to quality. 5.06 the audit organization should establish policies and procedures designed to provide reasonable assurance that those assigned',
1161:'operational responsibility for the audit organization’s system of quality control have sufficient and appropriate experience and ability, and the necessary',
1162:'authority, to assume that responsibility. application guidance: leadership responsibilities for quality within the audit organization 5.07 appropriate policies and communications',
1163:'encourage a culture that recognizes that quality is essential in conducting gagas engagements and that audit organization leadership is ultimately',
1164:'responsible for the system of quality control. independence, legal, and ethical requirements requirements: independence, legal, and ethical requirements 5.08 the',
1165:'audit organization should establish policies and procedures on independence and legal and ethical requirements that are designed to provide reasonable',
1166:'assurance that the organization and its chapter 5:quality control andpeer review personnel maintain independence and comply with applicable legaland ethical',
1167:'requirements.35 5.09at least annually, the audit organization should obtain written affirmation of compliance with its policies and procedures onindependence from',
1168:'all of its personnel required to be independent. application guidance:independence, legal, and ethical requirements 5.10policies and procedures pertaining to independence',
1169:'and legal andethical requirements assist the audit organization in a.communicating its independence requirements to its personneland b.identifying and evaluating circumstances',
1170:'and relationships that create threats to independence and taking appropriate action to eliminate those threatsor reduce them to an acceptable',
1171:'level byapplying safeguards or, if considered appropriate, withdrawing from the engagement where withdrawal is not prohibited by law orregulation. 5.11written',
1172:'affirmation of compliance with its policies and procedures on independence from all audit organization personnel required to be independent may',
1173:'be in paper or electronic form. by obtaining affirmation of retrospective compliance with the audit organization’s policiesand procedureson independence during',
1174:'a specified period and taking appropriate action on information indicating noncompliance, or potentialnoncompliance, the organization demonstrates the importance that it',
1175:'attaches to independence and keeps the issue current for, and visible to, its personnel. an audit organization may obtain affirmation',
1176:'of required personnel’scompliance with policies and procedures on independence more frequently than once per year. for example, affirmation may be',
1177:'obtained on a perengagement basis when such engagements last lessthan 1 year. 35see paras. 3.02 through 3.16 for a discussion',
1178:'of ethicalprinciplesand paras. 3.18 through 3.108 for independence requirements and guidance. page 83gao21368ggovernment auditing standards initiation, acceptance, and continuance of',
1179:'engagements requirement: initiation, acceptance, and continuance of engagements 5.12 the audit organization should establish policies and procedures for the initiation,',
1180:'acceptance, and continuance of engagements that are designed to provide reasonable assurance that the organization will undertake engagements only if',
1181:'it a. complies with professional standards, applicable legal and regulatory requirements, and ethical principles; b. acts within its legal mandate',
1182:'or authority; and c. has the capabilities, including time and resources, to do so. application guidance: initiation, acceptance, and continuance',
1183:'of engagements 5.13 government audit organizations initiate engagements as a result of 1 legal mandates, 2 requests from legislative bodies',
1184:'or oversight bodies, and 3 audit organization discretion. in the case of legal mandates and requests, a government audit organization',
1185:'may be required to conduct the engagement and may not be permitted to make decisions about acceptance or continuance and',
1186:'may not be permitted to resign or withdraw from the engagement. 5.14 audit organizations may operate with limited resources. audit',
1187:'organizations may consider their workloads in determining whether they have the resources to deliver the range of work to the',
1188:'desired level of quality. to achieve this, audit organizations may develop systems to prioritize their work in a way that',
1189:'takes into account the need to maintain quality. human resources requirements: human resources 5.15 the audit organization should establish policies',
1190:'and procedures for human resources that are designed to provide the organization with reasonable assurance that it has personnel with',
1191:'the competence to conduct gagas engagements in accordance with professional chapter 5:quality control andpeer review standards and applicable legal and',
1192:'regulatory requirements.36 5.16the audit organization should establish policies and proceduresto provide reasonable assurance that auditors who are performing work in',
1193:'accordance with gagasmeet the continuing professionaleducation cpe requirements, including maintaining documentation of the cpe completed and any exemptions granted. application',
1194:'guidance: human resources 5.17effective recruitment processesand procedures help the audit organization select individuals of integrity who have the capacity to',
1195:'develop the competence and capabilities necessary to perform the audit organization’s work and possess the appropriate characteristics to enable them',
1196:'to perform competently. examples of such characteristics include meeting minimum academic requirements established by the audit organization and leadership traits.',
1197:'5.18the audit organization may use a suitably qualified external person to conduct engagement work when internal resources, for example, personnel',
1198:'with particular areas of technical expertise, are unavailable. 5.19effectiveperformance evaluation, compensation, and advancementproceduresgive due recognition and reward to developing and',
1199:'maintaining competent personnel. steps that an audit organization maytake in developing and maintaining competent personnel include the following: a.making personnel',
1200:'aware of the audit organization’s expectationsregarding performance and ethicalprinciples; b.providing personnel with an evaluation of, and counseling on, performance, progress,',
1201:'and careerdevelopment; and c.helping personnel understand that compensation and advancement to positions of greater responsibility depend on, among other things,',
1202:'performance quality, and that failure to 36refer to paras. 4.02 through 4.15 for requirements and guidance on competence. page 85gao21368ggovernment',
1203:'auditing standards comply with the audit organization’s policies and procedures may result in disciplinary action. 5.20 the size and circumstances',
1204:'of the audit organization are important considerations in determining the structure of the audit organization’s performance evaluation process. a smaller',
1205:'audit organization, in particular, may employ less formal methods of evaluating the performance of its personnel. 5.21 objectives of the',
1206:'audit organization’s human resources policies and procedures may include a. promoting learning and training for all personnel to encourage their',
1207:'professional development and to help ensure that personnel are trained in current developments in the profession and b. helping ensure',
1208:'that personnel and any parties contracted to carry out work for the audit organization have an appropriate understanding of the',
1209:'environments in which the organization operates and a good understanding of the work they are required to carry out. engagement',
1210:'performance requirements: general 5.22 the audit organization should establish policies and procedures for engagement performance, documentation, and reporting that are',
1211:'designed to provide the audit organization with reasonable assurance that engagements are conducted and reports are issued in accordance with',
1212:'professional standards and applicable legal and regulatory requirements. 5.23 if auditors change the engagement objectives during the engagement, they should',
1213:'document the revised engagement objectives and the reasons for the changes. 5.24 the audit organization should establish policies and procedures',
1214:'designed to provide it with reasonable assurance that a. appropriate consultation takes place on difficult or contentious issues that arise',
1215:'among engagement team members in the course of conducting a gagas engagement; b. both the individual seeking consultation and the',
1216:'individual consulted document and agree upon the nature and scope of such consultations; and c. the conclusions resulting from consultations',
1217:'are documented, understood by both the individual seeking consultation and the individual consulted, and implemented. 5.25 if an engagement is',
1218:'terminated before it is completed and an audit report is not issued, auditors should document the results of the work',
1219:'to the date of termination and why the engagement was terminated. application guidance: general 5.26 the audit organization’s policies and',
1220:'procedures may address consistency in the quality of engagement performance. this is often accomplished through written or electronic manuals, software',
1221:'tools or other forms of standardized documentation, and industryspecific or subject matterspecific guidance materials. matters addressed may include the following:',
1222:'a. maintaining current policies and procedures; b. briefing the engagement team to provide an understanding of the engagement objectives and',
1223:'professional standards; c. complying with applicable engagement standards; d. planning the engagement, supervision, staff training, and mentoring; e. reviewing the',
1224:'work performed, the significant judgments made, and the type of report being issued; f. documenting the work performed and the',
1225:'timing and extent of review; g. reviewing the independence and qualifications of any specialists and the scope and quality of',
1226:'their work; h. resolving difficult or contentious issues or disagreements among team members, including specialists; i. obtaining and addressing comments',
1227:'from the audited entity on draft reports; and j. reporting findings and conclusions supported by the evidence obtained and in',
1228:'accordance with professional standards and applicable legal and regulatory requirements. 5.27 the form and content of the documentation of the',
1229:'audit organization’s policies and procedures, as well as documentation of its compliance with those policies and procedures, are matters of',
1230:'professional judgment and will vary based on the organization’s circumstances. 5.28 documentation of policies and procedures, as well as compliance',
1231:'with those policies and procedures, may be either electronic or manual. for example, large audit organizations may use electronic databases',
1232:'to document matters such as independence confirmations, performance evaluations, and the results of monitoring. smaller audit organizations may use more',
1233:'informal methods in the documentation of their systems of quality control, such as manual notes, checklists, and forms. 5.29 consultation',
1234:'includes discussion at the appropriate professional level with individuals within or outside the audit organization who have relevant specialized expertise.',
1235:'5.30 consultation uses appropriate research resources, as well as the collective experience and technical expertise of the audit organization. consultation',
1236:'helps promote quality and improves the application of professional judgment. appropriate recognition of consultation in the audit organization’s policies and',
1237:'procedures helps promote a culture in which consultation is recognized as a strength and personnel are encouraged to consult on',
1238:'difficult or contentious issues. 5.31 effective consultation on significant technical, ethical, and other matters within the audit organization or, when',
1239:'applicable, outside the audit organization can be achieved when a. those consulted are given all the relevant facts that will',
1240:'enable them to provide informed advice; b. those consulted have appropriate knowledge, authority, and experience; and c. conclusions resulting from',
1241:'consultations are appropriately documented and implemented. 5.32 documentation of consultations with other professionals that involve difficult or contentious matters contributes',
1242:'to an understanding of a. the issue on which consultation was sought and b. the results of the consultation, including',
1243:'any decisions made, the basis for those decisions, and how they were implemented. 5.33 an audit organization needing to obtain',
1244:'specialized or technical expertise from external providers may take advantage of services provided by a. other audit organizations, b. professional',
1245:'and regulatory bodies, and c. commercial organizations that provide relevant quality control services. 5.34 before contracting for services, consideration of',
1246:'the competence and capabilities of the external provider helps the audit organization determine whether the external provider is suitably qualified',
1247:'for that purpose. 5.35 determining whether and how to communicate the reason for terminating an engagement or changing the engagement',
1248:'objectives to those charged with governance, appropriate officials of the audited entity, the entity contracting for or requesting the engagement,',
1249:'and other appropriate officials will depend on the facts and circumstances and therefore is a matter of professional judgment. requirements:',
1250:'supervision 5.36 the audit organization should establish policies and procedures that require engagement team members with appropriate levels of skill',
1251:'and proficiency in auditing to supervise engagements and review work performed by other engagement team members. 5.37 the audit organization',
1252:'should assign responsibility for each engagement to an engagement partner or director with authority designated by the audit organization to',
1253:'assume that responsibility and should establish policies and procedures requiring the organization to a. communicate the identity and role of',
1254:'the engagement partner or director to management and those charged with governance of the audited entity and b. clearly define',
1255:'the responsibilities of the engagement partner or director and communicate them to that individual. application guidance: supervision 5.38 appropriate teamwork',
1256:'and training help less experienced members of the engagement team to clearly understand the objectives of the assigned work. 5.39',
1257:'engagement supervision includes the following: a. tracking the progress of the engagement; b. considering the competence of individual members of',
1258:'the engagement team, whether they understand their instructions, and whether the work is being carried out in accordance with the',
1259:'planned approach to the engagement; c. addressing significant findings and issues arising during the engagement, considering their significance, and modifying',
1260:'the planned approach appropriately; and d. identifying matters for consultation or consideration by engagement team members with appropriate levels of',
1261:'skill and proficiency in auditing, specialists, or both during the engagement. 5.40 a review of the work performed includes consideration',
1262:'of whether a. the work has been performed in accordance with professional standards and applicable legal and regulatory requirements; b.',
1263:'significant findings and issues have been raised for further consideration; c. appropriate consultations have taken place and the resulting conclusions',
1264:'have been documented and implemented; d. the nature, timing, and extent of the work performed is appropriate and without need',
1265:'for revision; e. the work performed supports the conclusions reached and is appropriately documented; f. the evidence obtained is sufficient',
1266:'and appropriate to support the report; and g. the objectives of the engagement procedures have been achieved. 5.41 in the',
1267:'case of a sole proprietor, the requirement for a second auditor to review work performed and related documentation may be',
1268:'achieved through alternative procedures. monitoring of quality requirements: monitoring of quality 5.42 the audit organization should establish policies and procedures',
1269:'for monitoring its system of quality control. 5.43 the audit organization should perform monitoring procedures that enable it to assess',
1270:'compliance with professional standards and quality control policies and procedures for gagas engagements. individuals performing monitoring should have sufficient expertise',
1271:'and authority within the audit organization. 5.44 the audit organization should analyze and summarize the results of its monitoring process',
1272:'at least annually, with identification of any systemic or repetitive issues needing improvement, along with recommendations for corrective action. the',
1273:'audit organization should communicate to the relevant engagement partner or director, and other appropriate personnel, any deficiencies noted during the',
1274:'monitoring process and recommend appropriate remedial action. this communication should be sufficient to enable the audit organization and appropriate personnel',
1275:'to take prompt corrective action related to deficiencies, when necessary, in accordance with their defined roles and responsibilities. information communicated',
1276:'should include the following: a. a description of the monitoring procedures performed; b. the conclusions reached from the monitoring procedures;',
1277:'and c. when relevant, a description of systemic, repetitive, or other deficiencies and of the actions taken to resolve those',
1278:'deficiencies. 5.45 the audit organization should evaluate the effects of deficiencies noted during monitoring of the audit organization’s system of',
1279:'quality control to determine and implement appropriate actions to address the deficiencies. this evaluation should include assessments to determine if',
1280:'the deficiencies noted indicate that the audit organization’s system of quality control is insufficient to provide it with reasonable assurance',
1281:'that it complies with professional standards and applicable legal and regulatory requirements, and that accordingly the reports that the audit',
1282:'organization issues are not appropriate in the circumstances. 5.46 the audit organization should establish policies and procedures that require retention',
1283:'of engagement documentation for a period of time sufficient to permit those performing monitoring procedures and peer review of the',
1284:'organization to evaluate its compliance with its system of quality control or for a longer period if required by law',
1285:'or regulation. application guidance: monitoring of quality 5.47 monitoring of quality is a process comprising an ongoing consideration and evaluation',
1286:'of the audit organization’s system of quality control, including inspection of engagement documentation and reports for a selection of completed',
1287:'engagements. the purpose of monitoring is to provide management of the audit organization with reasonable assurance that 1 the policies',
1288:'and procedures related to the system of quality control are suitably designed and operating effectively in practice and 2 auditors',
1289:'have followed professional standards and applicable legal and regulatory requirements. 5.48 monitoring is most effective when performed by persons who',
1290:'do not have responsibility for the specific activity being monitored. 5.49 monitoring procedures will vary based on the audit organization’s',
1291:'facts and circumstances. 5.50 ongoing consideration and evaluation of the audit organization’s system of quality control may identify circumstances that',
1292:'necessitate changes to, or improve compliance with, the audit organization’s policies and procedures to provide the audit organization with reasonable',
1293:'assurance that its system of quality control is effective. 5.51 ongoing consideration and evaluation of the audit organization’s system of',
1294:'quality control may include matters such as the following: a. review of selected administrative and human resource records pertaining to',
1295:'the quality control elements; b. review of engagement documentation and reports; c. discussions with the audit organization’s personnel; d. determination',
1296:'of corrective actions to be taken and improvements to be made in the system, including providing feedback on the audit',
1297:'organization’s policies and procedures relating to education and training; e. communication to appropriate audit organization personnel of weaknesses identified in',
1298:'the system, in the level of understanding of the system, or compliance with the system; and f. followup by appropriate',
1299:'audit organization personnel so that necessary modifications are promptly made to the quality control policies and procedures. 5.52 monitoring procedures',
1300:'may also include an assessment of the following: a. the appropriateness of the audit organization’s guidance materials and any practice',
1301:'aids; b. new developments in professional standards and applicable legal and regulatory requirements and how they are reflected in the',
1302:'audit organization’s policies and procedures, when appropriate; c. written affirmation of compliance with policies and procedures on independence; d. the',
1303:'effectiveness of staff training; e. decisions related to acceptance and continuance of relationships with audited entities and specific engagements; and',
1304:'f. audit organization personnel’s understanding of the organization’s quality control policies and procedures and implementation thereof. 5.53 reviews of the',
1305:'work by engagement team members prior to the date of the report are not monitoring procedures. 5.54 the extent of',
1306:'inspection procedures depends, in part, on the existence and effectiveness of the other monitoring procedures. inspection is a retrospective evaluation',
1307:'of the adequacy of the audit organization’s quality control policies and procedures, its personnel’s understanding of those policies and procedures,',
1308:'and the extent of the audit organization’s compliance with them. the nature of inspection procedures varies based on the audit',
1309:'organization’s quality control policies and procedures and the effectiveness and results of other monitoring procedures. 5.55 the inspection of a',
1310:'selection of completed engagements may be performed on a cyclical basis. the manner in which the inspection cycle is organized,',
1311:'including the timing of selection of individual engagements, depends on many factors, such as the following: a. the size of',
1312:'the audit organization; b. the number and geographical location of offices; c. the results of previous monitoring procedures; d. the',
1313:'degree of authority of both personnel and office for example, whether individual offices are authorized to conduct their own inspections',
1314:'or whether only the head office may conduct them; e. the nature and complexity of the audit organization’s practice and',
1315:'structure; and f. the risks associated with entities audited by the audit organization and specific engagements. 5.56 the inspection process',
1316:'involves the selection of individual engagements, some of which may be selected without prior notification to the engagement team. in',
1317:'determining the scope of the inspections, the audit organization may take into account the scope or conclusions of a peer',
1318:'review or regulatory inspections. 5.57 reporting of identified deficiencies to individuals other than the relevant engagement partner or director need',
1319:'not include identifying the specific engagements concerned, unless such identification is necessary for individuals other than the engagement partner or',
1320:'director to properly discharge their responsibilities. 5.58 whether engagement documentation is in paper, electronic, or other form, the integrity, accessibility,',
1321:'and retrievability of the underlying information could be compromised if the documentation is altered, added to, or deleted without the',
1322:'auditors’ knowledge or if the documentation is lost or damaged. 5.59 appropriate documentation relating to monitoring may include, for example,',
1323:'the following: a. monitoring procedures, including the procedure for selecting completed engagements to be inspected; b. a record of the',
1324:'evaluation of the following: 1 adherence to professional standards and applicable legal and regulatory requirements, 2 whether the system of',
1325:'quality control has been appropriately designed and is effectively implemented and operating, and 3 whether the audit organization’s quality control',
1326:'policies and procedures have been appropriately applied so that the reports that are issued by the audit organization are appropriate',
1327:'in the circumstances; and c. identification of the deficiencies noted, an evaluation of their effect, and the basis for determining',
1328:'whether and what further action is necessary. external peer review requirements: general 5.60 each audit organization conducting engagements in accordance',
1329:'with gagas must obtain an external peer review conducted by reviewers independent of the audit organization being reviewed. the peer',
1330:'review should be sufficient in scope to provide a reasonable basis for determining whether, for the period under review, 1',
1331:'the reviewed audit organization’s system of quality control was suitably designed and 2 the organization is complying with its quality',
1332:'control system so that it has reasonable assurance that it is performing and reporting in conformity with professional standards and',
1333:'applicable legal and regulatory requirements in all material respects. 5.61 audit organizations affiliated with one of the following recognized organizations',
1334:'should comply with the respective organization’s peer review requirements and the requirements listed throughout paragraphs 5.66 through 5.80. a. american',
1335:'institute of certified public accountants b. council of the inspectors general on integrity and efficiency c. association of local government',
1336:'auditors d. international organization of supreme audit institutions e. national state auditors association 5.62 any audit organization not affiliated with',
1337:'an organization listed in paragraph 5.61 should meet the minimum gagas peer review requirements throughout paragraphs 5.66 through 5.94. application',
1338:'guidance: general 5.63 each audit organization has discretion in selecting and accepting its peer review teams. auditors in governments or',
1339:'jurisdictions without access to established peer review programs may engage other auditors, including public accounting firms, to conduct their peer',
1340:'reviews. if access to an established peer review program is not available, auditors may organize regional programs with other auditors.',
1341:'5.64 in cases of unusual difficulty or hardship, extensions of the deadlines for submitting peer review reports exceeding 3 months',
1342:'beyond the due date may be granted by the entity that administers the peer review program with the concurrence of',
1343:'gao. 5.65 some audit organizations may be subject to or required to follow a peer review program of a recognized',
1344:'organization. other audit organizations may follow a specific peer review program voluntarily. in instances where the audit organization follows a',
1345:'recognized organization’s peer review program voluntarily, the use of such a peer review program means compliance with the recognized organization’s',
1346:'entire peer review process, including, where applicable, standards for administering, performing, and reporting on peer reviews, oversight procedures, training, and',
1347:'related guidance materials. requirements: assessment of peer review risk 5.66 the peer review team should perform an assessment of peer',
1348:'review risk to help determine the number and types of engagements to select for review. 5.67 based on the risk',
1349:'assessment, the peer review team should select engagements that provide a reasonable cross section of all types of work subject',
1350:'to the reviewed audit organization’s quality control system, including one or more engagements conducted in accordance with gagas. application guidance:',
1351:'assessment of peer review risk 5.68 peer review risk is the risk that the review team a. fails to identify',
1352:'significant weaknesses in the reviewed audit organization’s system of quality control for its auditing practice, its lack of compliance with',
1353:'that system, or a combination thereof; b. issues an inappropriate opinion on the reviewed audit organization’s system of quality control',
1354:'for its auditing practice, its compliance with that system, or a combination thereof; or c. makes an inappropriate decision about',
1355:'the matters to be included in, or excluded from, the peer review report. 5.69 a selection approach that provides a',
1356:'cross section of all types of work is generally applicable to audit organizations that conduct a small number of gagas',
1357:'engagements in relation to other types of engagements. in these cases, one or more gagas engagements may represent more than',
1358:'what would be selected when looking at a cross section of the audit organization’s work as a whole. some audit',
1359:'organizations conduct audit and attestation work in a number of functional areas. for example, an organization may conduct financial audits,',
1360:'attestation engagements, reviews of financial statements, and performance audits. the peer review team may consider reviewing a sample of engagements',
1361:'from each of the major functional areas included within the scope of the review. 5.70 a peer review is designed',
1362:'to test significant risk areas where it is possible that engagements are not being conducted, reported on, or both in',
1363:'conformity with professional standards and applicable legal and regulatory requirements in all material respects. a peer review is not designed',
1364:'to test every engagement, compliance with every professional standard, or every detailed component of the audit organization’s system of quality',
1365:'control. 5.71 examples of the factors that may be considered when performing an assessment of risk for selecting engagements for',
1366:'peer review include a. scope of the engagements, including size of the audited entity or engagements covering multiple locations; b.',
1367:'functional area or type of government program; c. types of engagements conducted, including the extent of nonaudit services provided to',
1368:'audited entities; d. personnel including use of new personnel or personnel not routinely assigned the types of engagements conducted; e.',
1369:'initial engagements; f. familiarity resulting from a longstanding relationship with the audited entity; g. political sensitivity of the engagements; h.',
1370:'budget constraints faced by the audit organization that could negatively affect engagement quality; i. results of the peer review team’s',
1371:'review of the design of system of quality control; j. results of the audit organization’s monitoring process; and k. overall',
1372:'risk tolerance within the audit organization that could negatively affect engagement quality. requirements: peer review report ratings 5.72 the peer',
1373:'review team should use professional judgment in deciding on the type of peer review rating to issue; the ratings are',
1374:'as follows: a. peer review rating of pass: a conclusion that the audit organization’s system of quality control has been',
1375:'suitably designed and complied with to provide the audit organization with reasonable assurance of performing and reporting in conformity with',
1376:'professional standards and applicable legal and regulatory requirements in all material respects. b. peer review rating of pass with deficiencies:',
1377:'a conclusion that the audit organization’s system of quality control has been suitably designed and complied with to provide the',
1378:'audit organization with reasonable assurance of performing and reporting in conformity with professional standards and applicable legal and regulatory requirements',
1379:'in all material respects with the exception of a certain deficiency or deficiencies described in the report. c. peer review',
1380:'rating of fail: a conclusion, based on the significant deficiencies described in the report, that the audit organization’s system of',
1381:'quality control is not suitably designed to provide the audit organization with reasonable assurance of performing and reporting in conformity',
1382:'with professional standards and applicable legal and regulatory requirements in all material respects, or that the audit organization has not',
1383:'complied with its system of quality control to provide the audit organization with reasonable assurance of performing and reporting in',
1384:'conformity with professional standards and applicable legal and regulatory requirements in all material respects. 5.73 the peer review team should',
1385:'determine the type of peer review rating to issue based on the observed matters’ importance to the audit organization’s system',
1386:'of quality control as a whole and the nature, causes, patterns, and pervasiveness of those matters. the matters should be',
1387:'assessed both alone and in aggregate. 5.74 the peer review team should aggregate and systematically evaluate any observed matters circumstances',
1388:'that warrant further consideration by the peer review team and document its evaluation.37 the peer review team should perform its',
1389:'evaluation and issue report ratings as follows: a. if the peer review team’s evaluation of observed matters does not identify',
1390:'any findings more than a remote possibility that the reviewed audit organization would not perform, report, or both in conformity',
1391:'with professional standards and applicable legal and regulatory requirements, or identifies findings that are not considered to be deficiencies, the',
1392:'peer review team issues a pass rating. b. if the peer review team’s evaluation of findings identified deficiencies but did',
1393:'not identify any significant deficiencies, the peer review team issues a pass with deficiencies rating and communicates the deficiencies in',
1394:'its report. c. if the peer review team’s evaluation of deficiencies identified significant deficiencies, the peer review team issues a',
1395:'fail rating and communicates the deficiencies and significant deficiencies in its report. 37see fig. 3 for a flowchart on developing',
1396:'peer review communications for observed matters in accordance with gagas. application guidance: peer review report ratings 5.75 deficiencies are findings',
1397:'that because of their nature, causes, pattern, or pervasiveness, including their relative importance to the audit organization’s system of quality',
1398:'control taken as a whole, could create a situation in which the audit organization would not have reasonable assurance of',
1399:'performing, reporting, or both in conformity with professional standards and applicable legal and regulatory requirements in one or more important',
1400:'respects. 5.76 significant deficiencies are one or more deficiencies that the peer review team concludes result from a condition in',
1401:'the audit organization’s system of quality control or compliance with that system such that the system taken as a whole',
1402:'does not provide reasonable assurance of performing, reporting, or both in conformity with professional standards and applicable legal and regulatory',
1403:'requirements. requirements: availability of the peer review report to the public 5.77 an external audit organization should make its most',
1404:'recent peer review report publicly available. if a separate communication detailing findings, conclusions, and recommendations is issued, the external audit',
1405:'organization is not required to make that communication publicly available. an internal audit organization that reports internally to management and',
1406:'those charged with governance should provide a copy of its peer review report to those charged with governance. 5.78 an',
1407:'external audit organization should satisfy the publication requirement for its peer review report by posting the report on a publicly',
1408:'available website or to a publicly available file. alternatively, if neither of these options is available, then the audit organization',
1409:'should use the same mechanism it uses to make other reports or documents public. 5.79 because information in peer review',
1410:'reports may be relevant to decisions on procuring audit services, an audit organization seeking to enter into a contract to',
1411:'conduct an engagement in accordance with gagas should provide the following to the party contracting for such services when requested:',
1412:'a. the audit organization’s most recent peer review report and b. any subsequent peer review reports received during the period',
1413:'of the contract. 5.80 auditors who are using another audit organization’s work should request a copy of that organization’s most',
1414:'recent peer review report, and the organization should provide this document when it is requested. application guidance: availability of the',
1415:'peer review report to the public 5.81 to help the public understand the peer review reports, an audit organization may',
1416:'include a description of the peer review process and how it applies to its organization. examples of additional information that',
1417:'audit organizations may include to help users understand the meaning of the peer review report follow: a. explanation of the',
1418:'peer review process. b. description of the audit organization’s system of quality control. c. explanation of the relationship of the',
1419:'peer review results to the audited organization’s work. d. if a peer review report is issued with a rating of',
1420:'pass with deficiencies or fail, explanation of the reviewed audit organization’s plan for improving quality controls and the status of',
1421:'the improvements. additional requirements for audit organizations not affiliated with recognized organizations requirement: peer review scope 5.82 the peer review',
1422:'team should include the following elements in the scope of the peer review: a. review of the audit organization’s design',
1423:'of, and compliance with, quality control and related policies and procedures; b. consideration of the adequacy and results of the',
1424:'audit organization’s internal monitoring procedures; c. review of selected audit reports and related documentation and, if applicable, documentation related to',
1425:'selected terminated engagements prepared in accordance with paragraph 5.25, if any terminated engagements are selected from the universe of engagements',
1426:'used for the peer review sample; d. review of prior peer review reports, if applicable; e. review of other documents',
1427:'necessary for assessing compliance with standards, for example, independence documentation, cpe records, and relevant human resource management files; and f.',
1428:'interviews with selected members of the audit organization’s personnel in various roles to assess their understanding of and compliance with',
1429:'relevant quality control policies and procedures. application guidance: peer review scope 5.83 review of documentation related to terminated engagements can',
1430:'provide information on the audit organization’s response to threats to independence. for example, the documentation may include information on whether',
1431:'an engagement was terminated as a result of an undue influence from outside the audit organization. requirement: peer review intervals',
1432:'5.84 an audit organization not already subject to a peer review requirement should obtain an external peer review at least',
1433:'once every 3 years. the audit organization should obtain its first peer review covering a review period ending no later',
1434:'than 3 years from the date an audit organization begins its first engagement in accordance with gagas. application guidance: peer',
1435:'review intervals 5.85 the period under review in a peer review generally covers 1 year. requirement: written agreement for peer',
1436:'review 5.86 the peer review team and the reviewed audit organization should incorporate their basic agreement on the peer review',
1437:'into a written agreement. the written agreement should be drafted by the peer review team, reviewed by the reviewed audit',
1438:'organization to ensure that it accurately describes the agreement between the parties, and signed by the authorized representatives of both',
1439:'the peer review team and the reviewed audit organization prior to the initiation of work under the agreement. the written',
1440:'agreement should state that the peer review will be conducted in accordance with gagas peer review requirements. application guidance: written',
1441:'agreement for peer review 5.87 the written agreement is meant to ensure mutual consent on the fundamental aspects of the',
1442:'peer review and to avoid any potential misunderstandings. the written agreement may address the following: a. scope of the peer',
1443:'review; b. staffing and time frame; c. compensation for conducting the peer review, if applicable; d. preliminary findings, if applicable;',
1444:'e. reporting results; f. administrative matters; and g. access to audit documentation. 5.88 the peer review team is responsible for',
1445:'ensuring that the peer review is conducted in accordance with gagas peer review requirements. requirement: peer review team 5.89 the',
1446:'peer review team should meet the following criteria: a. the review team collectively has adequate professional competence and knowledge of',
1447:'gagas and government auditing. b. the organization conducting the peer review and individual review team members are independent as defined',
1448:'in gagas of the audit organization being reviewed, its personnel, and the engagements selected for the peer review.38 c. the',
1449:'review team collectively has sufficient knowledge to conduct a peer review. 38see paras. 3.18 through 3.108 for discussion of independence.',
1450:'application guidance: peer review team 5.90 peer review knowledge and professional competence may be obtained from onthejob training, training courses,',
1451:'or a combination of both. having individuals on the peer review team with prior experience on a peer review or',
1452:'internal inspection team is desirable. requirement: report content 5.91 the peer review team should prepare one or more written reports',
1453:'communicating the results of the peer review, which collectively include the following elements: a. a description of the scope of',
1454:'the peer review, including any limitations; b. a rating concluding on whether the system of quality control of the reviewed',
1455:'audit organization was adequately designed and complied with during the period reviewed and would provide the audit organization with reasonable',
1456:'assurance that it conformed to professional standards and applicable legal and regulatory requirements; c. specification of the professional standards and',
1457:'applicable legal and regulatory requirements to which the reviewed audit organization is being held; d. reference to a separate written',
1458:'communication, if issued under the peer review program; e. a statement that the peer review was conducted in accordance with',
1459:'gagas peer review requirements; and f. a detailed description of the findings, conclusions, and recommendations related to any deficiencies or',
1460:'significant deficiencies identified in the review. application guidance: report content 5.92 when the scope of the peer review is limited',
1461:'by conditions that preclude the application of one or more peer review procedures considered necessary in the circumstances and the',
1462:'peer review team cannot accomplish the objectives of those procedures through alternative procedures, the report can be modified by including',
1463:'a statement in the report’s scope paragraph, body, and opinion paragraph. the statement describes the relationship of the excluded engagements',
1464:'or functional areas to the reviewed audit organization’s full scope of practice as a whole and system of quality control',
1465:'and the effects of the exclusion on the scope and results of the review. requirements: audit organization’s response to the',
1466:'peer review report 5.93 if the reviewed audit organization receives a report with a peer review rating of pass with',
1467:'deficiencies or fail, the reviewed audit organization should respond in writing to the deficiencies or significant deficiencies and related recommendations',
1468:'identified in the report. 5.94 with respect to each deficiency or significant deficiency in the report, the reviewed audit organization',
1469:'should describe in its letter of response the corrective actions already taken, target dates for planned corrective actions, or both.',
1470:'application guidance: audit organization’s response to the peer review report 5.95 when an audit organization receives a peer review rating',
1471:'of pass with deficiencies or fail that relates to its gagas engagements, critical evaluation of the design and implementation of',
1472:'the system of quality control is a factor in determining the audit organization’s ability to accept and perform future gagas',
1473:'engagements. figure 3: developing peer review communications for observed matters in accordance with generally accepted government auditing standards chapter 6:',
1474:'standards for financial audits 6.01 this chapter contains requirements and guidance for conducting and reporting on financial audits conducted in',
1475:'accordance with generally accepted government auditing standards gagas. gagas incorporates by reference the american institute of certified public accountants’ aicpa',
1476:'statements on auditing standards sas.39 all sections of the sas are incorporated, including the introduction, objectives, definitions, requirements, and application',
1477:'material. gagas does not incorporate the aicpa code of professional conduct by reference but recognizes that certain certified public accountants',
1478:'cpa may use or may be required to use the code in conjunction with gagas.40 for financial audits conducted in',
1479:'accordance with gagas, the requirements and guidance in the incorporated sas and this chapter apply. the requirements and guidance contained',
1480:'in chapters 1 through 5 also apply. 39see para. 2.13 and the aicpa codification of statements on auditing standards auc',
1481:'for additional discussion of the relationship between gagas and other professional standards. 40see para. 2.14 for a discussion of the',
1482:'aicpa code of professional conduct. 41see auc section 320, materiality in planning and performing an audit aicpa, professional standards. additional',
1483:'gagas requirements for conducting financial audits compliance with standards requirement: compliance with standards 6.02 gagas establishes requirements for financial audits',
1484:'in addition to the requirements in the aicpa sas. auditors should comply with these additional requirements, along with the aicpa',
1485:'requirements for financial audits, when citing gagas in financial audit reports. application guidance: compliance with standards 6.03 standards used in',
1486:'conjunction with gagas require the auditors to apply the concept of materiality appropriately in planning and performing the audit.41 additional',
1487:'considerations may apply to gagas engagements that concern government entities or entities that receive government awards. for example, for engagements',
1488:'conducted in accordance with gagas, auditors may find it appropriate to use lower materiality levels than those used in nongagas',
1489:'audits because of the public accountability of government entities and entities receiving government funding, various legal and regulatory requirements, and',
1490:'the visibility and sensitivity of government programs. licensing and certification requirements: licensing and certification 6.04 auditors engaged to conduct financial',
1491:'audits in the united states who do not work for a government audit organization should be licensed cpas, persons working',
1492:'for licensed certified public accounting firms, or licensed accountants in states that have multiclass licensing systems that recognize licensed accountants',
1493:'other than cpas. 6.05 auditors engaged to conduct financial audits of entities operating outside of the united states who do',
1494:'not work for a government audit organization should meet the qualifications indicated in paragraph 6.04, have certifications that meet all',
1495:'applicable national and international standards and serve in their respective countries as the functional equivalent of cpas in the united',
1496:'states, or work for nongovernment audit organizations that are the functional equivalent of licensed certified public accounting firms in the',
1497:'united states. auditor communication requirements: auditor communication 6.06 if the law or regulation requiring an audit specifically identifies the entities',
1498:'to be audited, auditors should communicate pertinent information that in the auditors’ professional judgment needs to be communicated both to',
1499:'individuals contracting for or requesting the audit and to those legislative committees, if any, that have ongoing oversight responsibilities for',
1500:'the audited entity. 6.07 if the identity of those charged with governance is not clearly evident, auditors should document the',
1501:'process followed and conclusions reached in identifying the appropriate individuals to receive the required communications. application guidance: auditor communication 6.08',
1502:'one example of a law or regulation requiring an audit that does not specifically identify the entities to be audited',
1503:'is the single audit act amendments of 1996. 6.09 for some matters, early communication to management or those charged with',
1504:'governance may be important because of the relative significance and the urgency for corrective followup action.42 further, early communication is',
1505:'important to allow management to take prompt corrective action to prevent further occurrences when a control deficiency results in identified',
1506:'or suspected noncompliance with provisions of laws, regulations, contracts, and grant agreements or identified or suspected instances of fraud. when',
1507:'a deficiency is communicated early, the reporting requirements and application guidance in paragraphs 6.39 through 6.49 still apply. 42see auc',
1508:'section 265, communicating internal control related matters identified in an audit aicpa, professional standards. 6.10 because the governance structures of',
1509:'government entities and organizations can vary widely, it may not always be clearly evident who is charged with key governance',
1510:'functions. the process for identifying those charged with governance includes evaluating the organizational structure for directing and controlling operations to',
1511:'achieve the audited entity’s objectives and how the audited entity delegates authority and establishes accountability for management. results of previous',
1512:'engagements requirement: results of previous engagements 6.11 when planning the audit, auditors should ask management of the audited entity to',
1513:'identify previous audits, attestation engagements, and other studies that directly relate to the objectives of the audit, including whether related',
1514:'recommendations have been implemented. auditors should evaluate whether the audited entity has taken appropriate corrective action to address findings and',
1515:'recommendations from previous engagements that could have a significant effect on the subject matter. auditors should use this information in',
1516:'assessing risk and determining the nature, timing, and extent of current audit work and determining the extent to which testing',
1517:'the implementation of the corrective actions is applicable to the current audit objectives. investigations or legal proceedings requirement: investigations or',
1518:'legal proceedings 6.12 auditors should inquire of management of the audited entity whether any investigations or legal proceedings have been',
1519:'initiated or are in process with respect to the period under audit, and should evaluate the effect of initiated or',
1520:'inprocess investigations or legal proceedings on the current audit. application guidance: investigations or legal proceedings 6.13 laws, regulations, or policies',
1521:'may require auditors to communicate indications of certain types of fraud or noncompliance with provisions of laws, regulations, contracts, and',
1522:'grant agreements to law enforcement or investigatory authorities before performing additional audit procedures. 6.14 avoiding interference with investigations or legal',
1523:'proceedings is important in pursuing indications of fraud and noncompliance with provisions of laws, regulations, contracts, and grant agreements. in',
1524:'some cases, it may be appropriate for the auditors to work with investigators or legal authorities or to withdraw from',
1525:'or defer further work on the engagement or a portion of the engagement to avoid interfering with an ongoing investigation',
1526:'or legal proceeding. noncompliance with provisions of laws, regulations, contracts, and grant agreements requirement: noncompliance with provisions of laws, regulations,',
1527:'contracts, and grant agreements 6.15 auditors should extend the aicpa requirements concerning consideration of noncompliance with laws and regulations to',
1528:'include chapter 6: standards for financial audits consideration of noncompliance with provisions of contracts and grant agreements.43 application guidance: noncompliance',
1529:'with provisions of laws, regulations, contracts, and grant agreements 6.16government programs are subject to provisions of many laws, regulations, contracts,',
1530:'and grant agreements. at the same time, these provisions’significance within the context of the audit objectives varieswidely, depending on the',
1531:'objectives of the audit. auditors may consult with their legal counselto 1 determine those laws and regulations thatare significant to',
1532:'the audit objectives, 2 design tests of compliance with laws and regulations, and 3 evaluate the results of those tests.',
1533:'auditorsalso may consult with their legal counsel when audit objectives require testing compliance with provisions of contracts or grant agreements.',
1534:'depending on the circumstances of the audit, auditors may consult with others, such as investigative staff, other audit organizationsorgovernment entities',
1535:'that provided professional services to the audited entity, or applicable law enforcement authorities, to obtain information on compliance matters. findings',
1536:'requirements: findings 6.17 when auditors identify findings, they should plan and performprocedures to develop the criteria, condition, cause, and effect',
1537:'of the findings to the extent that these elements are relevant and necessaryto achieve the audit objectives. 6.18auditors should consider',
1538:'internal control deficiencies in theirevaluation of identified findings when developing the cause element of the identified findings. 43see auc section',
1539:'250,consideration of laws and regulations in an audit of financial statementsaicpa,professional standards. page 113gao21368ggovernment auditing standards application guidance: findings 6.19',
1540:'findings may involve deficiencies in internal control; noncompliance with provisions of laws, regulations, contracts, and grant agreements; or instances of',
1541:'fraud. 6.20 given the concept of accountability for use of public resources and government authority, evaluating internal control in a',
1542:'government environment may also include considering internal control deficiencies that result in waste or abuse. because the determination of waste',
1543:'and abuse is subjective, auditors are not required to perform specific procedures to detect waste or abuse in financial audits.',
1544:'however, auditors may consider whether and how to communicate such matters if they become aware of them. auditors may also',
1545:'discover that waste or abuse are indicative of fraud or noncompliance with provisions of laws, regulations, contracts, and grant agreements.',
1546:'6.21 waste is the act of using or expending resources carelessly, extravagantly, or to no purpose. importantly, waste can include',
1547:'activities that do not include abuse and does not necessarily involve a violation of law. rather, waste relates primarily to',
1548:'mismanagement, inappropriate actions, and inadequate oversight. 6.22 the following are examples of waste, depending on the facts and circumstances: a.',
1549:'making travel choices that are contrary to existing travel policies or are unnecessarily extravagant or expensive. b. making procurement or',
1550:'vendor selections that are contrary to existing policies or are unnecessarily extravagant or expensive. 6.23 abuse is behavior that is',
1551:'deficient or improper when compared with behavior that a prudent person would consider reasonable and necessary business practice given the',
1552:'facts and circumstances, but excludes fraud and noncompliance with provisions of laws, regulations, contracts, and grant agreements. abuse also includes',
1553:'misuse of authority or position for personal financial interests or those of an immediate or close family member or business',
1554:'associate. 6.24 the following are examples of abuse, depending on the facts and circumstances: a. creating unneeded overtime. b. requesting',
1555:'staff to perform personal errands or work tasks for a supervisor or manager. c. misusing the official’s position for personal',
1556:'gain including actions that could be perceived by an objective third party with knowledge of the relevant information as improperly',
1557:'benefiting an official’s personal financial interests or those of an immediate or close family member; a general partner; an organization',
1558:'for which the official serves as an officer, director, trustee, or employee; or an organization with which the official is',
1559:'negotiating concerning future employment. 6.25 criteria: for inclusion in findings, criteria may include the laws, regulations, contracts, grant agreements, standards,',
1560:'measures, expected performance, defined business practices, and benchmarks against which performance is compared or evaluated. criteria identify the required or',
1561:'desired state or expectation with respect to the program or operation. criteria provide a context for evaluating evidence and understanding',
1562:'the findings, conclusions, and recommendations in the report. in a financial audit, the applicable financial reporting framework, such as generally',
1563:'accepted accounting principles, represents one set of criteria. 6.26 condition: condition is a situation that exists. the condition is determined',
1564:'and documented during the audit. 6.27 cause: the cause is the factor or factors responsible for the difference between the',
1565:'condition and the criteria, and may also serve as a basis for recommendations for corrective actions. common factors include poorly',
1566:'designed policies, procedures, or criteria; inconsistent, incomplete, or incorrect implementation; or factors beyond the control of program management. auditors may',
1567:'assess whether the evidence provides a reasonable and convincing argument for why the stated cause is the key factor contributing',
1568:'to the difference between the condition and the criteria. 6.28 effect or potential effect: the effect or potential effect is',
1569:'the outcome or consequence resulting from the difference between the condition and the criteria. when the audit objectives include identifying',
1570:'the actual or potential consequences of a condition that varies either positively or negatively from the criteria identified in the',
1571:'audit, effect is a measure of those consequences. effect or potential effect may be used to demonstrate the need for',
1572:'corrective action in response to identified problems or relevant risks. 6.29 regardless of the type of finding identified, the cause',
1573:'of a finding may relate to one or more underlying internal control deficiencies. depending on the magnitude of impact, likelihood',
1574:'of occurrence, and nature of the deficiency, the deficiency could be a significant deficiency or material weakness in a financial',
1575:'audit.44 44see auc section 265, communicating internal control related matters identified in an audit aicpa, professional standards. 45para. .a16 of',
1576:'auc section 940, an audit of internal control over financial reporting that is integrated with an audit of financial statements',
1577:'aicpa, professional standards indicates that the committee of sponsoring organizations of the treadway commission’s internal control—integrated framework and standards for',
1578:'internal control in the federal government gao14704g provide suitable and available criteria against which management may evaluate and report on',
1579:'the effectiveness of the entity’s internal control over financial reporting. standards for internal control in the federal government may be',
1580:'adopted by entities beyond those federal entities for which it is legally required, such as state, local, and quasigovernmental entities,',
1581:'as well as other federal entities and notfor profit organizations, as a framework for an internal control system. 6.30 considering',
1582:'internal control in the context of a comprehensive internal control framework, such as standards for internal control in the federal',
1583:'government or internal control—integrated framework,45 can help auditors to determine whether underlying internal control deficiencies exist as the root cause',
1584:'of findings. identifying these deficiencies can help provide the basis for developing meaningful recommendations for corrective actions. audit documentation requirements:',
1585:'audit documentation 6.31 auditors should document supervisory review, before the report release date, of the evidence that supports the findings',
1586:'and conclusions contained in the audit report. 6.32 auditors should document any departures from the gagas requirements and the effect',
1587:'on the audit and on the auditors’ conclusions when the audit is not in compliance with applicable gagas requirements because',
1588:'of law, regulation, scope limitations, restrictions on access to records, or other issues affecting the audit. application guidance: audit documentation',
1589:'6.33 when documenting departures from the gagas requirements, the audit documentation requirements apply to departures from unconditional requirements and from',
1590:'presumptively mandatory requirements when alternative procedures performed in the circumstances were not sufficient to achieve the objectives of the requirements.',
1591:'availability of individuals and documentation requirement: availability of individuals and documentation 6.34 subject to applicable provisions of laws and regulations,',
1592:'auditors should make appropriate individuals and audit documentation available upon request and in a timely manner to other auditors or',
1593:'reviewers. application guidance: availability of individuals and documentation 6.35 underlying gagas audits is the premise that audit organizations in federal,',
1594:'state, and local governments and public accounting firms engaged to conduct financial audits in accordance with gagas cooperate in auditing',
1595:'programs of common interest so that auditors may use others’ work and avoid duplication of efforts. the use of auditors’',
1596:'work by other auditors may be facilitated by contractual arrangements for gagas audits that provide for full and timely access',
1597:'to appropriate individuals and to audit documentation. additional gagas requirements for reporting on financial audits reporting the auditors’ compliance with',
1598:'gagas requirement: reporting the auditors’ compliance with gagas 6.36 when auditors comply with all applicable gagas requirements, they should include',
1599:'a statement in the audit report that they conducted the audit in accordance with gagas.46 46see paras. 2.16 through 2.19',
1600:'for information on the gagas compliance statement. 47see auc section 700, forming an opinion and reporting on financial statements aicpa,',
1601:'professional standards. 48see auc section 705, modifications to the opinion in the independent auditor’s report aicpa, professional standards. application guidance:',
1602:'reporting the auditors’ compliance with gagas 6.37 because gagas incorporates by reference the aicpa’s financial audit standards, gagas does not',
1603:'require auditors to cite compliance with the aicpa standards when citing compliance with gagas. gagas does not prohibit auditors from',
1604:'issuing a separate report conforming only to the requirements of the aicpa or other standards.47 6.38 when disclaiming an opinion',
1605:'on a financial audit, auditors may revise the statement that the auditor was engaged to audit the financial statements.48 for',
1606:'example, auditors may state that they were engaged to conduct the audit in accordance with gagas or that the auditors’',
1607:'work was conducted in accordance with gagas, depending on whether the use of gagas is required or voluntary. determining how',
1608:'to revise this statement is a matter of professional judgment. reporting on internal control; compliance with provisions of laws, regulations,',
1609:'contracts, and grant agreements; and instances of fraud requirements: reporting on internal control; compliance with provisions of laws, regulations, contracts,',
1610:'and grant agreements; and instances of fraud 6.39 auditors should report on internal control and compliance with provisions of laws,',
1611:'regulations, contracts, or grant agreements regardless of whether they identify internal control deficiencies or instances of noncompliance. 6.40 when providing',
1612:'an opinion or a disclaimer on financial statements, auditors should report as findings any significant deficiencies or material weaknesses in',
1613:'internal control over financial reporting that the auditors identified based on the engagement work performed. 6.41 auditors should include in',
1614:'their report on internal control or compliance the relevant information about noncompliance and fraud when auditors, based on sufficient, appropriate',
1615:'evidence, identify or suspect a. noncompliance with provisions of laws, regulations, contracts, or grant agreements that has a material effect',
1616:'on the financial statements or other financial data significant to the audit objectives or b. fraud that is material, either',
1617:'quantitatively or qualitatively, to the financial statements or other financial data significant to the audit objectives. 6.42 auditors should include',
1618:'either in the same or in separate reports a description of the scope of the auditors’ testing of internal control',
1619:'over financial reporting and of compliance with provisions of laws, regulations, contracts, and grant agreements. auditors should also state in',
1620:'the reports whether the tests they performed provided sufficient, appropriate evidence to support opinions on the effectiveness of internal control',
1621:'and on compliance with provisions of laws, regulations, contracts, and grant agreements. 6.43 if auditors report separately including separate reports',
1622:'bound in the same document on internal control over financial reporting and on compliance with provisions of laws, regulations, contracts,',
1623:'and grant agreements, they should include a reference in the audit report on the financial statements to those additional reports.',
1624:'they should also state in the audit report that the reports on internal control over financial reporting and on compliance',
1625:'with provisions of laws, regulations, contracts, and grant agreements are an integral part of a gagas audit in considering the',
1626:'audited entity’s internal control over financial reporting and compliance. if separate reports are used, the auditors should make the report',
1627:'on internal control and compliance available to users in the same manner as the financial audit report to which it',
1628:'relates. 6.44 auditors should communicate in writing to audited entity officials when a. identified or suspected noncompliance with provisions of',
1629:'laws, regulations, contracts, or grant agreements comes to the auditor’s attention during the course of an audit that has an',
1630:'effect on the financial statements or other financial data significant to the audit objectives that is less than material but',
1631:'warrants the attention of those charged with governance or b. the auditor has obtained evidence of identified or suspected instances',
1632:'of fraud that have an effect on the financial statements or other financial data significant to the audit objectives that',
1633:'are less than material but warrant the attention of those charged with governance. application guidance: reporting on internal control; compliance',
1634:'with provisions of laws, regulations, contracts, and grant agreements; and instances of fraud 6.45 the gagas requirement to report on',
1635:'internal control over financial reporting is based on the aicpa requirements to communicate in writing to those charged with governance',
1636:'significant deficiencies and material weaknesses in internal control over financial reporting identified during an audit. the objective of the gagas',
1637:'internal control reporting requirement for financial audits is to increase the availability of information on significant deficiencies and material weaknesses',
1638:'to users of financial statements other than those charged with governance. 6.46 internal control plays an expanded role in the',
1639:'government sector. given the government’s accountability for public resources, assessing internal control in a government environment may involve considering controls',
1640:'that would not be required in the private sector. in the government sector, evaluating controls that are relevant to the',
1641:'audit involves understanding significant controls that the audited entity designed, implemented, and operated as part of its responsibility for oversight',
1642:'of public resources. 6.47 the audit report on internal control and compliance with provisions of laws, regulations, contracts, and grant',
1643:'agreements relates only to the most recent reporting period included, when comparative financial statements are presented. 6.48 when identified or',
1644:'suspected noncompliance with provisions of laws, regulations, contracts, or grant agreements that does not warrant the attention of those charged',
1645:'with governance comes to the auditor’s attention during the course of the audit, the auditors’ determination of how to communicate',
1646:'such instances to audited entity officials is a matter of professional judgment. when identified or suspected noncompliance with provisions of',
1647:'laws, regulations, contracts, or grant agreements is clearly inconsequential, the auditors’ determination of whether and how to communicate such instances',
1648:'to audited entity officials is a matter of professional judgment. 6.49 when auditors identify or suspect noncompliance with provisions of',
1649:'laws, regulations, contracts, or grant agreements or instances of fraud, auditors may consult with authorities or legal counsel about whether',
1650:'publicly reporting such information would compromise investigative or legal proceedings. auditors may limit their public reporting to matters that would',
1651:'not compromise those proceedings and, for example, report only on information that is already a part of the public record.',
1652:'presenting findings in the audit report requirements: presenting findings in the audit report 6.50 when presenting findings, auditors should develop',
1653:'the elements of the findings to the extent necessary to assist management or oversight officials of the audited entity in',
1654:'understanding the need for corrective action. 6.51 auditors should place their findings in perspective by describing the nature and extent',
1655:'of the issues being reported and the extent of the work performed that resulted in the finding. to give the',
1656:'reader a basis for judging the prevalence and consequences of these findings, auditors should, as appropriate, relate the instances identified',
1657:'to the population or the number of cases examined and quantify the results in terms of dollar value or other',
1658:'measures. if the results cannot be projected, auditors should limit their conclusions appropriately. application guidance: presenting findings in the audit',
1659:'report 6.52 along with assisting management or oversight officials of the audited entity in understanding the need for corrective action,',
1660:'clearly developed findings assist auditors in making recommendations for corrective action. if auditors sufficiently develop the elements of a finding,',
1661:'they may provide recommendations for corrective action. reporting findings directly to parties outside the audited entity requirements: reporting findings directly',
1662:'to parties outside the audited entity 6.53 auditors should report identified or suspected noncompliance with provisions of laws, regulations, contracts,',
1663:'and grant agreements and instances of fraud directly to parties outside the audited entity in the following two circumstances. a.',
1664:'when audited entity management fails to satisfy legal or regulatory requirements to report such information to external parties specified in',
1665:'law or regulation, auditors should first communicate the failure to report such information to those charged with governance. if the',
1666:'audited entity still does not report this information to the specified external parties as soon as practicable after the auditors’',
1667:'communication with those charged with governance, then the auditors should report the information directly to the specified external parties. b.',
1668:'when audited entity management fails to take timely and appropriate steps to respond to fraud or noncompliance with provisions of',
1669:'laws, regulations, contracts, and grant agreements that 1 is likely to have a material effect on the subject matter and',
1670:'2 involves funding received directly or indirectly from a government agency, auditors should first report management’s failure to take timely',
1671:'and appropriate steps to those charged with governance. if the audited entity still does not take timely and appropriate steps',
1672:'as soon as practicable after the auditors’ communication with those charged with governance, then the auditors should report the audited',
1673:'entity’s failure to take timely and appropriate steps directly to the funding agency. 6.54 auditors should comply with the requirements',
1674:'in paragraph 6.53 even if they have resigned or been dismissed from the audit prior to its completion. 6.55 auditors',
1675:'should obtain sufficient, appropriate evidence, such as confirmation from outside parties, to corroborate representations by management of the audited entity',
1676:'that it has reported audit findings in accordance with provisions of laws, regulations, or funding agreements. when auditors are unable',
1677:'to do so, they should report such information directly as discussed in paragraphs 6.53 and 6.54. application guidance: reporting findings',
1678:'directly to parties outside the audited entity 6.56 the reporting in paragraph 6.53 is in addition to any legal requirements',
1679:'to report such information directly to parties outside the audited entity. obtaining and reporting the views of responsible officials requirements:',
1680:'obtaining and reporting the views of responsible officials 6.57 auditors should obtain and report the views of responsible officials of',
1681:'the audited entity concerning the findings, conclusions, and recommendations in the audit report, as well as any planned corrective actions.',
1682:'6.58 when auditors receive written comments from the responsible officials, they should include in their report a copy of the',
1683:'officials’ written comments or a summary of the comments received. when the responsible officials provide oral comments only, auditors should',
1684:'prepare a summary of the oral comments, provide a copy of the summary to the responsible officials to verify that',
1685:'the comments are accurately represented, and include the summary in their report. 6.59 when the audited entity’s comments are inconsistent',
1686:'or in conflict with the findings, conclusions, or recommendations in the draft report, the auditors should evaluate the validity of',
1687:'the audited entity’s comments. if the auditors disagree with the comments, they should explain in the report their reasons for',
1688:'disagreement. conversely, the auditors should modify their report as necessary if they find the comments valid and supported by sufficient,',
1689:'appropriate evidence. 6.60 if the audited entity refuses to provide comments or is unable to provide comments within a reasonable',
1690:'period of time, the auditors should issue the report without receiving comments from the audited entity. in such cases, the',
1691:'auditors should indicate in the report that the audited entity did not provide comments. application guidance: obtaining and reporting the',
1692:'views of responsible officials 6.61 providing a draft report with findings for review and comment by responsible officials of the',
1693:'audited entity and others helps the auditors develop a report that is fair, complete, and objective. including the views of',
1694:'responsible officials results in a report that presents not only the auditors’ findings, conclusions, and recommendations but also the perspectives',
1695:'of the audited entity’s responsible officials and the corrective actions they plan to take. obtaining the comments in writing is',
1696:'preferred, but oral comments are acceptable. in cases in which the audited entity provides technical comments in addition to its',
1697:'written or oral comments on the report, auditors may disclose in the report that such comments were received. technical comments',
1698:'address points of fact or are editorial in nature and do not address substantive issues, such as methodology, findings, conclusions,',
1699:'or recommendations. 6.62 obtaining oral comments may be appropriate when, for example, there is a reporting date critical to meeting',
1700:'a user’s needs; auditors have worked closely with the responsible officials throughout the engagement, and the parties are familiar with',
1701:'the findings and issues addressed in the draft report; or the auditors do not expect major disagreements with findings, conclusions,',
1702:'or recommendations in the draft report or major controversies with regard to the issues discussed in the draft report. reporting',
1703:'confidential or sensitive information requirements: reporting confidential or sensitive information 6.63 if certain information is prohibited from public disclosure or',
1704:'is excluded from a report because of its confidential or sensitive nature, auditors should disclose in the report that certain',
1705:'information has been omitted and the circumstances that make the omission necessary. 6.64 when circumstances call for omission of certain',
1706:'information from the report, auditors should evaluate whether this omission could distort the audit results or conceal improper or illegal',
1707:'practices and revise the report language as necessary to avoid report users drawing inappropriate conclusions from the information presented. 6.65',
1708:'when the audit organization is subject to public records laws, auditors should determine whether public records laws could affect the',
1709:'availability of classified or limited use reports and determine whether other means of communicating with management and those charged with',
1710:'governance would be more appropriate. auditors use professional judgment to determine the appropriate means to communicate the omitted information to',
1711:'management and those charged with governance considering, among other things, whether public records laws could affect the availability of classified',
1712:'or limited use reports. application guidance: reporting confidential or sensitive information 6.66 if the report refers to the omitted information,',
1713:'the reference may be general and not specific. if the omitted information is not necessary to meet the audit objectives,',
1714:'the report need not refer to its omission. 6.67 certain information may be classified or may otherwise be prohibited from',
1715:'general disclosure by federal, state, or local laws or regulations. in such circumstances, auditors may issue a separate, classified, or',
1716:'limited use report containing such information and distribute the report only to persons authorized by law or regulation to receive',
1717:'it. 6.68 additional circumstances associated with public safety, privacy, or security concerns could also justify the exclusion of certain information',
1718:'from a publicly available or widely distributed report. for example, detailed information related to computer security for a particular program',
1719:'may be excluded from publicly available reports because of the potential damage that misuse of this information could cause. in',
1720:'such circumstances, auditors may issue a limited use report containing such information and distribute the report only to those parties',
1721:'responsible for acting on the auditors’ recommendations. in some instances, it may be appropriate to issue both a publicly available',
1722:'report with the sensitive information excluded and a limited use report. the auditors may consult with legal counsel regarding any',
1723:'requirements or other circumstances that may necessitate omitting certain information. considering the broad public interest in the program or activity',
1724:'under audit assists auditors when deciding whether to exclude certain information from publicly available reports. 6.69 in cases described in',
1725:'paragraph 6.65, the auditors may communicate general information in a written report and communicate detailed information orally. the auditors may',
1726:'consult with legal counsel regarding applicable public records laws. distributing reports requirement: distributing reports 6.70 distribution of reports completed in',
1727:'accordance with gagas depends on the auditors’ relationship with the audited entity and the nature of the information contained in',
1728:'the reports. auditors should document any limitation on report distribution. a. an audit organization in a government entity should distribute',
1729:'audit reports to those charged with governance, to the appropriate audited entity officials, and to the appropriate oversight bodies or',
1730:'organizations requiring or arranging for the audits. as appropriate, auditors should also distribute copies of the reports to other officials',
1731:'who have legal oversight authority or who may be responsible for acting on audit findings and recommendations and to others',
1732:'authorized to receive such reports. b. a public accounting firm contracted to conduct an audit in accordance with gagas should',
1733:'clarify report distribution responsibilities with the engaging party. if the contracting firm is responsible for the distribution, it should reach',
1734:'agreement with the party contracting for the audit about which officials or organizations will receive the report and the steps',
1735:'being taken to make the report available to the public. chapter 7: standards for attestation engagements and reviews of financial',
1736:'statements 7.01 this chapter contains requirements and guidance for conducting and reporting on attestation engagements and reviews of financial statements',
1737:'conducted in accordance with generally accepted government auditing standards gagas. for attestation engagements, gagas incorporates by reference the american institute',
1738:'of certified public accountants’ aicpa statements on standards for attestation engagements ssae. for reviews of financial statements, gagas incorporates by',
1739:'reference aicpa’s arc section 90, review of financial statements.49 all sections of the cited standards are incorporated, including the introduction,',
1740:'objectives, definitions, requirements, and application and other explanatory material. gagas does not incorporate the aicpa code of professional conduct by',
1741:'reference but recognizes that certain certified public accountants cpa may use or may be required to use the code in',
1742:'conjunction with gagas.50 for attestation engagements and reviews of financial statements conducted in accordance with gagas, the requirements and guidance',
1743:'in the respective incorporated standards and this chapter apply. the requirements and guidance contained in chapters 1 through 5 also',
1744:'apply. 49aicpa, professional standards. 50see para. 2.14 for a discussion of the aicpa code of professional conduct. 51see para. .08',
1745:'of atc section 205, para. .09 of atc section 210, and para. .14 of atc section 215; and para. .11',
1746:'of arc section 90 aicpa, professional standards. 7.02 an attestation engagement can provide one of three levels of service as',
1747:'defined by the aicpa: an examination engagement, a review engagement, or an agreedupon procedures engagement. 7.03 the aicpa standards used',
1748:'in conjunction with gagas require auditors to establish an understanding with the audited entity regarding the services to be performed',
1749:'for each attestation engagement or review of financial statements. such an understanding reduces the risk that either the auditors or',
1750:'the audited entity may misinterpret the needs or expectations of the other party. the understanding includes the objectives of the',
1751:'engagement, responsibilities of audited entity management, responsibilities of auditors, and limitations of the engagement.51 7.04 auditors often conduct gagas engagements',
1752:'under a contract with a party other than the officials of the audited entity or pursuant to a third party',
1753:'request. in such cases, auditors may also find it appropriate to communicate information regarding the services to be performed to',
1754:'the individuals contracting for or requesting the engagement. such an understanding can help auditors avoid any misunderstandings regarding the nature',
1755:'of the review or agreedupon procedures engagement. for example, a review engagement only provides limited assurance, and as a result,',
1756:'auditors do not perform sufficient work to be able to develop elements of a finding or provide recommendations that are',
1757:'common in other types of gagas engagements. an agreedupon procedures engagement does not provide an opinion or conclusion, and as',
1758:'a result, auditors do not perform sufficient work to be able to develop elements of a finding or provide recommendations',
1759:'that are common in other types of gagas engagements. consequently, requesting parties may find that a different type of attestation',
1760:'engagement or a performance audit may provide the appropriate level of assurance to meet their needs. examination engagements compliance with',
1761:'standards requirement: compliance with standards 7.05 gagas establishes requirements for examination engagements in addition to the requirements for examinations contained',
1762:'in the aicpa’s ssaes. auditors should comply with these additional requirements, along with the aicpa requirements for examination engagements, when',
1763:'citing gagas in their examination engagement reports. application guidance: compliance with standards 7.06 the aicpa standards applicable to examinations require',
1764:'the auditors to apply the concept of materiality appropriately in planning and performing the examination. additional considerations may apply to',
1765:'gagas engagements that concern government entities or entities that receive government awards. for example, for engagements conducted in accordance with',
1766:'gagas, auditors may find it appropriate to use lower materiality levels than those used in nongagas engagements because of the',
1767:'public accountability of government entities and entities receiving government funding, various legal and regulatory requirements, and the visibility and sensitivity',
1768:'of government programs. licensing and certification requirements: licensing and certification 7.07 auditors engaged to conduct examination engagements in the united',
1769:'states who do not work for a government audit organization should be licensed cpas, persons working for licensed certified public',
1770:'accounting firms, or licensed accountants in states that have multiclass licensing systems that recognize licensed accountants other than cpas. 7.08',
1771:'auditors engaged to conduct examination engagements of entities operating outside of the united states who do not work for a',
1772:'government audit organization should meet the qualifications indicated in paragraph 7.07, have certifications that meet all applicable national and international',
1773:'standards and serve in their respective countries as the functional equivalent of cpas in the united states, or work for',
1774:'nongovernment audit organizations that are the functional equivalent of licensed certified public accounting firms in the united states. auditor communication',
1775:'requirements: auditor communication 7.09 if the law or regulation requiring an examination engagement specifically identifies the entities to be examined,',
1776:'auditors should communicate pertinent information that in the auditors’ professional judgment needs to be communicated both to individuals contracting for',
1777:'or requesting the examination and to those legislative committees, if any, that have ongoing oversight responsibilities for the audited entity.',
1778:'7.10 if the identity of those charged with governance is not clearly evident, auditors should document the process followed and',
1779:'conclusions reached in identifying the appropriate individuals to receive the required communications. application guidance: auditor communication 7.11 for some matters,',
1780:'early communication to those charged with governance or management may be important because of the relative significance and the urgency',
1781:'for corrective followup action. further, early communication is important to allow management to take prompt corrective action to prevent further',
1782:'occurrences when a control deficiency results in identified or suspected noncompliance with provisions of laws, regulations, contracts, and grant agreements',
1783:'or identified or suspected fraud. when a deficiency is communicated early, the reporting requirements and application guidance in paragraphs 7.39',
1784:'through 7.47 still apply. 7.12 because the governance structures of government entities and organizations can vary widely, it may not',
1785:'always be clearly evident who is charged with key governance functions. the process for identifying those charged with governance includes',
1786:'evaluating the organizational structure for directing and controlling operations to achieve the audited entity’s objectives and how the audited entity',
1787:'delegates authority and establishes accountability for management. results of previous engagements requirement: results of previous engagements 7.13 when planning a',
1788:'gagas examination engagement, auditors should ask management of the audited entity to identify previous audits, attestation engagements, and other studies',
1789:'that directly relate to the subject matter or an assertion about the subject matter of the examination engagement, including whether',
1790:'related recommendations have been implemented. auditors should evaluate whether the audited entity has taken appropriate corrective action to address findings',
1791:'and recommendations from previous engagements that could have a significant effect on the subject matter or an assertion about the',
1792:'subject matter. auditors should use this information in assessing risk and determining the nature, timing, and extent of current work',
1793:'and determining the extent to which testing the implementation of the corrective actions is applicable to the current examination engagement',
1794:'objectives. investigations or legal proceedings requirement: investigations or legal proceedings 7.14 auditors should inquire of management of the audited entity',
1795:'whether any investigations or legal proceedings significant to the engagement objectives have been initiated or are in process with respect',
1796:'to the period under examination, and should evaluate the effect of initiated or inprocess investigations or legal proceedings on the',
1797:'current examination engagement. application guidance: investigations or legal proceedings 7.15 laws, regulations, or policies may require auditors to report indications',
1798:'of certain types of fraud or noncompliance with provisions of laws, regulations, contracts, and grant agreements to law enforcement or',
1799:'investigatory authorities before performing additional examination procedures. 7.16 avoiding interference with investigations or legal proceedings is important in pursuing indications',
1800:'of fraud and noncompliance with provisions of laws, regulations, contracts, and grant agreements. in some cases, it may be appropriate',
1801:'for the auditors to work with investigators or legal authorities or to withdraw from or defer further work on the',
1802:'attestation engagement or a portion of the engagement to avoid interfering with an ongoing investigation or legal proceeding. noncompliance with',
1803:'provisions of laws, regulations, contracts, and grant agreements requirement: noncompliance with provisions of laws, regulations, contracts, and grant agreements 7.17',
1804:'auditors should extend the aicpa requirements concerning consideration of noncompliance with laws and regulations to include consideration of noncompliance with',
1805:'provisions of contracts and grant agreements.52 52see paras. .32 and .33 of atc section 205 aicpa, professional standards. application guidance:',
1806:'noncompliance with provisions of laws, regulations, contracts, and grant agreements 7.18 government programs are subject to provisions of many laws,',
1807:'regulations, contracts, and grant agreements. at the same time, these provisions’ significance within the context of the engagement objectives varies',
1808:'widely, depending on the objectives of the engagement. auditors may consult with their legal counsel to 1 determine those laws',
1809:'and regulations that are significant to the examination objectives, 2 design tests of compliance with laws and regulations, and 3',
1810:'evaluate the results of those tests. auditors also may consult with their legal counsel when engagement objectives require testing compliance',
1811:'with provisions of contracts or grant agreements. depending on the circumstances of the engagement, auditors may consult with others—such as',
1812:'investigative staff, other audit organizations or government entities that provided professional services to the audited entity, or applicable law enforcement',
1813:'authorities—to obtain information on compliance matters. findings requirements: findings 7.19 when auditors identify findings, they should plan and perform procedures',
1814:'to develop the criteria, condition, cause, and effect of the findings to the extent that these elements are relevant and',
1815:'necessary to achieve the examination objectives. 7.20 auditors should consider internal control deficiencies in their evaluation of identified findings when',
1816:'developing the cause element of the identified findings. application guidance: findings 7.21 findings may involve deficiencies in internal control; noncompliance',
1817:'with provisions of laws, regulations, contracts, and grant agreements; or instances of fraud. 7.22 given the concept of accountability for',
1818:'use of public resources and government authority, evaluating internal control in a government environment may also include considering internal control',
1819:'deficiencies that result in waste or abuse. because the determination of waste and abuse is subjective, auditors are not required',
1820:'to perform specific procedures to detect waste or abuse in examinations. however, auditors may consider whether and how to communicate',
1821:'such matters if they become aware of them. auditors may also discover that waste or abuse are indicative of fraud',
1822:'or noncompliance with provisions of laws, regulations, contracts, and grant agreements. 7.23 waste is the act of using or expending',
1823:'resources carelessly, extravagantly, or to no purpose. importantly, waste can include activities that do not include abuse and does not',
1824:'necessarily involve a violation of law. rather, waste relates primarily to mismanagement, inappropriate actions, and inadequate oversight. 7.24 the following',
1825:'are examples of waste, depending on the facts and circumstances: a. making travel choices that are contrary to existing travel',
1826:'policies or are unnecessarily extravagant or expensive. b. making procurement or vendor selections that are contrary to existing policies or',
1827:'are unnecessarily extravagant or expensive. 7.25 abuse is behavior that is deficient or improper when compared with behavior that a',
1828:'prudent person would consider reasonable and necessary business practice given the facts and circumstances, but excludes fraud and noncompliance with',
1829:'provisions of laws, regulations, contracts, and grant agreements. abuse also includes misuse of authority or position for personal financial interests',
1830:'or those of an immediate or close family member or business associate. 7.26 the following are examples of abuse, depending',
1831:'on the facts and circumstances: a. creating unneeded overtime. b. requesting staff to perform personal errands or work tasks for',
1832:'a supervisor or manager. c. misusing the official’s position for personal gain including actions that could be perceived by an',
1833:'objective third party with knowledge of the relevant information as improperly benefiting an official’s personal financial interests or those of',
1834:'an immediate or close family member; a general partner; an organization for which the official serves as an officer, director,',
1835:'trustee, or employee; or an organization with which the official is negotiating concerning future employment. 7.27 criteria: for inclusion in',
1836:'findings, criteria may include the laws, regulations, contracts, grant agreements, standards, measures, expected performance, defined business practices, and benchmarks against',
1837:'which performance is compared or evaluated. criteria identify the required or desired state or expectation with respect to the program',
1838:'or operation. criteria provide a context for evaluating evidence and understanding the findings, conclusions, and recommendations in the report. 7.28',
1839:'condition: condition is a situation that exists. the condition is determined and documented during the attestation engagement. 7.29 cause: the',
1840:'cause is the factor or factors responsible for the difference between the condition and the criteria, and may also serve',
1841:'as a basis for recommendations for corrective actions. common factors include poorly designed policies, procedures, or criteria; inconsistent, incomplete, or',
1842:'incorrect implementation; or factors beyond the control of program management. auditors may assess whether the evidence provides a reasonable and',
1843:'convincing argument for why the stated cause is the key factor contributing to the difference between the condition and the',
1844:'criteria. 7.30 effect or potential effect: the effect or potential effect is the outcome or consequence resulting from the difference',
1845:'between the condition and the criteria. when the engagement objectives include identifying the actual or potential consequences of a condition',
1846:'that varies either positively or negatively from the criteria identified in the engagement, effect is a measure of those consequences.',
1847:'effect or potential effect may be used to demonstrate the need for corrective action in response to identified problems or',
1848:'relevant risks. 7.31 regardless of the type of finding identified, the cause of a finding may relate to an underlying',
1849:'internal control deficiency. depending on the magnitude of impact, likelihood of occurrence, and nature of the deficiency, this deficiency could',
1850:'be a significant deficiency or a material weakness. 7.32 considering internal control in the context of a comprehensive internal control',
1851:'framework, such as standards for internal control in the federal government or internal control—integrated framework,53 can 53the committee of sponsoring',
1852:'organizations of the treadway commission’s internal control—integrated framework and standards for internal control in the federal government gao14704g provide suitable',
1853:'and available criteria against which management may evaluate and report on the effectiveness of the entity’s internal control. standards for',
1854:'internal control in the federal government may be adopted by entities beyond those federal entities for which it is legally',
1855:'required, such as state, local, and quasigovernmental entities, as well as other federal entities and notforprofit organizations, as a framework',
1856:'for an internal control system. help auditors to determine whether underlying internal control deficiencies exist as the root cause of',
1857:'findings. identifying these deficiencies can help provide the basis for developing meaningful recommendations for corrective actions. examination engagement documentation requirements:',
1858:'examination engagement documentation 7.33 auditors should comply with the following documentation requirements. a. before the date of the examination report,',
1859:'document supervisory review of the evidence that supports the findings, conclusions, and recommendations contained in the examination report. b. document',
1860:'any departures from the gagas requirements and the effect on the examination engagement and on the auditors’ conclusions when the',
1861:'examination engagement does not comply with applicable gagas requirements because of law, regulation, scope limitations, restrictions on access to records,',
1862:'or other issues affecting the examination engagement. 7.34 in addition to the requirements of the examination engagement standards used in',
1863:'conjunction with gagas, auditors should prepare attest documentation in sufficient detail to enable an experienced auditor, having no previous connection',
1864:'to the examination engagement, to understand from the documentation the nature, timing, extent, and results of procedures performed and the',
1865:'evidence obtained and its source and the conclusions reached, including evidence that supports the auditors’ significant judgments and conclusions. application',
1866:'guidance: examination engagement documentation 7.35 when documenting departures from the gagas requirements where alternative procedures performed were not sufficient to',
1867:'achieve the objectives of the requirements, the examination engagement documentation requirements apply to departures from unconditional requirements and presumptively mandatory',
1868:'requirements. 7.36 an experienced auditor is an individual who possesses the competencies and skills to be able to conduct the',
1869:'examination engagement. these competencies and skills include an understanding of 1 examination engagement processes and related examination standards, 2 gagas',
1870:'and applicable legal and regulatory requirements, 3 the subject matter on which the auditors are engaged to report, 4 the',
1871:'suitability and availability of criteria, and 5 issues related to the audited entity’s environment. availability of individuals and documentation requirement:',
1872:'availability of individuals and documentation 7.37 subject to applicable provisions of laws and regulations, auditors should make appropriate individuals and',
1873:'examination engagement documentation available upon request and in a timely manner to other auditors or reviewers. application guidance: availability of',
1874:'individuals and documentation 7.38 underlying gagas examination engagements is the premise that audit organizations in federal, state, and local governments',
1875:'and public accounting firms engaged to conduct examination engagements in accordance with gagas cooperate in evaluating programs of common interest',
1876:'so that auditors may use others’ work and avoid duplication of efforts. the use of auditors’ work by other auditors',
1877:'may be facilitated by contractual arrangements for gagas engagements that provide for full and timely access to appropriate individuals and',
1878:'to engagement documentation. reporting the auditors’ compliance with gagas requirements: reporting the auditors’ compliance with gagas 7.39 when auditors comply',
1879:'with all applicable gagas requirements, they should include a statement in the report that they conducted the examination in accordance',
1880:'with gagas.54 7.40 if auditors report separately including separate reports bound in the same document on deficiencies in internal control;',
1881:'noncompliance with provisions of laws, regulations, contracts, and grant agreements; 54see paras. 2.16 through 2.19 for information on the gagas',
1882:'compliance statement. or instances of fraud, they should state in the examination report that they are issuing those additional reports.',
1883:'they should include a reference to the separate reports and also state that the reports are an integral part of',
1884:'a gagas examination engagement. application guidance: reporting the auditors’ compliance with gagas 7.41 because gagas incorporates by reference the aicpa’s',
1885:'attestation standards, gagas does not require auditors to cite compliance with the aicpa standards when citing compliance with gagas. gagas',
1886:'does not prohibit auditors from issuing a separate report conforming only to the requirements of the aicpa or other standards.',
1887:'reporting deficiencies in internal control requirement: reporting deficiencies in internal control 7.42 auditors should include in the examination report all',
1888:'internal control deficiencies, even those communicated early, that are considered to be significant deficiencies or material weaknesses that the auditors',
1889:'identified based on the engagement work performed.55 55gagas’s use of internal control terminology is consistent with the definitions contained in',
1890:'auc section 265 aicpa, professional standards. application guidance: reporting deficiencies in internal control 7.43 determining whether and how to communicate',
1891:'to officials of the audited entity internal control deficiencies that are not considered significant deficiencies or material weaknesses is a',
1892:'matter of professional judgment. reporting on noncompliance with provisions of laws, regulations, contracts, and grant agreements or instances of fraud',
1893:'requirements: reporting on noncompliance with provisions of laws, regulations, contracts, and grant agreements or instances of fraud 7.44 auditors should',
1894:'include in their examination report the relevant information about noncompliance and fraud when auditors, based on sufficient, appropriate evidence, identify',
1895:'or suspect a. noncompliance with provisions of laws, regulations, contracts, or grant agreements that has a material effect on the',
1896:'subject matter or an assertion about the subject matter or b. fraud that is material, either quantitatively or qualitatively, to',
1897:'the subject matter or an assertion about the subject matter that is significant to the engagement objectives. 7.45 when auditors',
1898:'identify or suspect noncompliance with provisions of laws, regulations, contracts, or grant agreements or instances of fraud that have an',
1899:'effect on the subject matter or an assertion about the subject matter that are less than material but warrant the',
1900:'attention of those charged with governance, they should communicate in writing to audited entity officials. application guidance: reporting on noncompliance',
1901:'with provisions of laws, regulations, contracts, or grant agreements or instances of fraud 7.46 when auditors identify or suspect noncompliance',
1902:'with provisions of laws, regulations, contracts, or grant agreements or instances of fraud that do not warrant the attention of',
1903:'those charged with governance, the auditors’ determination of whether and how to communicate such instances to audited entity officials is',
1904:'a matter of professional judgment. 7.47 when auditors identify or suspect noncompliance with provisions of laws, regulations, contracts, or grant',
1905:'agreements or instances of fraud, auditors may consult with authorities or legal counsel about whether publicly reporting such information would',
1906:'compromise investigative or legal proceedings. auditors may limit their public reporting to matters that would not compromise those proceedings and,',
1907:'for example, report only on information that is already a part of the public record. presenting findings in the report',
1908:'requirements: presenting findings in the report 7.48 when presenting findings, auditors should develop the elements of the findings to the',
1909:'extent necessary to assist management or oversight officials of the audited entity in understanding the need for taking corrective action.',
1910:'7.49 auditors should place their findings in perspective by describing the nature and extent of the issues being reported and',
1911:'the extent of the work performed that resulted in the findings. to give the reader a basis for judging the',
1912:'prevalence and consequences of the findings, auditors should, as appropriate, relate the instances identified to the population or the number',
1913:'of cases examined and quantify the results in terms of dollar value or other measures. if the results cannot be',
1914:'projected, auditors should limit their conclusions appropriately. application guidance: presenting findings in the report 7.50 along with assisting management or',
1915:'oversight officials of the audited entity in understanding the need for taking corrective action, clearly developed findings assist auditors in',
1916:'making recommendations for corrective action. if auditors sufficiently develop the elements of a finding, they may provide recommendations for corrective',
1917:'action. reporting findings directly to parties outside the audited entity requirements: reporting findings directly to parties outside the audited entity',
1918:'7.51 auditors should report identified or suspected noncompliance with provisions of laws, regulations, contracts, and grant agreements and instances of',
1919:'fraud directly to parties outside the audited entity in the following two circumstances. a. when audited entity management fails to',
1920:'satisfy legal or regulatory requirements to report such information to external parties specified in law or regulation, auditors should first',
1921:'communicate the failure to report such information to those charged with governance. if the audited entity still does not report',
1922:'this information to the specified external parties as soon as practicable after the auditors’ communication with those charged with governance,',
1923:'then the auditors should report the information directly to the specified external parties. b. when audited entity management fails to',
1924:'take timely and appropriate steps to respond to fraud or noncompliance with provisions of laws, regulations, contracts, and grant agreements',
1925:'that 1 is likely to have a material effect on the subject matter and 2 involves funding received directly or',
1926:'indirectly from a government agency, auditors should first report management’s failure to take timely and appropriate steps to those charged',
1927:'with governance. if the audited entity still does not take timely and appropriate steps as soon as practicable after the',
1928:'auditors’ communication with those charged with governance, then the auditors should report the audited entity’s failure to take timely and',
1929:'appropriate steps directly to the funding agency. 7.52 auditors should comply with the requirements in paragraph 7.51 even if they',
1930:'have resigned or been dismissed from the engagement prior to its completion. 7.53 auditors should obtain sufficient, appropriate evidence, such',
1931:'as confirmation from outside parties, to corroborate representations by management of the audited entity that it has reported engagement findings',
1932:'in accordance with laws, regulations, or funding agreements. when auditors are unable to do so, they should report such information',
1933:'directly, as discussed in paragraphs 7.51 and 7.52. application guidance: reporting findings directly to parties outside the audited entity 7.54',
1934:'the reporting in paragraph 7.51 is in addition to any legal requirements to report such information directly to parties outside',
1935:'the audited entity. obtaining and reporting the views of responsible officials requirements: obtaining and reporting the views of responsible officials',
1936:'7.55 auditors should obtain and report the views of responsible officials of the audited entity concerning the findings, conclusions, and',
1937:'recommendations in the examination report, as well as any planned corrective actions. 7.56 when auditors receive written comments from the',
1938:'responsible officials, they should include in their report a copy of the officials’ written comments or a summary of the',
1939:'comments received. when the responsible officials provide oral comments only, auditors should prepare a summary of the oral comments, provide',
1940:'a copy of the summary to the responsible officials to verify that the comments are accurately represented, and include the',
1941:'summary in their report. 7.57 when the audited entity’s comments are inconsistent or in conflict with the findings, conclusions, or',
1942:'recommendations in the draft report, the auditors should evaluate the validity of the audited entity’s comments. if the auditors disagree',
1943:'with the comments, they should explain in the report their reasons for disagreement. conversely, the auditors should modify their report',
1944:'as necessary if they find the comments valid and supported by sufficient, appropriate evidence. 7.58 if the audited entity refuses',
1945:'to provide comments or is unable to provide comments within a reasonable period of time, the auditors should issue the',
1946:'report without receiving comments from the audited entity. in such cases, the auditors should indicate in the report that the',
1947:'audited entity did not provide comments. application guidance: obtaining and reporting the views of responsible officials 7.59 providing a draft',
1948:'report with findings for review and comment by responsible officials of the audited entity and others helps the auditors develop',
1949:'a report that is fair, complete, and objective. including the views of responsible officials results in a report that presents',
1950:'not only the auditors’ findings, conclusions, and recommendations but also the perspectives of the audited entity’s responsible officials and the',
1951:'corrective actions they plan to take. obtaining the comments in writing is preferred, but oral comments are acceptable. when the',
1952:'audited entity provides technical comments in addition to its written or oral comments on the report, auditors may disclose in',
1953:'the report that such comments were received. technical comments address points of fact or are editorial in nature and do',
1954:'not address substantive issues, such as methodology, findings, conclusions, or recommendations. 7.60 obtaining oral comments may be appropriate when, for',
1955:'example, there is a reporting date critical to meeting a user’s needs; auditors have worked closely with the responsible officials',
1956:'throughout the engagement, and the parties are familiar with the findings and issues addressed in the draft report; or the',
1957:'auditors do not expect major disagreements with findings, conclusions, or recommendations in the draft report or major controversies with regard',
1958:'to the issues discussed in the draft report. reporting confidential or sensitive information requirements: reporting confidential or sensitive information 7.61',
1959:'if certain information is prohibited from public disclosure or is excluded from a report because of its confidential or sensitive',
1960:'nature, auditors should disclose in the report that certain information has been omitted and the circumstances that make the omission',
1961:'necessary. 7.62 when circumstances call for omission of certain information, auditors should evaluate whether the omission could distort the examination',
1962:'engagement results or conceal improper or illegal practices and revise the report language as necessary to avoid report users drawing',
1963:'inappropriate conclusions from the information presented. 7.63 when the audit organization is subject to public records laws, auditors should determine',
1964:'whether public records laws could affect the availability of classified or limited use reports and determine whether other means of',
1965:'communicating with management and those charged with governance would be more appropriate. auditors use professional judgment to determine the appropriate',
1966:'means to communicate the omitted information to management and those charged with governance considering, among other things, whether public records',
1967:'laws could affect the availability of classified or limited use reports. application guidance: reporting confidential or sensitive information 7.64 if',
1968:'the report refers to the omitted information, the reference may be general and not specific. if the omitted information is',
1969:'not necessary to meet the engagement objectives, the report need not refer to its omission. 7.65 certain information may be',
1970:'classified or may otherwise be prohibited from general disclosure by federal, state, or local laws or regulations. in such circumstances,',
1971:'auditors may issue a separate, classified, or limited use report containing such information and distribute the report only to persons',
1972:'authorized by law or regulation to receive it. 7.66 additional circumstances associated with public safety, privacy, or security concerns could',
1973:'also justify the exclusion of certain information from a publicly available or widely distributed report. for example, detailed information related',
1974:'to computer security for a particular program may be excluded from publicly available reports because of the potential damage that',
1975:'misuse of this information could cause. in such circumstances, auditors may issue a limited use report containing such information and',
1976:'distribute the report only to those parties responsible for acting on the auditors’ recommendations. in some instances, it may be',
1977:'appropriate to issue both a publicly available report with the sensitive information excluded and a limited use report. the auditors',
1978:'may consult with legal counsel regarding any requirements or other circumstances that may necessitate omitting certain information. 7.67 considering the',
1979:'broad public interest in the program or activity under examination assists auditors when deciding whether to exclude certain information from',
1980:'publicly available reports. 7.68 in cases described in paragraph 7.63, the auditors may communicate general information in a written report',
1981:'and communicate detailed information orally. the auditors may consult with legal counsel regarding applicable public records laws. distributing reports requirement:',
1982:'distributing reports 7.69 distribution of reports completed in accordance with gagas depends on the auditors’ relationship with the audited organization',
1983:'and the nature of the information contained in the reports. auditors should document any limitation on report distribution. a. an',
1984:'audit organization in a government entity should distribute reports to those charged with governance, to the appropriate audited entity officials,',
1985:'and to the appropriate oversight bodies or organizations requiring or arranging for the examination engagements. as appropriate, auditors should also',
1986:'distribute copies of the reports to other officials who have legal oversight authority or who may be responsible for acting',
1987:'on engagement findings and recommendations and to others authorized to receive such reports. b. a public accounting firm contracted to',
1988:'conduct an examination engagement in accordance with gagas should clarify report distribution responsibilities with the engaging party. if the contracting',
1989:'firm is responsible for the distribution, it should reach agreement with the party contracting for the examination engagement about which',
1990:'officials or organizations will receive the report and the steps being taken to make the report available to the public.',
1991:'review engagements compliance with standards requirement: compliance with standards 7.70 gagas establishes requirements for review engagements in addition to the',
1992:'requirements for reviews contained in the aicpa’s ssaes. auditors should comply with the additional gagas requirements, along with the applicable',
1993:'aicpa requirements, when citing gagas in their review engagement reports. licensing and certification requirements: licensing and certification 7.71 auditors engaged',
1994:'to conduct review engagements in the united states who do not work for a government audit organization should be licensed',
1995:'cpas, persons working for licensed certified public accounting firms, or licensed accountants in states that have multiclass licensing systems that',
1996:'recognize licensed accountants other than cpas. 7.72 auditors engaged to conduct review engagements of entities operating outside of the united',
1997:'states who do not work for a government audit organization should meet the qualifications indicated in paragraph 7.71, have certifications',
1998:'that meet all applicable national and international standards and serve in their respective countries as the functional equivalent of cpas',
1999:'in the united states, or work for nongovernment audit organizations that are the functional equivalent of licensed certified public accounting',
2000:'firms in the united states. noncompliance with provisions of laws, regulations, contracts, and grant agreements requirement: noncompliance with provisions of',
2001:'laws, regulations, contracts, and grant agreements 7.73 auditors should extend the aicpa requirements concerning consideration of noncompliance with laws and',
2002:'regulations to include consideration of noncompliance with provisions of contracts and grant agreements.56 56see paras. .23 and .24 of atc',
2003:'section 210 aicpa, professional standards. 57see paras. 2.16 through 2.19 for information on the gagas compliance statement. reporting auditors’ compliance',
2004:'with gagas requirement: reporting auditors’ compliance with gagas 7.74 when auditors comply with all applicable requirements for a review engagement',
2005:'conducted in accordance with gagas, they should include a statement in the review report that they conducted the engagement in',
2006:'accordance with gagas.57 application guidance: reporting auditors’ compliance with gagas 7.75 because gagas incorporates by reference the aicpa’s attestation standards,',
2007:'gagas does not require auditors to cite compliance with the aicpa standards when they cite compliance with gagas. gagas does',
2008:'not prohibit auditors from issuing a separate report conforming only to the requirements of the aicpa or other standards setters.',
2009:'7.76 because review engagements are substantially less in scope than audits and examination engagements, it is important to include all',
2010:'required reporting elements contained in the standards used in conjunction with gagas. for example, a required element of the review',
2011:'report under ssaes is a statement that a review is substantially less in scope than an examination, the objective of',
2012:'which is to express an opinion on the subject matter, and accordingly, no such opinion is expressed.58 including only those',
2013:'elements that the reporting standards for review engagements require or permit helps ensure that auditors comply with the standards and',
2014:'that users of gagas reports have an understanding of the nature of the work performed and the results of the',
2015:'review engagement. 58see para. .46fiii of atc section 210 aicpa, professional standards. distributing reports requirement: distributing reports 7.77 distribution of',
2016:'reports completed in accordance with gagas depends on the auditors’ relationship with the audited organization and the nature of the',
2017:'information contained in the reports. if the subject matter or the assertion involves material that is classified or contains confidential',
2018:'or sensitive information, auditors should limit report distribution. auditors should document any limitation on report distribution. a. an audit organization',
2019:'in a government entity should distribute reports to those charged with governance, to the appropriate audited entity officials, and to',
2020:'the appropriate oversight bodies or organizations requiring or arranging for the engagements. as appropriate, auditors should also distribute copies of',
2021:'the reports to other officials who have legal oversight authority and to others authorized to receive such reports. b. a',
2022:'public accounting firm contracted to conduct a review engagement in accordance with gagas should clarify report distribution responsibilities with the',
2023:'engaging party. if the contracting firm is responsible for the distribution, it should reach agreement with the party contracting for',
2024:'the engagement about which officials or organizations will receive the report and the steps being taken to make the report',
2025:'available to the public. agreedupon procedures engagements compliance with standards requirement: compliance with standards 7.78 gagas establishes requirements for agreedupon',
2026:'procedures engagements in addition to the requirements for agreedupon procedures engagements contained in the aicpa’s ssaes. auditors should comply with',
2027:'the additional gagas requirements, along with the applicable aicpa requirements, when citing gagas in their agreed upon procedures engagement reports.',
2028:'licensing and certification requirements: licensing and certification 7.79 auditors engaged to conduct agreedupon procedures engagements in the united states who',
2029:'do not work for a government audit organization should be licensed cpas, persons working for licensed certified public accounting firms,',
2030:'or licensed accountants in states that have multiclass licensing systems that recognize licensed accountants other than cpas. 7.80 auditors engaged',
2031:'to conduct agreedupon procedures engagements of entities operating outside of the united states who do not work for a government',
2032:'audit organization should meet the qualifications indicated in paragraph 7.79, have certifications that meet all applicable national and international standards',
2033:'and serve in their respective countries as the functional equivalent of cpas in the united states, or work for nongovernment',
2034:'audit organizations that are the functional equivalent of licensed certified public accounting firms in the united states. noncompliance with provisions',
2035:'of laws, regulations, contracts, and grant agreements requirement: noncompliance with provisions of laws, regulations, contracts, and grant agreements 7.81 auditors',
2036:'should extend the aicpa requirements concerning consideration of noncompliance with laws and regulations to include consideration of noncompliance with provisions',
2037:'of contracts and grant agreements.59 59see para. .42 of atc section 215 aicpa, professional standards. 60see paras. 2.16 through 2.19',
2038:'for information on the gagas compliance statement. reporting auditors’ compliance with gagas requirement: reporting auditors’ compliance with gagas 7.82 when',
2039:'auditors comply with all applicable gagas requirements for agreedupon procedures engagements, they should include a statement in the agreedupon procedures',
2040:'engagement report that they conducted the engagement in accordance with gagas.60 application guidance: reporting auditors’ compliance with gagas 7.83 because',
2041:'gagas incorporates by reference the aicpa’s attestation standards, gagas does not require auditors to cite compliance with the aicpa standards',
2042:'when citing compliance with gagas. gagas does not prohibit auditors from issuing a separate report conforming only to the requirements',
2043:'of the aicpa or other standards. 7.84 because agreedupon procedures engagements are substantially less in scope than audits and examination',
2044:'engagements, it is important not to deviate from the required reporting elements contained in the attestation standards incorporated by reference',
2045:'in gagas, other than chapter 7: standardsforattestationengagements and reviews of financialstatements distributing reports including the reference to gagas. for example,',
2046:'a required element of the report on agreedupon procedures is a statement that the auditorswere not engaged to and did',
2047:'not conduct an examination or a review of the subject matter, the objective of which would be the expression of',
2048:'anopinion or a conclusion, respectively, and that had the auditors performed additional procedures, other matters may have come to their',
2049:'attention that would have been reported.61another required element isa statement that the sufficiency of the procedures is solely the responsibility',
2050:'of the parties specified in the report and a disclaimer of responsibility forsufficiency of those procedures.62including only those elements that',
2051:'the aicpa reporting standards for agreedupon procedures engagementsrequire or permit helps ensure that auditors comply with the aicpastandards and that',
2052:'users of gagasreports understand the nature of the work performed and the results of the agreedupon proceduresengagement. requirement: distributing reports',
2053:'7.85distribution of reports completed in accordance with gagasdepends on the auditors’relationship with the audited organization and the nature of the',
2054:'information contained in the reports. if the subject matter or the assertion involves material that isclassified orcontainsconfidentialor sensitive information, auditors',
2055:'should limit thereport distribution. auditors should document any limitation on report distribution. a.an audit organization in a government entity should',
2056:'distribute reports to those charged with governance, to the appropriate audited entity officials, and to the appropriate oversight bodiesororganizations requiring',
2057:'or arranging for the engagements.asappropriate, auditors should also distribute copies of the reports to other officialswho have legal oversight authority',
2058:'and to others authorized to receive such reports. b.apublic accounting firm contracted to conduct an agreedupon procedures engagement in accordance',
2059:'with gagas should 61see para. .35j of atc section 215 aicpa,professional standards. 62see para. .35g of atc section 215 aicpa,professionalstandards.',
2060:'page 149gao21368ggovernment auditing standards clarify report distribution responsibilities with the engaging party. if the contracting firm is responsible for the',
2061:'distribution, it should reach agreement with the party contracting for the engagement about which officials or organizations will receive the',
2062:'report and the steps being taken to make the report available to the public. reviews of financial statements compliance with',
2063:'standards requirement: compliance with standards 7.86 gagas establishes requirements for reviews of financial statements in addition to the requirements for',
2064:'reviews of financial statements contained in the aicpa’s arc section 90, review of financial statements.63 auditors should comply with the',
2065:'additional gagas requirements, along with the applicable aicpa requirements, when citing gagas in their review engagement reports. 63aicpa, professional standards.',
2066:'licensing and certification requirements: licensing and certification 7.87 auditors engaged to conduct reviews of financial statements in the united states',
2067:'who do not work for a government audit organization should be licensed cpas, persons working for licensed certified public accounting',
2068:'firms, or licensed accountants in states that have multiclass licensing systems that recognize licensed accountants other than cpas. 7.88 auditors',
2069:'engaged to conduct reviews of financial statements of entities operating outside of the united states who do not work for',
2070:'a government audit organization should meet the qualifications indicated in paragraph 7.87, have certifications that meet all applicable national and',
2071:'international standards and serve in their respective countries as the functional equivalent of cpas in the united states, or work',
2072:'for nongovernment audit organizations that are the functional equivalent of licensed certified public accounting firms in the united states. noncompliance',
2073:'with provisions of laws, regulations, contracts, and grant agreements requirement: noncompliance with provisions of laws, regulations, contracts, and grant agreements',
2074:'7.89 auditors should extend the aicpa requirements concerning consideration of noncompliance with laws and regulations to include consideration of noncompliance',
2075:'with provisions of contracts and grant agreements.64 64see para. .51 of arc section 90 aicpa, professional standards. 65see paras. 2.16',
2076:'through 2.19 for information on the gagas compliance statement. 66aicpa, professional standards. reporting auditors’ compliance with gagas requirement: reporting auditors’',
2077:'compliance with gagas 7.90 when auditors comply with all applicable requirements for a review of financial statements conducted in accordance',
2078:'with gagas, they should include a statement in the report that they conducted the engagement in accordance with gagas.65 application',
2079:'guidance: reporting auditors’ compliance with gagas 7.91 because gagas incorporates by reference the aicpa’s arc section 90, review of financial',
2080:'statements,66 gagas does not require auditors to cite compliance with the aicpa standards when they cite compliance with gagas. gagas',
2081:'does not prohibit auditors from issuing a separate report conforming only to the requirements of the aicpa or other standards',
2082:'setters. 7.92 because reviews of financial statements are substantially less in scope than audits and examination engagements, it is important',
2083:'to include all required reporting elements contained in the standards used in conjunction with gagas. for example, a required reporting',
2084:'element of the review of financial statements under arc section 90, review of financial statements,67 is to include a statement',
2085:'that a review is substantially less in scope than an audit, the objective of which is the expression of an',
2086:'opinion regarding the financial statements as a whole and that accordingly the accountant does not express such an opinion.68 including',
2087:'only those elements that the reporting standards for review of financial statements engagements require or permit helps ensure that auditors',
2088:'comply with the standards and that users of gagas reports have an understanding of the nature of the work performed',
2089:'and the results of the review engagement. 67aicpa, professional standards. 68see para. .39cvi of arc section 90 aicpa, professional standards.',
2090:'distributing reports requirement: distributing reports 7.93 distribution of reports completed in accordance with gagas depends on the auditors’ relationship with',
2091:'the audited organization and the nature of the information contained in the reports. if the subject matter involves material that',
2092:'is classified or contains confidential or sensitive information, auditors should limit report distribution. auditors should document any limitation on report',
2093:'distribution. a. an audit organization in a government entity should distribute reports to those charged with governance, to the appropriate',
2094:'audited entity officials, and to the appropriate oversight bodies or organizations requiring or arranging for the engagements. as appropriate, auditors',
2095:'should also distribute copies of the reports to other officials who have legal oversight authority and to others authorized to',
2096:'receive such reports. b. a public accounting firm contracted to conduct a review of financial statements engagement in accordance with',
2097:'gagas should clarify report distribution responsibilities with the engaging party. if the contracting firm is responsible for the distribution, it',
2098:'should reach agreement with the party contracting for the engagement about which officials or organizations will receive the report and',
2099:'the steps being taken to make the report available to the public. chapter 8: fieldwork standards for performance audits 8.01',
2100:'this chapter contains fieldwork requirements and guidance for performance audits conducted in accordance with generally accepted government auditing standards gagas.',
2101:'fieldwork requirements establish an overall approach for auditors to apply in planning and performing an audit to obtain sufficient, appropriate',
2102:'evidence that provides a reasonable basis for findings and conclusions based on the audit objectives. for performance audits conducted in',
2103:'accordance with gagas, the requirements and guidance in chapters 1 through 5 and chapter 9 also apply. 8.02 the fieldwork',
2104:'requirements for performance audits relate to planning the audit; conducting the engagement; supervising staff; obtaining sufficient, appropriate evidence; and preparing',
2105:'audit documentation. the concepts of evidence, significance, and audit risk form a framework for applying these requirements and are included',
2106:'throughout the discussion of performance audits. planning requirements: general 8.03 auditors must adequately plan the work necessary to address the',
2107:'audit objectives. auditors must document the audit plan. 8.04 auditors must plan the audit to reduce audit risk to an',
2108:'acceptably low level. 8.05 in planning the audit, auditors should assess significance and audit risk. auditors should apply these assessments',
2109:'to establish the scope and methodology for addressing the audit objectives. planning is a continuous process throughout the audit. 8.06',
2110:'auditors should design the methodology to obtain sufficient, appropriate evidence that provides a reasonable basis for findings and conclusions based',
2111:'on the audit objectives and to reduce audit risk to an acceptably low level. 8.07 auditors should identify and use',
2112:'suitable criteria based on the audit objectives. application guidance: general 8.08 the audit objectives are what the audit is intended',
2113:'to accomplish. they identify the audit subject matter and performance aspects to be included. audit objectives can be thought of',
2114:'as questions about the program that the auditors seek to answer based on evidence obtained and assessed against criteria. audit',
2115:'objectives may also pertain to the current status or condition of a program. the term program as used in gagas',
2116:'includes processes, projects, studies, policies, operations, activities, entities, and functions. 8.09 auditors may need to refine or adjust the audit',
2117:'objectives, scope, and methodology as work is performed. however, in situations where the audit objectives are established by statute or',
2118:'legislative oversight, auditors may not have latitude to define or adjust the audit objectives or scope. 8.10 scope is the',
2119:'boundary of the audit and is directly tied to the audit objectives. the scope defines the subject matter that the',
2120:'auditors will assess and report on, such as a particular program or aspect of a program, the necessary documents or',
2121:'records, the period of time reviewed, and the locations that will be included. 8.11 the methodology describes the nature and',
2122:'extent of audit procedures for gathering and analyzing evidence to address the audit objectives. audit procedures are the specific steps',
2123:'and tests auditors perform to address the audit objectives. 8.12 obtaining sufficient, appropriate evidence provides auditors with a reasonable basis',
2124:'for findings and conclusions that are valid, accurate, appropriate, and complete with respect to the audit objectives. 8.13 the sufficiency',
2125:'and appropriateness of evidence needed and tests of evidence are determined by the auditors based on the audit objectives, findings,',
2126:'and conclusions. objectives for performance audits range from narrow to broad and involve varying types and quality of evidence. in',
2127:'some engagements, sufficient, appropriate evidence is available, but in others, information may have limitations. professional judgment assists auditors in determining',
2128:'the audit scope and methodology needed to address the audit objectives and in evaluating whether sufficient, appropriate evidence has been',
2129:'obtained to address the audit objectives. 8.14 in performance audits conducted in accordance with gagas, auditors are the party who',
2130:'measures or evaluates the subject matter of the engagement and who presents the resulting information as part of, or accompanying,',
2131:'the audit report. therefore, gagas does not require auditors to obtain management assertions with respect to the subject matter when',
2132:'conducting a performance audit. 8.15 the concept of significance assists auditors throughout a performance audit, including when deciding the type',
2133:'and extent of audit work to perform, when evaluating results of audit work, and when developing the report and related',
2134:'findings and conclusions. significance is defined as the relative importance of a matter within the context in which it is',
2135:'being considered, including quantitative and qualitative factors. such factors include the magnitude of the matter in relation to the subject',
2136:'matter of the audit, the nature and effect of the matter, the relevance of the matter, the needs and interests',
2137:'of an objective third party with knowledge of the relevant information, and the matter’s effect on the audited program or',
2138:'activity. professional judgment assists auditors when evaluating the significance of matters within the context of the audit objectives. in the',
2139:'performance audit requirements, the term significant is comparable to the term material as used in the context of financial statement',
2140:'engagements. 8.16 audit risk is the possibility that the auditors’ findings, conclusions, recommendations, or assurance may be improper or incomplete',
2141:'as a result of factors such as evidence that is not sufficient or appropriate, an inadequate audit process, or intentional',
2142:'omissions or misleading information because of misrepresentation or fraud. the assessment of audit risk involves both qualitative and quantitative considerations.',
2143:'factors affecting audit risk include the time frames, complexity, or sensitivity of the work; size of the program in terms',
2144:'of dollar amounts and number of citizens served; adequacy of the audited entity’s systems and processes for preventing and detecting',
2145:'inconsistencies, significant errors, or fraud; and auditors’ access to records. audit risk includes the risk that auditors will not detect',
2146:'a mistake, inconsistency, significant error, or fraud in the evidence supporting the audit. audit risk can be reduced by taking',
2147:'actions such as increasing the scope of work; adding specialists, additional reviewers, and other resources to conduct the audit; changing',
2148:'the methodology to obtain additional evidence, higherquality evidence, or alternative forms of corroborating evidence; or aligning the findings and conclusions',
2149:'to reflect the evidence obtained. 8.17 criteria identify the required or desired state or expectation with respect to the program',
2150:'or operation. criteria provide a context for evaluating evidence and understanding the findings, conclusions, and recommendations in the report. suitable',
2151:'criteria are relevant, reliable, objective, and understandable and do not result in the omission of significant information, as applicable, within',
2152:'the context of the audit objectives. the relative importance of each of these characteristics to a particular engagement is a',
2153:'matter of professional judgment. in instances where laws, regulations, or policies prescribe the criteria to be used for the engagement,',
2154:'such criteria are presumed to be suitable in the absence of indications to the contrary. 8.18 examples of criteria include',
2155:'a. laws and regulations applicable to the operation of the audited entity; b. goals, policies, and procedures established by officials',
2156:'of the audited entity; c. technically developed standards or norms; d. expert opinions; e. prior periods’ performance; f. defined business',
2157:'practices; g. contracts or grant agreements; and h. benchmarks against which performance is compared, including performance of other entities or',
2158:'sectors. 8.19 for audit objectives that pertain to the current status or condition of a program, sufficient, appropriate evidence is',
2159:'gathered to provide reasonable assurance that the description of the current status or condition of a program is accurate and',
2160:'reliable and does not omit significant information relevant to the audit objectives. information addressing the audit objectives is to be',
2161:'provided in an objective, understandable manner. the relative importance of each of the characteristics of the information to a particular',
2162:'engagement is a matter of professional judgment. auditor communication requirements: auditor communication 8.20 auditors should communicate an overview of the',
2163:'objectives, scope, and methodology and the timing of the performance audit and planned reporting including any potential restrictions on the',
2164:'report, unless doing so could significantly impair the auditors’ ability to obtain sufficient, appropriate evidence to address the audit objectives.',
2165:'auditors should communicate such information with the following parties, as applicable: a. management of the audited entity, including those with',
2166:'sufficient authority and responsibility to implement corrective action in the program or activity being audited; b. those charged with governance;',
2167:'c. the individuals contracting for or requesting audit services, such as contracting officials or grantees; or d. the cognizant legislative',
2168:'committee, when auditors conduct the audit pursuant to a law or regulation or when they conduct the work for the',
2169:'legislative committee that has oversight of the audited entity. 8.21 in situations where the parties required to receive communications, as',
2170:'described in paragraph 8.20, are not clearly evident, auditors should document the process followed and conclusions reached in identifying the',
2171:'appropriate individuals to receive the required communications. 8.22 auditors should retain any written communication resulting from paragraph 8.20 as audit',
2172:'documentation. application guidance: auditor communication 8.23 determining the form, content, and frequency of the communication with management or those charged',
2173:'with governance is a matter of professional judgment, although written communication is preferred. auditors may use an engagement letter to',
2174:'communicate key information early in the engagement. 8.24 examples of communications regarding the objectives, scope, methodology, and timing that could',
2175:'impair the auditors’ ability to obtain sufficient, appropriate evidence include situations in which the auditors plan to perform unannounced cash',
2176:'counts or perform procedures related to indications of fraud. 8.25 communicating with those charged with governance or management may include',
2177:'communicating deficiencies in internal control; fraud; or noncompliance with provisions of laws, regulations, contracts, and grant agreements. early communication of',
2178:'these matters may be important because of their relative significance and the urgency for corrective followup action. further, early communication',
2179:'is important to allow management to take prompt corrective action to prevent further occurrences when a control deficiency results in',
2180:'noncompliance with provisions of laws, regulations, contracts, and grant agreements or fraud. when a deficiency is communicated early, the reporting',
2181:'requirements and application guidance in paragraphs 9.29 through 9.44 still apply. 8.26 because the governance structures of government entities and',
2182:'organizations can vary widely, it may not always be clearly evident who is charged with key governance functions. the process',
2183:'for identifying those charged with governance includes evaluating the organizational structure for directing and controlling operations to achieve the audited',
2184:'entity’s objectives and how the audited entity delegates authority and establishes accountability for management. investigations or legal proceedings requirement: investigations',
2185:'or legal proceedings 8.27 auditors should inquire of management of the audited entity whether any investigations or legal proceedings significant',
2186:'to the audit objectives have been initiated or are in process with respect to the period under audit, and should',
2187:'evaluate the effect of initiated or in process investigations or legal proceedings on the current audit. application guidance: investigations or',
2188:'legal proceedings 8.28 laws, regulations, or policies may require auditors to report indications of the following to law enforcement or',
2189:'investigatory authorities before performing additional audit procedures: certain types of fraud or noncompliance with provisions of laws, regulations, contracts, and',
2190:'grant agreements. 8.29 avoiding interference with investigations or legal proceedings is important in pursuing indications of fraud and noncompliance with',
2191:'provisions of laws, regulations, contracts, and grant agreements. in some cases, it may be appropriate for the auditors to work',
2192:'with investigators or legal authorities or to withdraw from or defer further work on the engagement or a portion of',
2193:'the engagement to avoid interfering with an ongoing investigation or legal proceeding. results of previous engagements requirement: results of previous',
2194:'engagements 8.30 auditors should evaluate whether the audited entity has taken appropriate corrective action to address findings and recommendations from',
2195:'previous engagements that are significant within the context of the audit objectives. when planning the audit, auditors should ask management',
2196:'of the audited entity to identify previous engagements or other studies that directly relate to the objectives of the audit,',
2197:'including whether related recommendations have been implemented. auditors should use this information in assessing risk and determining the nature, timing,',
2198:'and extent of current audit work, including determining the extent to which testing the implementation of the corrective actions is',
2199:'applicable to the current audit objectives. assigning auditors requirements: assigning auditors 8.31 audit management should assign sufficient auditors with adequate',
2200:'collective professional competence, as described in paragraphs 4.02 through 4.15, to conduct the audit. staffing an audit includes, among other',
2201:'things, a. assigning auditors with the collective knowledge, skills, and abilities appropriate for the audit; b. assigning a sufficient number',
2202:'of auditors to the audit; c. providing for onthejob training of auditors; and d. engaging specialists when necessary. 8.32 if',
2203:'planning to use the work of specialists, auditors should document the nature and scope of the work to be performed',
2204:'by the specialists, including a. the objectives and scope of the specialists’ work, b. the intended use of the specialists’',
2205:'work to support the audit objectives, c. the specialists’ procedures and findings so they can be evaluated and related to',
2206:'other planned audit procedures, and d. the assumptions and methods used by the specialists. preparing a written audit plan requirement:',
2207:'preparing a written audit plan 8.33 auditors must prepare a written audit plan for each audit. auditors should update the',
2208:'plan, as necessary, to reflect any significant changes to the plan made during the audit. application guidance: preparing a written',
2209:'audit plan 8.34 the form and content of the written audit plan may vary among audits and may include an',
2210:'audit strategy, audit program, project plan, audit planning paper, or other appropriate documentation of key decisions about the audit objectives,',
2211:'scope, and methodology and the auditors’ basis for those decisions. 8.35 a written audit plan provides an opportunity for audit',
2212:'organization management to supervise audit planning and to determine whether a. the proposed audit objectives are likely to result in',
2213:'a useful report; b. the audit plan adequately addresses relevant risks; c. the proposed audit scope and methodology are adequate',
2214:'to address the audit objectives; d. available evidence is likely to be sufficient and appropriate for purposes of the audit;',
2215:'and e. sufficient staff, supervisors, and specialists with adequate collective professional competence and other resources are available to conduct the',
2216:'audit and to meet expected time frames for completing the work. conducting the engagement nature and profile of the program',
2217:'and user needs requirement: nature and profile of the program and user needs 8.36 auditors should obtain an understanding of',
2218:'the nature of the program or program component under audit and the potential use that will be made of the',
2219:'audit results or report as they plan a performance audit. the nature and profile of a program include a. visibility,',
2220:'sensitivity, and relevant risks associated with the program under audit; b. age of the program or changes in its condition;',
2221:'c. the size of the program in terms of total dollars, number of citizens affected, or other measures; d. level',
2222:'and extent of review or other forms of independent oversight; e. the program’s strategic plan and objectives; and f. external',
2223:'factors or conditions that could directly affect the program. application guidance: nature and profile of the program and user needs',
2224:'8.37 one group of users of the audit report is government officials or other parties who authorize or request audits.',
2225:'other important users of the audit report are the audited entity, those responsible for acting on the auditors’ recommendations, oversight',
2226:'organizations, and legislative bodies. other potential users of the audit report include legislators or government officials other than those who',
2227:'authorized or requested the audit, the media, interest groups, and individual citizens. in addition to an interest in the program,',
2228:'potential users may have an ability to influence the conduct of the program. an awareness of these potential users’ interests',
2229:'and influence can help auditors judge whether possible findings could be significant to relevant users. 8.38 obtaining an understanding of',
2230:'the program under audit helps auditors to assess the relevant risks associated with the program and the effect of the',
2231:'risks on the audit objectives, scope, and methodology. the auditors’ understanding may come from knowledge they already have about the',
2232:'program or knowledge they gain from inquiries, observations, and reviewing documents while planning the audit. the extent and breadth of',
2233:'those inquiries and observations will vary among audits based on the audit objectives, as will the need to understand individual',
2234:'aspects of the program, such as the following: a. provisions of laws, regulations, contracts, and grant agreements: government programs are',
2235:'usually created by law and are subject to specific laws and regulations. laws and regulations usually set forth what is',
2236:'to be done, who is to do it, the purpose to be achieved, the population to be served, and related',
2237:'funding guidelines or restrictions. government programs may also be subject to contracts or grant agreements. thus, understanding the laws and',
2238:'legislative history establishing a program and the provisions of contracts or grant agreements is essential to understanding the program itself.',
2239:'obtaining that understanding is also a necessary step in identifying the provisions of laws, regulations, contracts, and grant agreements that',
2240:'are significant within the context of the audit objectives. b. purpose and goals: purpose is the result or effect that',
2241:'is intended or desired from a program’s operation. legislatures usually establish a program’s purpose when they provide authority for the',
2242:'program. audited entity officials may provide more detailed information on the program’s purpose to supplement the authorizing legislation. audited entity',
2243:'officials are sometimes asked to set goals for program performance and operations, including both output and outcome goals. auditors may',
2244:'use the stated program purpose and goals as criteria for assessing program performance or may develop additional criteria to use',
2245:'when assessing performance. c. internal control: internal control is a process effected by an entity’s oversight body, management, and other',
2246:'personnel that provides reasonable assurance that the objectives of an entity will be achieved. internal control comprises the plans, methods,',
2247:'policies, and procedures used to fulfill the mission, strategic plan, goals, and objectives of the entity. d. inputs: inputs are',
2248:'the amount of resources in terms of, for example, money, material, or personnel that is put into a program. these',
2249:'resources may come from within or outside the entity operating the program. measures of inputs can have a number of',
2250:'dimensions, such as cost, timing, and quality. examples of measures of inputs are dollars spent, employee hours expended, and square',
2251:'feet of building space used. e. program operations: program operations are the strategies, processes, and activities management uses to convert',
2252:'inputs into outputs. program operations may be subject to internal control. f. outputs: outputs represent the quantity of goods or',
2253:'services produced by a program. for example, an output measure for a job training program could be the number of',
2254:'persons completing training, and an output measure for an aviation safety inspection program could be the number of safety inspections',
2255:'completed. g. outcomes: outcomes are accomplishments or results of a program. for example, an outcome measure for a job training',
2256:'program could be the percentage of trained persons obtaining a job and still in the workplace after a specified period.',
2257:'an example of an outcome measure for an aviation safety inspection program could be the percentage reduction in safety problems',
2258:'found in subsequent inspections or the percentage of problems deemed corrected in followup inspections. such outcome measures show the progress',
2259:'made in achieving the stated program purposes of helping unemployed citizens obtain and retain jobs and improving the safety of',
2260:'aviation operations, respectively. outcomes may be influenced by cultural, economic, physical, or technological factors outside the program. auditors may use',
2261:'approaches drawn from other disciplines, such as program evaluation, to isolate the effects of the program from these other influences.',
2262:'outcomes also include a program’s unexpected or unintentional effects, both positive and negative. determining significance and obtaining an understanding of',
2263:'internal control requirements: determining significance and obtaining an understanding of internal control 8.39 auditors should determine and document whether internal',
2264:'control is significant to the audit objectives.69 8.40 if it is determined that internal control is significant to the audit',
2265:'objectives, auditors should obtain an understanding of such internal control. 69see fig.4 at the end of ch. 8 for a',
2266:'flowchart on consideration of internal control in a gagas performance audit. application guidance: determining significance and obtaining an understanding of',
2267:'internal control 8.41 consideration of internal control in a performance audit begins with determining the significance of internal control to',
2268:'the audit objectives and documenting that determination. some factors that may be considered when determining the significance of internal control',
2269:'to the audit objectives include a. the subject matter under audit, such as the program or program component under audit,',
2270:'including the audited entity’s objectives for the program and associated inherent risks; b. the nature of findings and conclusions expected',
2271:'to be reported, based on the needs and interests of audit report users; c. the three categories of entity objectives',
2272:'operations, reporting, and compliance;70 and d. the five components of internal control control environment, risk assessment, control activities, information and',
2273:'communication, and monitoring and the integration of the components. 70the terminology used in this section is consistent with the definitions',
2274:'and concepts in the committee of sponsoring organizations of the treadway commission’s internal control—integrated framework coso framework and standards for',
2275:'internal control in the federal government gao14704g green book. 8.42 if internal control is significant to the audit objectives, auditors',
2276:'determine which of the five components of internal control are significant to the audit objectives, as all components of internal',
2277:'control are generally relevant, but not all components may be significant to the audit objectives. this determination can also identify',
2278:'the underlying principles, control objectives, or specific controls that are significant to the audit objectives. determining which internal control components,',
2279:'principles, control objectives, and/or specific controls are significant to the audit objectives is a matter of professional judgment. 8.43 determining',
2280:'the significance of internal control may be an iterative process. as discussed in paragraph 8.09, the audit objectives can evolve',
2281:'and become more refined throughout the audit. when this occurs, the significance of internal control is determined and documented for',
2282:'the new or revised objectives. 8.44 determining the significance of internal control may be documented in formats such as narratives',
2283:'or tables. the documentation includes the conclusions on whether internal control is significant to the audit objectives, and if so,',
2284:'which components of internal control are significant to the audit objectives. the documentation may also include the factors considered and',
2285:'steps taken to perform the determination. 8.45 determining the significance of internal control to the audit objectives affects the audit',
2286:'planning required in paragraphs 8.03 through 8.07. specifically, it enables auditors to determine whether to assess internal control as part',
2287:'of the audit and, if they do, to identify criteria for the assessment and plan the appropriate scope, methodology, and',
2288:'extent of internal control assessments to perform. 8.46 the nature and extent of procedures auditors perform to obtain an understanding',
2289:'of internal control is a matter of professional judgment and may vary among audits based on audit objectives, audit risk,',
2290:'internal control deficiencies, and the auditors’ knowledge about internal control gained in prior audits. the understanding of internal control builds',
2291:'on the understanding of the program required in paragraph 8.36. the auditors’ understanding of internal control may be obtained through',
2292:'procedures such as inquiries, observations, inspection of documents and records, review of other audit reports, or direct tests. 8.47 approaches',
2293:'for obtaining an understanding of internal control may vary and may include consideration of entitylevel controls, transaction level controls, or',
2294:'both. however, even when assessing only transaction level controls, it may be beneficial to gain an understanding of entitylevel controls',
2295:'that may affect transactionlevel controls by obtaining a broad understanding of the five components of internal control at the entity',
2296:'level. this involves considering the relationships between the components, which work together in an integrated manner in an effective internal',
2297:'control system, and the principles of internal control that support each component. in addition to obtaining a broad understanding of',
2298:'internal control at the entity level, auditors may also obtain an understanding of internal control at the transaction level for',
2299:'the specific programs and processes under audit. 8.48 obtaining an understanding of internal control assists auditors in identifying an audited',
2300:'entity’s key controls relevant to the audit objectives. identifying key controls involves considering the entity’s objectives that are relevant to',
2301:'the audit and whether the entity has controls in place to achieve those objectives and address associated risks. collectively, key',
2302:'controls are those controls necessary to achieve the entity’s control objectives and provide reasonable assurance of achieving the entity’s objectives.',
2303:'key controls often have one or both of the following characteristics: a. their failure may significantly affect the achievement of',
2304:'the entity’s objectives, yet not reasonably be detected in a timely manner by other controls. b. their operation may prevent',
2305:'or detect other control failures before they have an opportunity to become significant to the achievement of the entity’s objectives.',
2306:'assessing internal control requirement: assessing internal control 8.49 if internal control is determined to be significant to the audit objectives,',
2307:'auditors should plan and perform audit procedures to assess internal control to the extent necessary to address the audit objectives.',
2308:'application guidance: assessing internal control 8.50 the auditors’ understanding of internal control provides a basis for determining the nature, timing,',
2309:'and extent of procedures for assessments of internal control, if such an assessment will be performed. assessments of internal control',
2310:'in a performance audit are performed to the extent necessary to address the audit objectives. the levels of internal control',
2311:'assessment that may be performed based on the audit objectives are 1 assessing the design; 2 assessing the design and',
2312:'implementation; or 3 assessing the design, implementation, and operating effectiveness of controls that are significant to the audit objectives. 8.51',
2313:'assessments of internal control involve designing and performing procedures to obtain sufficient, appropriate evidence, as required in paragraphs 8.90 through',
2314:'8.94, to support and document the auditors’ findings and conclusions on design, implementation, and/or operating effectiveness of controls that are',
2315:'significant to the audit objectives. the controls being assessed are generally the key controls identified during the planning phase of',
2316:'the engagement, which may include controls at both the entity and transaction levels. changes may be made to the initial',
2317:'determination of key controls based on additional information gathered during the course of fieldwork. 8.52 the design of internal control',
2318:'is assessed by determining whether controls individually and in combination are capable of achieving an objective and addressing the related',
2319:'risk. the implementation of internal control is assessed by determining if the control exists and has been placed into operation.',
2320:'the operating effectiveness of internal control is assessed by determining whether controls were applied at relevant times during the period',
2321:'under evaluation, the consistency with which they were applied, and by whom or by what means they were applied. a',
2322:'control cannot be effectively implemented if it was not effectively designed. a control cannot be operating effectively if it was',
2323:'not effectively designed and implemented. 8.53 during the assessment of each control, deficiencies in internal control may be identified. a',
2324:'deficiency in internal control exists when the design, implementation, or operation of a control does not allow management or personnel',
2325:'to achieve control objectives and address related risks.71 a deficiency in design exists when a necessary control is missing or',
2326:'is not properly designed so that even if the control operates as designed, the control objective would not be met.',
2327:'a deficiency in implementation exists when a control is properly designed but not implemented correctly in the internal control system.',
2328:'a deficiency in operating effectiveness exists when a properly designed control does not operate as designed or the person performing',
2329:'the control does not have the necessary competence or authority to perform the control effectively. 71see paras. 1.27g and 1.27k',
2330:'for definitions of control objective and entity objective. 72see paras. 9.29 through 9.34 for a discussion of reporting on internal',
2331:'control. internal control deficiencies considerations requirement: internal control deficiencies considerations 8.54 auditors should evaluate and document the significance of identified',
2332:'internal control deficiencies within the context of the audit objectives. application guidance: internal control deficiencies considerations 8.55 internal control deficiencies',
2333:'are evaluated for significance within the context of the audit objectives. deficiencies are evaluated both on an individual basis and',
2334:'in the aggregate. consideration is given to the correlation among deficiencies. this evaluation and the audit work performed form the',
2335:'basis of the auditors’ determination whether, individually or in combination, the deficiencies are significant within the context of the audit',
2336:'objectives.72 8.56 determining whether deficiencies are significant within the context of the audit objectives involves evaluating the following factors: a.',
2337:'magnitude of impact: magnitude of impact refers to the likely effect that the deficiency could have on the entity achieving',
2338:'its objectives and is affected by factors such as the size, pace, and duration of the deficiency’s impact. a deficiency',
2339:'may be more significant to one objective than another. b. likelihood of occurrence: likelihood of occurrence refers to the possibility',
2340:'of a deficiency impacting an entity’s ability to achieve its objectives. c. nature of the deficiency: the nature of the',
2341:'deficiency involves factors such as the degree of subjectivity involved with the deficiency and whether the deficiency arises from fraud',
2342:'or misconduct. 8.57 internal control deficiencies are a type of finding, and the requirements related to developing the four elements',
2343:'of a finding in paragraph 8.116 apply. when determining the cause of internal control deficiencies, it may be helpful for',
2344:'auditors to perform an analysis to identify the root cause of the deficiencies. identifying the root causes of internal control',
2345:'deficiencies may strengthen the quality of auditors’ recommendations for corrective actions. 8.58 the following are examples of control deficiencies: a.',
2346:'ineffective oversight by those charged with governance of the entity’s financial reporting, performance reporting, or internal control, or an ineffective',
2347:'overall governance structure. b. an ineffective internal audit function or risk assessment function at an entity for which such functions',
2348:'are important to the monitoring or risk assessment component of internal control, such as for a large or complex entity.',
2349:'c. failure by management or those charged with governance to assess the effect of a deficiency previously communicated to them',
2350:'and either to correct it or to conclude that it does not need to be corrected. d. inadequate controls for',
2351:'the safeguarding of assets. e. inadequate design of information systems general, application, and user controls that prevents an information system',
2352:'from providing complete and accurate information consistent with financial, compliance, or performance reporting objectives or other current needs. f. failure',
2353:'of an application control caused by a deficiency in the design or operation of an information system’s general controls. g.',
2354:'employees or management who lack the qualifications and training to fulfill their assigned functions. information systems controls considerations requirements: information',
2355:'systems controls considerations 8.59 the effectiveness of significant internal controls frequently depends on the effectiveness of information systems controls. thus,',
2356:'when obtaining an understanding of internal control significant to the audit objectives, auditors should also determine whether it is necessary',
2357:'to evaluate information systems controls. 8.60 when information systems controls are determined to be significant to the audit objectives or',
2358:'when the effectiveness of significant controls depends on the effectiveness of information systems controls, auditors should then evaluate the design,',
2359:'implementation, and/or operating effectiveness of such controls. this evaluation includes other information systems controls that affect the effectiveness of the',
2360:'significant controls or the reliability of information used in performing the significant controls. auditors should obtain a sufficient understanding of',
2361:'information systems controls necessary to assess audit risk and plan the audit within the context of the audit objectives. 8.61',
2362:'auditors should determine which audit procedures related to information systems controls are needed to obtain sufficient, appropriate evidence to support',
2363:'the audit findings and conclusions. 8.62 when evaluating information systems controls is an audit objective, auditors should test information systems',
2364:'controls to the extent necessary to address the audit objective. application guidance: information systems controls considerations 8.63 understanding information systems',
2365:'controls is important when information systems are used extensively throughout the program under audit and the fundamental business processes related',
2366:'to the audit objectives rely on information systems. information systems controls consist of those internal controls that depend on information',
2367:'systems processing and include general controls, application controls, and user controls. a. information systems general controls entitywide, system, and application',
2368:'levels are the policies and procedures that apply to all or a large segment of an entity’s information systems. general',
2369:'controls help ensure the proper operation of information systems by creating the environment for proper operation of application controls. general',
2370:'controls include security management, logical and physical access, configuration management, segregation of duties, and contingency planning. b. application controls, sometimes',
2371:'referred to as business process controls, are those controls that are incorporated directly into computer applications to help ensure the',
2372:'validity, completeness, accuracy, and confidentiality of transactions and data during application processing. application controls include controls over input, processing, output,',
2373:'master file, interface, and the data management system. c. user controls are portions of controls that are performed by people',
2374:'interacting with information systems controls. a user control is an information systems control if its effectiveness depends on information systems',
2375:'processing or the reliability accuracy, completeness, and validity of information processed by information systems. 8.64 an entity’s use of information',
2376:'systems controls may be extensive; however, auditors are primarily interested in those information systems controls that are significant to the',
2377:'audit objectives. information systems controls are significant to the audit objectives if auditors determine that it is necessary to evaluate',
2378:'the effectiveness of these controls in order to obtain sufficient, appropriate evidence. for example, an audit objective may involve evaluating',
2379:'the effectiveness of information systems controls related to certain systems, facilities, or entities. 8.65 audit procedures to evaluate the effectiveness',
2380:'of significant information systems controls include 1 gaining an understanding of the system as it relates to the information and',
2381:'2 identifying and evaluating the general, application, and user controls that are critical to providing assurance over the reliability of',
2382:'the information required for the audit. 8.66 the evaluation of information systems controls may be done in conjunction with the',
2383:'auditors’ consideration of internal control within the context of the audit objectives or as a separate audit objective or audit',
2384:'procedure, depending on the audit’s objectives. depending on the significance of information systems controls to the audit objectives, the extent',
2385:'of audit procedures to obtain such an understanding may be limited or extensive. in addition, the nature and extent of',
2386:'audit risk related to information systems controls are affected by the hardware and software used, the configuration of the entity’s',
2387:'systems and networks, and the entity’s information systems strategy. 8.67 the following factors may assist auditors in determining the significance',
2388:'of information system controls to the audit objectives: a. the extent to which internal controls that are significant to the',
2389:'audit depend on the reliability of information processed or generated by information systems. b. the availability of evidence outside the',
2390:'information system to support the findings and conclusions. it may not be possible for auditors to obtain sufficient, appropriate evidence',
2391:'without evaluating the effectiveness of relevant information systems controls. for example, if information supporting the findings and conclusions is generated',
2392:'by information systems or its reliability depends on information systems controls, there may not be sufficient supporting or corroborating information',
2393:'or documentary evidence available other than that produced by the information systems. c. the relationship of information systems controls to',
2394:'data reliability. to obtain evidence about the reliability of computergenerated information, auditors may decide to evaluate the effectiveness of information',
2395:'systems controls as part of obtaining evidence about the reliability of the data. if the auditors conclude that information systems',
2396:'controls are effective, they may reduce the direct testing of data. provisions of laws, regulations, contracts, and grant agreements requirement:',
2397:'provisions of laws, regulations, contracts, and grant agreements 8.68 auditors should identify any provisions of laws, regulations, contracts, and grant',
2398:'agreements that are significant within the context of the audit objectives and assess the risk that noncompliance with provisions of',
2399:'laws, regulations, contracts, and grant agreements could occur. based on that risk assessment, the auditors should design and perform procedures',
2400:'to obtain reasonable assurance of detecting instances of noncompliance with provisions of laws, regulations, contracts, and grant agreements that are',
2401:'significant within the context of the audit objectives. application guidance: provisions of laws, regulations, contracts, and grant agreements 8.69 government',
2402:'programs are subject to many provisions of laws, regulations, contracts, and grant agreements. at the same time, these provisions’ significance',
2403:'within the context of the audit objectives varies widely, depending on the objectives of the audit. auditors may consult with',
2404:'their legal counsel to 1 determine those laws and regulations that are significant to the audit objectives, 2 design tests',
2405:'of compliance with provisions of laws and regulations, and 3 evaluate the results of those tests. auditors also may consult',
2406:'with their legal counsel when audit objectives require testing compliance with provisions of contracts or grant agreements. depending on the',
2407:'circumstances of the audit, auditors may consult with others, such as investigative staff, other audit organizations or government entities that',
2408:'provided professional services to the audited entity, or law enforcement authorities, to obtain information on compliance matters. 8.70 the auditors’',
2409:'assessment of audit risk may be affected by such factors as the complexity or recent establishment of the laws, regulations,',
2410:'contracts, and grant agreements. the auditors’ assessment of audit risk also may be affected by whether the audited entity has',
2411:'controls that are effective in preventing or detecting noncompliance with provisions of laws, regulations, contracts, and grant agreements. if auditors',
2412:'obtain sufficient, appropriate evidence of the effectiveness of these controls, they can reduce their tests of compliance. fraud requirements: fraud',
2413:'8.71 auditors should assess the risk of fraud occurring that is significant within the context of the audit objectives. audit',
2414:'team members should discuss among the team fraud risks, including factors such as individuals’ incentives or pressures to commit fraud,',
2415:'the opportunity for fraud to occur, and rationalizations or attitudes that could increase the risk of fraud. auditors should gather',
2416:'and assess information to identify the risk of fraud that is significant within the scope of the audit objectives or',
2417:'that could affect the findings and conclusions. 8.72 assessing the risk of fraud is an ongoing process throughout the audit.',
2418:'when information comes to the auditors’ attention indicating that fraud, significant within the context of the audit objectives, may have',
2419:'occurred, auditors should extend the audit steps and procedures, as necessary, to 1 determine whether fraud has likely occurred and',
2420:'2 if so, determine its effect on the audit findings. application guidance: fraud 8.73 fraud involves obtaining something of value',
2421:'through willful misrepresentation. whether an act is, in fact, fraud is determined through the judicial or other adjudicative system and',
2422:'is beyond auditors’ professional responsibility. 8.74 auditors may obtain information through discussion with officials of the audited entity or through',
2423:'other means to determine the susceptibility of a program to fraud, the extent to which the audited entity has implemented',
2424:'leading practices to manage fraud risks, the status of internal controls the audited entity has established to prevent and detect',
2425:'fraud, or the risk that officials of the audited entity could override internal control. an attitude of professional skepticism in',
2426:'assessing the risk of fraud assists auditors in assessing which factors or risks could significantly affect the audit objectives. 8.75',
2427:'in some circumstances, conditions such as the following could indicate a heightened risk of fraud: a. economic, programmatic, or entity',
2428:'operating conditions that threaten the entity’s financial stability, viability, or budget; b. the nature of the entity’s operations provide opportunities',
2429:'to engage in fraud; c. management’s monitoring of compliance with laws, regulations, and policies is inadequate; d. the organizational structure',
2430:'is unstable or unnecessarily complex; e. management communication or support for ethical standards is lacking; f. management is willing to',
2431:'accept unusually high levels of risk in making significant decisions; g. the entity has a history of impropriety, such as',
2432:'previous issues with fraud, questionable practices, or past audits or investigations with findings of questionable or criminal activity; h. operating',
2433:'policies and procedures have not been developed or are outdated; i. key documentation is lacking or does not exist; j.',
2434:'asset accountability or safeguarding procedures are lacking; k. a history of improper payments; l. evidence of false or misleading information;',
2435:'and m. evidence of unusual patterns and trends in contracting, procurement, acquisition, and other activities of the entity or program.',
2436:'8.76 if fraud that may have occurred is not significant within the context of the audit objectives, the auditors may',
2437:'perform additional audit work as a separate engagement or refer the matter to other parties with oversight responsibility or jurisdiction.',
2438:'identifying sources of evidence and the amount and type of evidence required requirements: identifying sources of evidence and the amount',
2439:'and type of evidence required 8.77 auditors should identify potential sources of information that could be used as evidence. auditors',
2440:'should determine the amount and type of evidence needed to obtain sufficient, appropriate evidence to address the audit objectives and',
2441:'adequately plan audit work. 8.78 auditors should evaluate whether any lack of sufficient, appropriate evidence is caused by internal control',
2442:'deficiencies or other program weaknesses, and whether the lack of sufficient, appropriate evidence could be the basis for audit findings.',
2443:'application guidance: identifying sources of evidence and the amount and type of evidence required 8.79 if auditors believe it is',
2444:'likely that sufficient, appropriate evidence will not be available, they may revise the audit objectives or modify the scope and',
2445:'methodology and determine alternative procedures to obtain additional evidence or other forms of evidence to address the current audit objectives.',
2446:'using the work of others requirements: using the work of others 8.80 auditors should determine whether other auditors have conducted,',
2447:'or are conducting, audits that could be relevant to the current audit objectives. 8.81 if auditors use the work of',
2448:'other auditors, they should perform procedures that provide a sufficient basis for using that work. auditors should obtain evidence concerning',
2449:'the other auditors’ qualifications and independence and should determine whether the scope, quality, and timing of the audit work performed',
2450:'by the other auditors can be relied on in the context of the current audit objectives.73 73see para. 5.80 for',
2451:'additional discussion on using the work of other auditors and peer review reports. chapter 8: fieldwork standards forperformance audits 8.82if',
2452:'the engagement team intends to use the work of a specialist, it should assess the independence of the specialist.74 application',
2453:'guidance: using the work of others 8.83the results of other auditors’work may be useful sources of information for planning and',
2454:'conducting the audit. if other auditors have identified areas that warrant further audit work or followup, their workmay influence the',
2455:'auditors’selection of objectives, scope, and methodology. 8.84internal auditing isan important part of overall governance, accountability, and internal control. akey role',
2456:'of many internal audit organizations is to provide assurance that internal controls are in place to adequately mitigate risks and',
2457:'achieve programgoals and objectives. auditors may determine that it is appropriate to use the workof the internal auditors in assessing',
2458:'the effectiveness of design or operation of internal controls that are significant within the context of the audit objectives. 8.85if',
2459:'other auditors have completed audit work related to the objectivesof the current audit, the current auditors may be able to',
2460:'use the work ofthe other auditors to support findings or conclusions for the current audit and thereby avoid duplication of',
2461:'effort. procedures that auditors mayperform in making thisdetermination include reviewing the other audit report, audit plan, or audit documentation, or',
2462:'performing tests of the otherauditors’work. the nature and extent of evidence needed will depend onthe significance of the other auditors’work',
2463:'to the current audit objectivesand the extent to which the auditorswill use that work. 8.86the engagement team’s assessment of the',
2464:'independence of specialistswho perform audit work includes identifying threats and applying any necessary safeguardsin the same manner as they would',
2465:'forauditors performing work on those audits.75 74see para. 1.27p for the definition of specialist. 75see paras. 3.18 through 3.108 for',
2466:'requirements and guidance related to independence. page 178gao21368ggovernment auditing standards supervision requirement: supervision 8.87 auditors must properly supervise audit staff.',
2467:'application guidance: supervision 8.88 audit supervision involves providing sufficient guidance and direction to auditors assigned to the audit to address',
2468:'the audit objectives and follow applicable requirements, while staying informed about significant problems encountered, reviewing the work performed, and providing',
2469:'effective onthejob training. 8.89 the nature and extent of the auditors’ supervision and the review of audit work may vary',
2470:'depending on a number of factors, such as the size of the audit organization, the significance of the work, and',
2471:'the experience of the auditors. evidence requirements: evidence 8.90 auditors must obtain sufficient, appropriate evidence to provide a reasonable basis',
2472:'for addressing the audit objectives and supporting their findings and conclusions. 8.91 in assessing the appropriateness of evidence, auditors should',
2473:'assess whether the evidence is relevant, valid, and reliable. 8.92 in determining the sufficiency of evidence, auditors should determine whether',
2474:'enough appropriate evidence exists to address the audit objectives and support the findings and conclusions to the extent that would',
2475:'persuade a knowledgeable person that the findings are reasonable. 8.93 when auditors use information provided by officials of the audited',
2476:'entity as part of their evidence, they should determine what the officials of the audited entity or other auditors did',
2477:'to obtain assurance over the reliability of the information. 8.94 auditors should evaluate the objectivity, credibility, and reliability of testimonial',
2478:'evidence. application guidance: evidence 8.95 audit objectives may vary widely, as may the level of work necessary to assess the',
2479:'sufficiency and appropriateness of evidence to address the objectives. the concepts of audit risk and significance assist auditors in evaluating',
2480:'the audit evidence. professional judgment assists auditors in determining the sufficiency and appropriateness of evidence taken as a whole. interpreting,',
2481:'summarizing, or analyzing evidence is typically used in determining the sufficiency and appropriateness of evidence and in reporting the results',
2482:'of the audit work. 8.96 when auditors use information that audited entity officials provided as part of their evidence, auditors',
2483:'may find it necessary to test management’s procedures to obtain assurance, perform direct testing of the information, or obtain additional',
2484:'corroborating evidence. the nature, timing, and extent of the auditors’ procedures will depend on the significance of the information to',
2485:'the audit objectives and the nature of the information being used. using a riskbased approach, auditors may consider additional procedures',
2486:'if they become aware of evidence that conflicts with that provided by management. in their overall assessment, auditors may document',
2487:'how they resolved situations involving conflicting evidence.76 76see para. 8.105 for a discussion of the relationship between testimonial and documentary',
2488:'evidence. 8.97 auditors may request that management provide written representations as to the accuracy and completeness of information provided. 8.98',
2489:'the nature, timing, and extent of audit procedures to assess sufficiency and appropriateness are affected by the effectiveness of the',
2490:'audited entity’s internal controls over the information, including information systems controls, and the significance of the information and the level',
2491:'of detail presented in the auditors’ findings and conclusions in the context of the audit objectives. the sufficiency and appropriateness',
2492:'of computerprocessed information is assessed regardless of whether this information is provided to auditors or auditors independently extract it. assessing',
2493:'the sufficiency and appropriateness of computerprocessed information includes considering the completeness and accuracy of the data for the intended purposes.',
2494:'sufficiency 8.99 sufficiency is a measure of the quantity of evidence used to support the findings and conclusions related to',
2495:'the audit objectives. 8.100 when appropriate, auditors may use statistical methods to analyze and interpret evidence to assess its sufficiency.',
2496:'8.101 the sufficiency of evidence required to support the auditors’ findings and conclusions is a matter of the auditors’ professional',
2497:'judgment. the following presumptions are useful in judging the sufficiency of evidence. a. the greater the audit risk, the greater',
2498:'the quantity and quality of evidence required. b. stronger evidence may allow less evidence to be used. appropriateness 8.102 appropriateness',
2499:'is the measure of the quality of evidence that encompasses the relevance, validity, and reliability of evidence used for addressing',
2500:'the audit objectives and supporting findings and conclusions. a. relevance refers to the extent to which evidence has a logical',
2501:'relationship with, and importance to, the issue being addressed. b. validity refers to the extent to which evidence is a',
2502:'meaningful or reasonable basis for measuring what is being evaluated. in other words, validity refers to the extent to which',
2503:'evidence represents what it is purported to represent. c. reliability refers to the consistency of results when information is measured',
2504:'or tested and includes the concepts of being verifiable or supported. for example, in establishing the appropriateness of evidence, auditors',
2505:'may test its reliability by obtaining supporting evidence, using statistical testing, or obtaining corroborating evidence. d. having a large volume',
2506:'of evidence does not compensate for a lack of relevance, validity, or reliability. 8.103 the degree of assurance associated with',
2507:'a performance audit is strongly associated with the appropriateness of evidence in relation to the audit objectives. examples follow. a.',
2508:'the audit objectives might focus on verifying specific quantitative results presented by the audited entity. in these situations, the audit',
2509:'procedures would likely focus on obtaining evidence about the accuracy of the specific amounts in question. this work may include',
2510:'the use of statistical sampling. b. the audit objectives might focus on the performance of a specific program or activity',
2511:'in the audited entity. in these situations, the auditors may be provided information that the audited entity compiled in order',
2512:'to satisfy the audit objectives. the auditors may find it necessary to test the quality of the information, which includes',
2513:'both its validity and reliability. c. the audit objectives might focus on information that is used for widely accepted purposes',
2514:'and obtained from sources generally recognized as appropriate. for example, economic statistics issued by government agencies for purposes such as',
2515:'adjusting for inflation, or other such information issued by authoritative organizations, may be the best information available. in such cases,',
2516:'it may not be practical or necessary for auditors to perform procedures to verify the information. these decisions call for',
2517:'use of professional judgment based on the nature of the information, its common usage or acceptance, and how it is',
2518:'being used in the audit. d. the audit objectives might focus on comparisons or benchmarking between various government functions or',
2519:'agencies. these types of audits are especially useful for analyzing the outcomes of various public policy decisions. in these cases,',
2520:'auditors may perform analyses, such as comparative statistics of different jurisdictions or changes in performance over time, where it would',
2521:'be impractical to verify the detailed data underlying the statistics. clear disclosure of the extent to which comparative information or',
2522:'statistics were evaluated or corroborated will likely be necessary to place the evidence in context for report users. e. the',
2523:'audit objectives might focus on trend information based on data that the audited entity provided. in this situation, auditors may',
2524:'assess the evidence by using overall analytical tests of underlying data, combined with knowledge and understanding of the systems or',
2525:'processes used for compiling information. f. the audit objectives might focus on identifying emerging and crosscutting issues using information that',
2526:'audited entities compiled or selfreported. in such cases, it may be helpful for the auditors to consider the overall appropriateness',
2527:'of the compiled information along with other information available about the program. other sources of information, such as inspector general',
2528:'reports or other external audits, may provide the auditors with information regarding whether any unverified or selfreported information is consistent',
2529:'with or can be corroborated by these other external sources of information. 8.104 in terms of its form and how',
2530:'it is collected, evidence may be categorized as physical, documentary, or testimonial. physical evidence is obtained by auditors’ direct inspection',
2531:'or observation of people, property, or events. such evidence may be documented in summary memos, photographs, videos, drawings, charts, maps,',
2532:'or physical samples. documentary evidence is already existing information, such as letters, contracts, accounting records, invoices, spreadsheets, database extracts, electronically',
2533:'stored information, and management information on performance. testimonial evidence is obtained through inquiries, interviews, focus groups, public forums, or questionnaires.',
2534:'auditors frequently use analytical processes, including computations, comparisons, separation of information into components, and rational arguments, to analyze any evidence',
2535:'gathered to determine whether it is sufficient and appropriate. evidence may be obtained by observation, inquiry, or inspection. each type',
2536:'of evidence has its own strengths and weaknesses. the following contrasts are useful in judging the appropriateness of evidence. however,',
2537:'these contrasts are not adequate in themselves to determine appropriateness. the nature and types of evidence used to support auditors’',
2538:'findings and conclusions are matters of the auditors’ professional judgment based on the audit objectives and audit risk. a. evidence',
2539:'obtained when internal control is effective is generally more reliable than evidence obtained when internal control is weak or nonexistent.77',
2540:'77see paras. 8.39 through 8.67 for a discussion of internal control. b. evidence obtained through the auditors’ direct physical examination,',
2541:'observation, computation, and inspection is generally more reliable than evidence obtained indirectly. c. examination of original documents is generally more',
2542:'reliable than examination of copies. d. testimonial evidence obtained under conditions in which persons may speak freely is generally more',
2543:'reliable than evidence obtained under circumstances in which the persons may be intimidated. e. testimonial evidence obtained from an individual',
2544:'who is not biased and has direct knowledge about the area is generally more reliable than testimonial evidence obtained from',
2545:'an individual who is biased or has indirect or partial knowledge about the area. f. evidence obtained from a knowledgeable,',
2546:'credible, and unbiased third party is generally more reliable than evidence obtained from management of the audited entity or others',
2547:'who have a direct interest in the audited entity. 8.105 testimonial evidence may be useful in interpreting or corroborating documentary',
2548:'or physical information. documentary evidence may be used to help verify, support, or challenge testimonial evidence. 8.106 surveys generally provide',
2549:'selfreported information about existing conditions or programs. evaluating the survey design and administration assists auditors in evaluating the objectivity, credibility,',
2550:'and reliability of the selfreported information. 8.107 when sampling is used, the appropriate selection method will depend on the audit',
2551:'objectives. when a representative sample is needed, the use of statistical sampling approaches generally results in stronger evidence than that',
2552:'obtained from nonstatistical techniques. when a representative sample is not needed, a targeted selection may be effective if the auditors',
2553:'have isolated risk factors or other criteria to target the selection. overall assessment of evidence requirements: overall assessment of evidence',
2554:'8.108 auditors should perform and document an overall assessment of the collective evidence used to support findings and conclusions, including',
2555:'the results of any specific assessments performed to conclude on the validity and reliability of specific evidence. 8.109 when assessing',
2556:'the overall sufficiency and appropriateness of evidence, auditors should evaluate the expected significance of evidence to the audit objectives, findings,',
2557:'and conclusions; available corroborating evidence; and the level of audit risk. if auditors conclude that evidence is not sufficient or',
2558:'appropriate, they should not use such evidence as support for findings and conclusions. 8.110 when the auditors identify limitations or',
2559:'uncertainties in evidence that is significant to the audit findings and conclusions, they should perform additional procedures, as appropriate. application',
2560:'guidance: overall assessment of evidence 8.111 professional judgments about the sufficiency and appropriateness of evidence are closely interrelated, as auditors',
2561:'interpret the results of audit testing and evaluate whether the nature and extent of the evidence obtained is sufficient and',
2562:'appropriate. 8.112 sufficiency and appropriateness of evidence are relative concepts, which may be thought of as a continuum rather than',
2563:'as absolutes. sufficiency and appropriateness are evaluated in the context of the related findings and conclusions. for example, even though',
2564:'the auditors may identify some limitations or uncertainties about the sufficiency or appropriateness of some of the evidence, they may',
2565:'nonetheless determine that in total there is sufficient, appropriate evidence to support the findings and conclusions. 8.113 the steps to',
2566:'assess evidence may depend on the nature of the evidence, how the evidence is used in the audit or report,',
2567:'and the audit objectives. a. evidence is sufficient and appropriate when it provides a reasonable basis for supporting the findings',
2568:'or conclusions within the context of the audit objectives. b. evidence is not sufficient or appropriate when 1 using the',
2569:'evidence carries an unacceptably high risk that it could lead auditors to reach an incorrect or improper conclusion; 2 the',
2570:'evidence has significant limitations, given the audit objectives and intended use of the evidence; or 3 the evidence does not',
2571:'provide an adequate basis for addressing the audit objectives or supporting the findings and conclusions. 8.114 evidence has limitations or',
2572:'uncertainties when its validity or reliability has not been assessed or cannot be assessed, given the audit objectives and the',
2573:'intended use of the evidence. limitations also include errors identified by the auditors in their testing. 8.115 additional procedures that',
2574:'could address limitations or uncertainties in evidence that are significant to the audit findings and conclusions include a. seeking independent,',
2575:'corroborating evidence from other sources; b. redefining the audit objectives or the audit scope to eliminate the need to use',
2576:'the evidence; c. presenting the findings and conclusions so that the supporting evidence is sufficient and appropriate and describing in',
2577:'the report the limitations or uncertainties with the validity or reliability of the evidence, if such disclosure is necessary to',
2578:'avoid misleading the report users about the findings or conclusions; and d. determining whether to report the limitations or uncertainties',
2579:'as a finding, including any related significant internal control deficiencies. findings requirements: findings 8.116 as part of a performance audit,',
2580:'when auditors identify findings, they should plan and perform procedures to develop the criteria, condition, cause, and effect of the',
2581:'findings to the extent that these elements are relevant and necessary to achieve the audit objectives. 8.117 auditors should consider',
2582:'internal control deficiencies in their evaluation of identified findings when developing the cause element of the identified findings when internal',
2583:'control is significant to the audit objectives. application guidance: findings 8.118 findings may involve deficiencies in internal control; noncompliance with',
2584:'provisions of laws, regulations, contracts, and grant agreements; or instances of fraud. 8.119 given the concept of accountability for use',
2585:'of public resources and government authority, evaluating internal control in a government environment may also include considering internal control deficiencies',
2586:'that result in waste or abuse. because the determination of waste and abuse is subjective, auditors are not required to',
2587:'perform specific procedures to detect waste or abuse in performance audits. however, auditors may consider whether and how to communicate',
2588:'such matters if they become aware of them. auditors may also discover that waste or abuse are indicative of fraud',
2589:'or noncompliance with provisions of laws, regulations, contracts, and grant agreements. 8.120 waste is the act of using or expending',
2590:'resources carelessly, extravagantly, or to no purpose. importantly, waste can include activities that do not include abuse and does not',
2591:'necessarily involve a violation of law. rather, waste relates primarily to mismanagement, inappropriate actions, and inadequate oversight. 8.121 the following',
2592:'are examples of waste, depending on the facts and circumstances: a. making travel choices that are contrary to existing travel',
2593:'policies or are unnecessarily extravagant or expensive. b. making procurement or vendor selections that are contrary to existing policies or',
2594:'are unnecessarily extravagant or expensive. 8.122 abuse is behavior that is deficient or improper when compared with behavior that a',
2595:'prudent person would consider reasonable and necessary business practice given the facts and circumstances, but excludes fraud and noncompliance with',
2596:'provisions of laws, regulations, contracts, and grant agreements. abuse also includes misuse of authority or position for personal financial interests',
2597:'or those of an immediate or close family member or business associate. 8.123 the following are examples of abuse, depending',
2598:'on the facts and circumstances: a. creating unneeded overtime. b. requesting staff to perform personal errands or work tasks for',
2599:'a supervisor or manager. c. misusing the official’s position for personal gain including actions that could be perceived by an',
2600:'objective third party with knowledge of the relevant information as improperly benefiting an official’s personal financial interests or those of',
2601:'an immediate or close family member; a general partner; an organization for which the official serves as an officer, director,',
2602:'trustee, or employee; or an organization with which the official is negotiating concerning future employment. 8.124 criteria: to develop findings,',
2603:'criteria may include the laws, regulations, contracts, grant agreements, standards, measures, expected performance, defined business practices, and benchmarks against which',
2604:'performance is compared or evaluated. criteria identify the required or desired state or expectation with respect to the program or',
2605:'operation. the term program includes processes, projects, studies, policies, operations, activities, entities, and functions. criteria provide a context for evaluating',
2606:'evidence and understanding the findings, conclusions, and recommendations in the report. 8.125 condition: condition is a situation that exists. the',
2607:'condition is determined and documented during the audit. 8.126 cause: the cause is the factor or factors responsible for the',
2608:'difference between the condition and the criteria, and may also serve as a basis for recommendations for corrective actions. common',
2609:'factors include poorly designed policies, procedures, or criteria; inconsistent, incomplete, or incorrect implementation; or factors beyond the control of program',
2610:'management. auditors may assess whether the evidence provides a reasonable and convincing argument for why the stated cause is the',
2611:'key factor contributing to the difference between the condition and the criteria. 8.127 effect or potential effect: the effect or',
2612:'potential effect is the outcome or consequence resulting from the difference between the condition and the criteria. when the audit',
2613:'objectives include identifying the actual or potential consequences of a condition that varies either positively or negatively from the criteria',
2614:'identified in the audit, effect is a measure of those consequences. effect or potential effect may be used to demonstrate',
2615:'the need for corrective action in response to identified problems or relevant risks. 8.128 the elements needed for a finding',
2616:'are related to the objectives of the audit. thus, a finding or set of findings is complete to the extent',
2617:'that the audit objectives are addressed and the report clearly relates those objectives to the elements of a finding. for',
2618:'example, an audit objective may be to determine the current status or condition of program operations or progress in implementing',
2619:'legislative requirements, and not the related cause or effect. in this situation, developing the condition would address the audit objective,',
2620:'and developing the other elements of a finding would not be necessary. 8.129 the cause of a finding may relate',
2621:'to an underlying internal control deficiency. for example, auditors conducting a compliance audit may find that an audited entity has',
2622:'not complied with certain legislation. upon further evaluation, the auditors may find the root cause of the finding to be',
2623:'that one of the entity’s control activities was not properly designed. in this case, the finding would be an instance',
2624:'of noncompliance, but the cause of the finding would be an internal control deficiency. 8.130 considering internal control in the',
2625:'context of a comprehensive internal control framework, such as standards for internal control in the federal government or internal control—integrated',
2626:'framework,78 can help auditors to determine whether underlying internal control deficiencies exist as the root cause of findings. when the',
2627:'audit objectives include explaining why a particular type of positive or negative program performance, output, or outcome identified in the',
2628:'audit occurred, the underlying deficiencies are referred to as cause. identifying the cause of 78the coso framework and the green',
2629:'book provide suitable and available criteria against which management may evaluate and report on the effectiveness of the entity’s internal',
2630:'control. the green book may be adopted by entities beyond those federal entities for which it is legally required, such',
2631:'as state, local, and quasigovernmental entities, as well as other federal entities and notforprofit organizations, as a framework for an',
2632:'internal control system. problems may assist auditors in making constructive recommendations for correction. auditors may identify deficiencies in program design',
2633:'or structure as the cause of deficient performance. auditors may also identify deficiencies in internal control that are significant to',
2634:'the subject matter of the performance audit as the cause of deficient performance. in developing these types of findings, the',
2635:'deficiencies in program design or internal control would be described as the cause. often the causes of deficient program performance',
2636:'are complex and involve multiple factors, including fundamental, systemic root causes. 8.131 when the audit objectives include estimating the extent',
2637:'to which a program has caused changes in physical, social, or economic conditions, “effect” is a measure of the program’s',
2638:'impact. in this case, effect is the extent to which positive or negative changes in actual physical, social, or economic',
2639:'conditions can be identified and attributed to the program. audit documentation requirements: audit documentation 8.132 auditors must prepare audit documentation',
2640:'related to planning, conducting, and reporting for each audit. auditors should prepare audit documentation in sufficient detail to enable an',
2641:'experienced auditor, having no previous connection to the audit, to understand from the audit documentation the nature, timing, extent, and',
2642:'results of audit procedures performed; the evidence obtained; and its source and the conclusions reached, including evidence that supports the',
2643:'auditors’ significant judgments and conclusions. 8.133 auditors should prepare audit documentation that contains evidence that supports the findings, conclusions, and',
2644:'recommendations before they issue their report. 8.134 auditors should design the form and content of audit documentation to meet the',
2645:'circumstances of the particular audit. the audit documentation constitutes the principal record of the work that the auditors have performed',
2646:'in accordance with standards and the conclusions that the auditors have reached. the quantity, type, and content of audit documentation',
2647:'are a matter of the auditors’ professional judgment. 8.135 auditors should document the following: a. the objectives, scope, and methodology',
2648:'of the audit; b. the work performed and evidence obtained to support significant judgments and conclusions, as well as expectations',
2649:'in analytical procedures, including descriptions of transactions and records examined for example, by listing file numbers, case numbers, or other',
2650:'means of identifying specific documents examined, though copies of documents examined or detailed listings of information from those documents are',
2651:'not required; and c. supervisory review, before the audit report is issued, of the evidence that supports the findings, conclusions,',
2652:'and recommendations contained in the audit report. 8.136 when auditors do not comply with applicable gagas requirements because of law,',
2653:'regulation, scope limitations, restrictions on access to records, or other issues affecting the audit, the auditors should document the departure',
2654:'from the gagas requirements and the impact on the audit and on the auditors’ conclusions. application guidance: audit documentation 8.137',
2655:'audit documentation is an essential element of audit quality. the process of preparing and reviewing audit documentation contributes to the',
2656:'quality of an audit. audit documentation serves to 1 provide the principal support for the audit report, 2 aid auditors',
2657:'in conducting and supervising the audit, and 3 allow for the review of audit quality. 8.138 an experienced auditor means',
2658:'an individual whether internal or external to the audit organization who possesses the competencies and skills that would have enabled',
2659:'him or her to conduct the performance audit. these competencies and skills include an understanding of 1 the performance audit',
2660:'processes, 2 gagas and applicable legal and regulatory requirements, 3 the subject matter associated with achieving the audit objectives, and',
2661:'4 issues related to the audited entity’s environment. 8.139 when documenting departures from the gagas requirements, the audit documentation requirements',
2662:'apply to departures from unconditional requirements and from presumptively mandatory requirements when alternative procedures performed in the circumstances were not',
2663:'sufficient to achieve the objectives of the requirements. availability of individuals and documentation requirement: availability of individuals and documentation 8.140',
2664:'subject to applicable provisions of laws and regulations, auditors should make appropriate individuals and audit documentation available upon request and',
2665:'in a timely manner to other auditors or reviewers. application guidance: availability of individuals and documentation 8.141 underlying gagas audits',
2666:'is the premise that audit organizations in federal, state, and local governments and public accounting firms engaged to conduct audits',
2667:'in accordance with gagas cooperate in auditing programs of common interest so that auditors may use others’ work and avoid',
2668:'duplication of efforts. the use of auditors’ work by other auditors may be facilitated by contractual arrangements for gagas audits',
2669:'that provide for full and timely access to appropriate individuals and to audit documentation. figure 4: consideration of internal control',
2670:'in a generally accepted government auditing standards performance audit chapter 9: reporting standards for performance audits 9.01 this chapter contains',
2671:'reporting requirements and guidance for performance audits conducted in accordance with generally accepted government auditing standards gagas. reporting requirements establish',
2672:'the auditors’ overall approach for communicating the results of a performance audit. for performance audits conducted in accordance with gagas,',
2673:'the requirements and guidance in chapters 1 through 5 and chapter 8 also apply. 9.02 the reporting requirements for performance',
2674:'audits relate to reporting the auditors’ compliance with gagas, the form of the report, the report contents, obtaining the views',
2675:'of responsible officials, report distribution, reporting confidential or sensitive information, and discovery of insufficient evidence after report release. reporting auditors’',
2676:'compliance with gagas requirements: reporting auditors’ compliance with gagas 9.03 when auditors comply with all applicable gagas requirements, they should',
2677:'use the following language, which represents an unmodified gagas compliance statement, in the audit report to indicate that they conducted',
2678:'the audit in accordance with gagas: we conducted this performance audit in accordance with generally accepted government auditing standards. those',
2679:'standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for',
2680:'our findings and conclusions based on our audit objectives. we believe that the evidence obtained provides a reasonable basis for',
2681:'our findings and conclusions based on our audit objectives. 9.04 audit organizations that meet the independence requirements for internal audit',
2682:'organizations, but not those for external audit organizations, should include in the gagas compliance statement, where applicable, a statement that',
2683:'they are independent per the gagas requirements for internal auditors. 9.05 when auditors do not comply with all applicable gagas',
2684:'requirements, they should include a modified gagas compliance statement in the audit report. for performance audits, auditors should use a',
2685:'statement that includes either 1 the language in paragraph 9.03, modified to indicate the requirements that were not followed, or',
2686:'2 language indicating that the auditors did not follow gagas. report format requirements: report format 9.06 auditors should issue audit',
2687:'reports communicating the results of each completed performance audit. 9.07 auditors should issue the audit report in a form that',
2688:'is appropriate for its intended use, either in writing or in some other retrievable form.79 79see paras. 9.56 through 9.67',
2689:'for a discussion of report distribution and reporting confidential or sensitive information. application guidance: report format 9.08 the purposes of',
2690:'audit reports are to 1 clearly communicate the results of audits to those charged with governance, the appropriate officials of',
2691:'the audited entity, and the appropriate oversight officials and 2 facilitate followup to determine whether appropriate corrective actions have been',
2692:'taken. 9.09 auditors may present audit reports using electronic media through which report users and the audit organization can retrieve',
2693:'them. the users’ needs will influence the form of the audit report. different forms of audit reports include written reports,',
2694:'letters, briefing slides, or other presentation materials. report content requirements: report content, including objectives, scope, and methodology 9.10 auditors should',
2695:'prepare audit reports that contain 1 the objectives, scope, and methodology of the audit; 2 the audit results, including findings,',
2696:'conclusions, and recommendations, as appropriate; 3 a summary of the views of responsible officials; and 4 if applicable, the nature',
2697:'of any confidential or sensitive information omitted. 9.11 auditors should communicate audit objectives in the audit report in a clear,',
2698:'specific, neutral, and unbiased manner that includes relevant assumptions. in order to avoid potential misunderstanding, when audit objectives are limited',
2699:'but users could infer broader objectives, auditors should state in the audit report that certain issues were outside the scope',
2700:'of the audit. 9.12 auditors should describe the scope of the work performed and any limitations, including issues that would',
2701:'be relevant to likely users, so that report users can reasonably interpret the findings, conclusions, and recommendations in the report',
2702:'without being misled. auditors should also report any significant constraints imposed on the audit approach by information limitations or scope',
2703:'impairments, including denials of, or excessive delays in, access to certain records or individuals. 9.13 in describing the work performed',
2704:'to address the audit objectives and support the reported findings and conclusions, auditors should, as applicable, explain the relationship between',
2705:'the population and the items tested; identify entities, geographic locations, and the period covered; report the kinds and sources of',
2706:'evidence; and explain any significant limitations or uncertainties based on the auditors’ overall assessment of the sufficiency and appropriateness of',
2707:'the evidence in the aggregate. 9.14 in reporting audit methodology, auditors should explain how the completed audit work supports the',
2708:'audit objectives, including the evidencegathering and evidenceanalysis techniques, in sufficient detail to allow knowledgeable users of their reports to understand',
2709:'how the auditors addressed the audit objectives. auditors should identify significant assumptions made in conducting the audit; describe comparative techniques',
2710:'applied; describe the criteria used; and, when the results of sample testing significantly support the auditors’ findings, conclusions, or recommendations,',
2711:'describe the sample design and state why the design was chosen, including whether the results can be projected to the',
2712:'intended population. application guidance: report content, including objectives, scope, and methodology 9.15 report users need information regarding the audit objectives,',
2713:'scope, and methodology to understand the purpose of the audit; the nature and extent of the audit work performed; the',
2714:'context and perspective regarding what is reported; and any significant limitations in the audit objectives, scope, or methodology. 9.16 in',
2715:'reporting audit methodology, auditors may include a description of the procedures performed as part of their assessment of the sufficiency',
2716:'and appropriateness of information used as audit evidence. 9.17 the auditor may use the report quality elements of accurate, objective,',
2717:'complete, convincing, clear, concise, and timely when developing and writing the audit report as the subject permits. a. accurate: an',
2718:'accurate report is supported by sufficient, appropriate evidence with key facts, figures, and findings being traceable to the audit evidence.',
2719:'reports that are factbased, with a clear statement of sources, methods, and assumptions so that report users can judge how',
2720:'much weight to give the evidence reported, assist in achieving accuracy. disclosing data limitations and other disclosures also contribute to',
2721:'producing more accurate audit reports. reports also are more accurate when the findings are presented in the broader context of',
2722:'the issue. one way to help the audit organization prepare accurate audit reports is to use a quality control process',
2723:'such as referencing. referencing is a process in which an experienced auditor who is independent of the audit checks that',
2724:'statements of facts, figures, and dates are correctly reported; the findings are adequately supported by the evidence in the audit',
2725:'documentation; and the conclusions and recommendations flow logically from the evidence. b. objective: objective means that the presentation of the',
2726:'report is balanced in content and tone. a report’s credibility is significantly enhanced when it presents evidence in an unbiased',
2727:'manner and in the proper context. this means presenting the audit results impartially and fairly. the tone of reports may',
2728:'encourage decision makers to act on the auditors’ findings and recommendations. this balanced tone can be achieved when reports present',
2729:'sufficient, appropriate evidence to support conclusions while refraining from using adjectives or adverbs that characterize evidence in a way that',
2730:'implies criticism or unsupported conclusions. the objectivity of audit reports is enhanced when the report explicitly states the source of',
2731:'the evidence and the assumptions used in the analysis. the report may recognize the positive aspects of the program reviewed',
2732:'if applicable to the audit objectives. inclusion of positive program aspects may lead to improved performance by other government organizations',
2733:'that read the report. audit reports are more objective when they demonstrate that the work has been performed by professional,',
2734:'unbiased, independent, and knowledgeable personnel. c. complete: being complete means that the report contains sufficient, appropriate evidence needed to satisfy',
2735:'the audit objectives and promote an understanding of the matters reported. it also means the report states evidence and findings',
2736:'without omission of significant relevant information related to the audit objectives. providing report users with an understanding means providing perspective',
2737:'on the extent and significance of reported findings, such as the frequency of occurrence relative to the number of cases',
2738:'or transactions tested and the relationship of the findings to the entity’s operations. being complete also means clearly stating what',
2739:'was and was not done and explicitly describing data limitations, constraints imposed by restrictions on access to records, or other',
2740:'issues. d. convincing: being convincing means that the audit results are responsive to the audit objectives, that the findings are',
2741:'presented persuasively, and that the conclusions and recommendations flow logically from the facts presented. the validity of the findings, the',
2742:'reasonableness of the conclusions, and the benefit of implementing the recommendations are more convincing when supported by sufficient, appropriate evidence.',
2743:'reports designed in this way can help focus the attention of responsible officials on the matters that warrant attention and',
2744:'can provide an incentive for taking corrective action. e. clear: clarity means the report is easy for the intended user',
2745:'to read and understand. preparing the report in language as clear and simple as the subject permits assists auditors in',
2746:'achieving this goal. use of straightforward, nontechnical language is helpful to simplify presentation. defining technical terms, abbreviations, and acronyms that',
2747:'are used in the report is also helpful. auditors may use a highlights page or summary within the report to',
2748:'capture the report user’s attention and highlight the overall message. if a summary is used, it is helpful if it',
2749:'focuses on the audit objectives, summarizes the audit’s most significant findings and the report’s principal conclusions, and prepares users to',
2750:'anticipate the major recommendations. logical organization of material and accuracy and precision in stating facts and in drawing conclusions assist',
2751:'in the report’s clarity and understandability. effective use of titles and captions and topic sentences makes the report easier to',
2752:'read and understand. visual aids such as pictures, charts, graphs, and maps may help clarify and summarize complex material. f.',
2753:'concise: being concise means that the report is no longer than necessary to convey and support the message. extraneous detail',
2754:'detracts from a report and may even conceal the real message and confuse or distract the users. although room exists',
2755:'for considerable judgment in determining the content of reports, those that are factbased but concise are likely to achieve results.',
2756:'g. timely: to be of maximum use, providing relevant evidence in time to respond to officials of the audited entity,',
2757:'legislative officials, and other users’ legitimate needs is the auditors’ goal. likewise, the evidence provided in the report is more',
2758:'helpful if it is current. therefore, the timely issuance of the report is an important reporting goal for auditors. during',
2759:'the audit, the auditors may provide interim reports of significant matters to appropriate entity and oversight officials. such communication alerts',
2760:'officials to matters needing immediate attention and allows them to take corrective action before the final report is completed. reporting',
2761:'findings, conclusions, and recommendations requirements: reporting findings, conclusions, and recommendations 9.18 in the audit report, auditors should present sufficient, appropriate',
2762:'evidence to support the findings and conclusions in relation to the audit objectives. auditors should provide recommendations for corrective action',
2763:'if findings are significant within the context of the audit objectives. 9.19 auditors should report conclusions based on the audit',
2764:'objectives and the audit findings. 9.20 auditors should describe in their report limitations or uncertainties with the reliability or validity',
2765:'of evidence if 1 the evidence is significant to the findings and conclusions within the context of the audit objectives',
2766:'and 2 such disclosure is necessary to avoid misleading the report users about the findings and conclusions. auditors should describe',
2767:'the limitations or uncertainties regarding evidence in conjunction with the findings and conclusions, in addition to describing those limitations or',
2768:'uncertainties as part of the objectives, scope, and methodology. 9.21 auditors should place their findings in perspective by describing the',
2769:'nature and extent of the issues being reported and the extent of the work performed that resulted in the findings.',
2770:'to give the reader a basis for judging the prevalence and consequences of these findings, auditors should, as appropriate, relate',
2771:'the instances identified to the population or the number of cases examined and quantify the results in terms of dollar',
2772:'value or other measures. if the results cannot be projected, auditors should limit their conclusions appropriately. 9.22 when reporting on',
2773:'the results of their work, auditors should disclose significant facts relevant to the objectives of their work and known to',
2774:'them that if not disclosed could mislead knowledgeable users, misrepresent the results, or conceal significant improper or illegal practices. 9.23',
2775:'when feasible, auditors should recommend actions to correct deficiencies and other findings identified during the audit and to improve programs',
2776:'and operations when the potential for improvement in programs, operations, and performance is substantiated by the reported findings and conclusions.',
2777:'auditors should make recommendations that flow logically from the findings and conclusions, are directed at resolving the cause of identified',
2778:'deficiencies and findings, and clearly state the actions recommended. application guidance: reporting findings, conclusions, and recommendations 9.24 the extent to',
2779:'which the elements for a finding are developed depends on the audit objectives. clearly developed findings assist management and oversight',
2780:'officials of the audited entity in understanding the need for taking corrective action. 9.25 as discussed in paragraphs 8.108 through',
2781:'8.115, even though the auditors may have some uncertainty about the sufficiency or appropriateness of some of the evidence, they',
2782:'may nonetheless determine that in total there is sufficient, appropriate evidence given the findings and conclusions. describing limitations provides report',
2783:'users with a clear understanding of how much responsibility the auditors are taking for the information. 9.26 auditors may provide',
2784:'background information to establish the context for the overall message and to help the reader understand the findings and significance',
2785:'of the issues discussed. appropriate background information may include information on how programs and operations work; the significance of programs',
2786:'and operations e.g., dollars, effect, purposes, and past audit work, if relevant; a description of the audited entity’s responsibilities; and',
2787:'explanation of terms, organizational structure, and the statutory basis for the program and operations. 9.27 report conclusions are logical inferences',
2788:'about the program based on the auditors’ findings, not merely a summary of the findings. the strength of the auditors’',
2789:'conclusions depends on the persuasiveness of the evidence supporting the findings and the soundness of the logic used to formulate',
2790:'the conclusions. conclusions are more compelling if they lead to recommendations and convince a knowledgeable user of the report that',
2791:'action is necessary. 9.28 effective recommendations encourage improvements in the conduct of government programs and operations. recommendations are effective when',
2792:'they are addressed to parties with the authority to act and when the recommended actions are specific, feasible, costeffective, and',
2793:'measurable. reporting on internal control requirements: reporting on internal control 9.29 when internal control is significant within the context of',
2794:'the audit objectives, auditors should include in the audit report 1 the scope of their work on internal control and',
2795:'2 any deficiencies in internal control that are significant within the context of the audit objectives and based upon the',
2796:'audit work performed. 9.30 when reporting on the scope of their work on internal control, auditors should identify the scope',
2797:'of internal control assessed to the extent necessary for report users to reasonably interpret the findings, conclusions, and recommendations in',
2798:'the audit report. 9.31 when auditors detect deficiencies in internal control that are not significant to the objectives of the',
2799:'audit but warrant the attention of those charged with governance, they should include those deficiencies either in the report or',
2800:'communicate those deficiencies in writing to audited entity officials. if the written communication is separate from the audit report, auditors',
2801:'should refer to that written communication in the audit report. application guidance: reporting on internal control 9.32 auditors may identify',
2802:'the control components, underlying principles, control objectives, or specific controls assessed in describing the scope of their work on internal',
2803:'control. auditors may also identify the level of internal control assessment performed, as discussed in paragraph 8.50. control components and',
2804:'underlying principles that are not considered significant to the audit objectives may be identified in the scope if, in the',
2805:'auditors’ professional judgment, doing so is necessary to preclude a misunderstanding of the breadth of the conclusions of the audit',
2806:'report and to clarify that control effectiveness has not been evaluated as a whole. auditors may also identify and describe',
2807:'the five components of internal control so that report users understand the scope of the work within the context of',
2808:'the entity’s internal control system. 9.33 an internal control system is effective if the five components of internal control are',
2809:'effectively designed, implemented, and operating, and are operating together in an integrated manner. the principles support the effective design, implementation,',
2810:'and operation of the associated components and represent requirements necessary to establish an effective internal control system. if a principle',
2811:'is not applied effectively, then the respective component cannot be effective. if a principle or component is not effective, or',
2812:'the components are not operating together in an integrated manner, then an internal control system cannot be effective. 9.34 when',
2813:'auditors detect deficiencies in internal control that do not warrant the attention of those charged with governance, determining whether and',
2814:'how to communicate such deficiencies to audited entity officials is a matter of professional judgment. reporting on noncompliance with provisions',
2815:'of laws, regulations, contracts, and grant agreements requirements: reporting on noncompliance with provisions of laws, regulations, contracts, and grant agreements',
2816:'9.35 auditors should report a matter as a finding when they conclude, based on sufficient, appropriate evidence, that noncompliance with',
2817:'provisions of laws, regulations, contracts, and grant agreements either has occurred or is likely to have occurred that is significant',
2818:'within the context of the audit objectives. 9.36 auditors should communicate findings in writing to audited entity officials when the',
2819:'auditors detect instances of noncompliance with provisions of laws, regulations, contracts, and grant agreements that are not significant within the',
2820:'context of the audit objectives but warrant the attention of those charged with governance. application guidance: reporting on noncompliance with',
2821:'provisions of laws, regulations, contracts, and grant agreements 9.37 whether a particular act is, in fact, noncompliance with provisions of',
2822:'laws, regulations, contracts, and grant agreements may have to await final determination by a court of law or other adjudicative',
2823:'body.80 80see paras. 8.27 through 8.29 for a discussion of investigations or legal proceedings. 9.38 when auditors detect instances of',
2824:'noncompliance with provisions of laws, regulations, contracts, and grant agreements that do not warrant the attention of those charged with',
2825:'governance, the auditors’ determination of whether and how to communicate such instances to audited entity officials is a matter of',
2826:'professional judgment. 9.39 when noncompliance with provisions of laws, regulations, contracts, and grant agreements either has occurred or is likely',
2827:'to have occurred, auditors may consult with authorities or legal counsel about whether publicly reporting such information would compromise investigative',
2828:'or legal proceedings. auditors may limit their public reporting to matters that would not compromise those proceedings and, for example,',
2829:'report only on information that is already a part of the public record. reporting on instances of fraud requirements: reporting',
2830:'on instances of fraud 9.40 auditors should report a matter as a finding when they conclude, based on sufficient, appropriate',
2831:'evidence, that fraud either has occurred or is likely to have occurred that is significant to the audit objectives. 9.41',
2832:'auditors should communicate findings in writing to audited entity officials when the auditors detect instances of fraud that are not',
2833:'significant within the context of the audit objectives but warrant the attention of those charged with governance. application guidance: reporting',
2834:'on instances of fraud 9.42 whether a particular act is, in fact, fraud may have to await final determination by',
2835:'a court of law or other adjudicative body.81 81see paras. 8.27 through 8.29 for a discussion of investigations or legal',
2836:'proceedings. 9.43 when auditors detect instances of fraud that do not warrant the attention of those charged with governance, the',
2837:'auditors’ determination of whether and how to communicate such instances to audited entity officials is a matter of professional judgment.',
2838:'9.44 when auditors conclude fraud has occurred or is likely to have occurred, auditors may consult with authorities or legal',
2839:'counsel about whether publicly reporting such information would compromise investigative or legal proceedings. auditors may limit their public reporting to',
2840:'matters that would not compromise those proceedings and, for example, report only on information that is already a part of',
2841:'the public record. reporting findings directly to parties outside the audited entity requirements: reporting findings directly to parties outside the',
2842:'audited entity 9.45 auditors should report known or likely noncompliance with provisions of laws, regulations, contracts, and grant agreements or',
2843:'fraud directly to parties outside the audited entity in the following two circumstances. a. when audited entity management fails to',
2844:'satisfy legal or regulatory requirements to report such information to external parties specified in law or regulation, auditors should first',
2845:'communicate the failure to report such information to those charged with governance. if the audited entity still does not report',
2846:'this information to the specified external parties as soon as practicable after the auditors’ communication with those charged with governance,',
2847:'then the auditors should report the information directly to the specified external parties. b. when audited entity management fails to',
2848:'take timely and appropriate steps to respond to noncompliance with provisions of laws, regulations, contracts, and grant agreements or instances',
2849:'of fraud that 1 are likely to have a significant effect on the subject matter and 2 involve funding received',
2850:'directly or indirectly from a government agency, auditors should first report management’s failure to take timely and appropriate steps to',
2851:'those charged with governance. if the audited entity still does not take timely and appropriate steps as soon as practicable',
2852:'after the auditors’ communication with those charged with governance, then the auditors should report the audited entity’s failure to take',
2853:'timely and appropriate steps directly to the funding agency. 9.46 auditors should comply with the requirements in paragraph 9.45 even',
2854:'if they have resigned or been dismissed from the audit prior to its completion. 9.47 auditors should obtain sufficient, appropriate',
2855:'evidence, such as confirmation from outside parties, to corroborate representations by audited entity management that it has reported audit findings',
2856:'in accordance with provisions of laws, regulations, or funding agreements. when auditors are unable to do so, they should report',
2857:'such information directly, as discussed in paragraphs 9.45 and 9.46. application guidance: reporting findings directly to parties outside the audited',
2858:'entity 9.48 the reporting in paragraph 9.45 is in addition to any legal requirements to report such information directly to',
2859:'parties outside the audited entity. 9.49 internal audit organizations do not have a duty to report outside the audited entity',
2860:'unless required by law, regulation, or policy. obtaining the views of responsible officials requirements: obtaining the views of responsible officials',
2861:'9.50 auditors should obtain and report the views of responsible officials of the audited entity concerning the findings, conclusions, and',
2862:'recommendations in the audit report, as well as any planned corrective actions. 9.51 when auditors receive written comments from the',
2863:'responsible officials, they should include in their report a copy of the officials’ written comments or a summary of the',
2864:'comments received. when the responsible officials provide oral comments only, auditors should prepare a summary of the oral comments, provide',
2865:'a copy of the summary to the responsible officials to verify that the comments are accurately represented, and include the',
2866:'summary in their report. 9.52 when the audited entity’s comments are inconsistent or in conflict with the findings, conclusions, or',
2867:'recommendations in the draft report, the auditors should evaluate the validity of the audited entity’s comments. if the auditors disagree',
2868:'with the comments, they should explain in the report their reasons for disagreement. conversely, the auditors should modify their report',
2869:'as necessary if they find the comments valid and supported by sufficient, appropriate evidence. 9.53 if the audited entity refuses',
2870:'to provide comments or is unable to provide comments within a reasonable period of time, the auditors may issue the',
2871:'report without receiving comments from the audited entity. in such cases, the auditors should indicate in the report that the',
2872:'audited entity did not provide comments. application guidance: obtaining the views of responsible officials 9.54 providing a draft report with',
2873:'findings for review and comment by responsible officials of the audited entity and others helps the auditors develop a report',
2874:'that is fair, complete, and objective. including the views of responsible officials results in a report that presents not only',
2875:'the auditors’ findings, conclusions, and recommendations, but also the perspectives of the audited entity’s responsible officials and the corrective actions',
2876:'they plan to take. obtaining the comments in writing is preferred, but oral comments are acceptable. in cases in which',
2877:'the audited entity provides technical comments in addition to its written or oral comments on the report, auditors may disclose',
2878:'in the report that such comments were received. technical comments address points of fact or are editorial in nature and',
2879:'do not address substantive issues, such as methodology, findings, conclusions, or recommendations. 9.55 obtaining oral comments may be appropriate when,',
2880:'for example, there is a reporting date critical to meeting a user’s needs; auditors have worked closely with the responsible',
2881:'officials throughout the engagement, and the parties are familiar with the findings and issues addressed in the draft report; or',
2882:'the auditors do not expect major disagreements with findings, conclusions, or recommendations in the draft report, or major controversies with',
2883:'regard to the issues discussed in the draft report. report distribution requirements: report distribution 9.56 distribution of reports completed in',
2884:'accordance with gagas depends on the auditors’ relationship with the audited organization and the nature of the information contained in',
2885:'the reports. auditors should document any limitation on report distribution. auditors should make audit reports available to the public, unless',
2886:'distribution is specifically limited by the terms of the engagement, law, or regulation. report distribution for internal auditors 9.57 if',
2887:'an internal audit organization in a government entity follows the institute of internal auditors’ international standards for the professional practice',
2888:'of internal auditing as well as gagas, the head of the internal audit organization should communicate results to the parties',
2889:'who can ensure that the results are given due consideration. if not otherwise mandated by statutory or regulatory requirements, prior',
2890:'to releasing results to parties outside the organization, the head of the internal audit organization should 1 assess the potential',
2891:'risk to the organization, 2 consult with senior management or legal counsel as appropriate, and 3 control dissemination by indicating',
2892:'the intended users in the report. report distribution for external auditors 9.58 an audit organization in a government entity should',
2893:'distribute audit reports to those charged with governance, to the appropriate audited entity officials, and to the appropriate oversight bodies',
2894:'or organizations requiring or arranging for the audits. as appropriate, auditors should also distribute copies of the reports to other',
2895:'officials who have legal oversight authority or who may be responsible for acting on audit findings and recommendations and to',
2896:'others authorized to receive such reports. 9.59 a public accounting firm contracted to conduct an audit in accordance with gagas',
2897:'should clarify report distribution responsibilities with the engaging party. if the contracting firm is responsible for the distribution, it should',
2898:'reach agreement with the party contracting for the audit about which officials or organizations will receive the report and the',
2899:'steps being taken to make the report available to the public. application guidance: report distribution for external auditors 9.60 making',
2900:'an audit report available to the public can involve auditors posting the audit report to their publicly accessible websites or',
2901:'verifying that the audited entity has posted the audit report to its publicly accessible website. reporting confidential or sensitive information',
2902:'requirements: reporting confidential or sensitive information 9.61 if certain information is prohibited from public disclosure or is excluded from a',
2903:'report because of its confidential or sensitive nature, auditors should disclose in the report that certain information has been omitted',
2904:'and the circumstances that make the omission necessary. 9.62 when circumstances call for omission of certain information, auditors should evaluate',
2905:'whether this omission could distort the audit results or conceal improper or illegal practices and revise the report language as',
2906:'necessary to avoid report users drawing inappropriate conclusions from the information presented. 9.63 when the audit organization is subject to',
2907:'public records laws, auditors should determine whether public records laws could affect the availability of classified or limited use reports',
2908:'and determine whether other means of communicating with management and those charged with governance would be more appropriate. auditors use',
2909:'judgment to determine the appropriate means to communicate the omitted information to management and those charged with governance considering, among',
2910:'other things, whether public records laws could affect the availability of classified or limited use reports. application guidance: reporting confidential',
2911:'or sensitive information 9.64 if the report refers to the omitted information, the reference may be general and not specific.',
2912:'if the omitted information is not necessary to meet the audit objectives, the report need not refer to its omission.',
2913:'9.65 certain information may be classified or may otherwise be prohibited from general disclosure by federal, state, or local laws',
2914:'or regulations. in such circumstances, auditors may issue a separate, classified, or limited use report containing such information and distribute',
2915:'the report only to persons authorized by law or regulation to receive it. 9.66 additional circumstances associated with public safety,',
2916:'privacy, or security concerns could justify the exclusion of certain information from a publicly available or widely distributed report. for',
2917:'example, detailed information related to computer security for a particular program may be excluded from publicly available reports because of',
2918:'the potential damage that misuse of this information could cause. in such circumstances, auditors may issue a limited use report',
2919:'containing such information and distribute the report only to those parties responsible for acting on the auditors’ recommendations. in some',
2920:'instances, it may be appropriate to issue both a publicly available report with the sensitive information excluded and a limited',
2921:'use report. the auditors may consult with legal counsel regarding any requirements or other circumstances that may necessitate omitting certain',
2922:'information. considering the broad public interest in the program or activity under audit assists auditors when deciding whether to exclude',
2923:'certain information from publicly available reports. 9.67 in cases described in paragraph 9.63, auditors may communicate general information in a',
2924:'written report and communicate detailed information orally. auditors may consult with legal counsel regarding applicable public records laws. discovery of',
2925:'insufficient evidence after report release requirement: discovery of insufficient evidence after report release 9.68 if, after the report is issued,',
2926:'the auditors discover that they did not have sufficient, appropriate evidence to support the reported findings or conclusions, they should',
2927:'communicate in the same manner as that used to originally distribute the report to those charged with governance, the appropriate',
2928:'officials of the audited entity, the appropriate officials of the entities requiring or arranging for the audits, and other known',
2929:'users, so that they do not continue to rely on the findings or conclusions that were not supported. if the',
2930:'report was previously posted to the auditors’ publicly accessible website, the auditors should remove the report and post a public',
2931:'notification that the report was removed. the auditors should then determine whether to perform the additional audit work necessary to',
2932:'either reissue the report, including any revised findings or conclusions, or repost the original report if the additional audit work',
2933:'does not result in a change in findings or conclusions. glossary the following terms are provided to assist in clarifying',
2934:'the government auditing standards. the most relevant paragraph numbers are provided for reference. when terminology differs from that used at',
2935:'an organization subject to generally accepted government auditing standards gagas, auditors use professional judgment to determine if there is an',
2936:'equivalent term. abuse: behavior that is deficient or improper when compared with behavior that a prudent person would consider reasonable',
2937:'and necessary business practice given the facts and circumstances, but excludes fraud and noncompliance with provisions of laws, regulations, contracts,',
2938:'and grant agreements. paragraphs 6.23, 7.25, and 8.122 agreedupon procedures engagement: consists of auditors performing specific procedures on subject matter',
2939:'or an assertion and reporting findings without providing an opinion or a conclusion on it. paragraph 1.18c appropriateness: the measure',
2940:'of the quality of evidence that encompasses the relevance, validity, and reliability of evidence used for addressing the audit objectives',
2941:'and supporting findings and conclusions. paragraph 8.102 attestation engagement: an examination, review, or agreedupon procedures engagement conducted under the gagas',
2942:'attestation standards related to subject matter or an assertion that is the responsibility of another party. paragraph 1.27a audit: either',
2943:'a financial audit or performance audit conducted in accordance with gagas. paragraph 1.27b audit objectives: what the audit is intended',
2944:'to accomplish. they identify the audit subject matter and performance aspects to be included. audit objectives can be thought of',
2945:'as questions about the program that the auditors seek to answer based on evidence obtained and assessed against criteria. audit',
2946:'objectives may also pertain to the current status or condition of a program. paragraph 8.08 audit organization: a government audit',
2947:'entity or a public accounting firm or other audit entity that conducts gagas engagements. paragraph 1.27c audit procedures: the specific',
2948:'steps and tests auditors perform to address the audit objectives. paragraph 8.11 audit report: a report issued as a result',
2949:'of a financial audit, attestation engagement, review of financial statements, or performance audit conducted in accordance with gagas. paragraph 1.27d',
2950:'audit risk: the possibility that the auditors’ findings, conclusions, recommendations, or assurance may be improper or incomplete. the assessment of',
2951:'audit risk involves both qualitative and quantitative considerations. paragraph 8.16 audited entity: the entity that is subject to a gagas',
2952:'engagement, whether that engagement is a financial audit, attestation engagement, review of financial statements, or performance audit. paragraph 1.27e auditor:',
2953:'an individual assigned to planning, directing, performing engagement procedures or reporting on gagas engagements including work on audits, attestation engagements,',
2954:'and reviews of financial statements regardless of job title. therefore, individuals who may have the title auditor, information technology auditor,',
2955:'analyst, practitioner, evaluator, inspector, or other similar titles are considered auditors under gagas. paragraph 1.27f bias threat: the threat that',
2956:'an auditor will, as a result of political, ideological, social, or other convictions, take a position that is not objective.',
2957:'paragraph 3.30c cause: the factor or factors responsible for the difference between the condition and the criteria, which may also',
2958:'serve as a basis for recommendations for corrective actions. paragraphs 6.27, 7.29, and 8.126 competence: the knowledge, skills, and abilities,',
2959:'obtained from education and experience, necessary to conduct the gagas engagement. competence enables auditors to make sound professional judgments. competence',
2960:'includes possessing the technical knowledge and skills necessary for the assigned role and the type of work being done. this',
2961:'includes possessing specific knowledge about gagas. paragraph 4.05 condition: a situation that exists. the condition is determined and documented during',
2962:'the engagement. paragraphs 6.26, 7.28, and 8.125 control objective: the aim or purpose of specified controls; control objectives address the',
2963:'risks related to achieving an entity’s objectives. paragraph 1.27g cpe programs: structured educational activities or programs with learning objectives designed',
2964:'to maintain or enhance the auditors’ competence to address engagement objectives and perform work in accordance with gagas. paragraph 4.32',
2965:'criteria: laws, regulations, contracts, grant agreements, standards, measures, expected performance, defined business practices, and benchmarks against which performance is compared',
2966:'or evaluated. criteria identify the required or desired state or expectation with respect to the program or operation. criteria provide',
2967:'a context for evaluating evidence and understanding the findings, conclusions, and recommendations in the report. paragraphs 6.25, 7.27, and 8.124',
2968:'directing: supervising the efforts of others who are involved in accomplishing the objectives of the engagement or reviewing engagement work',
2969:'to determine whether those objectives have been accomplished. paragraph 4.11b education: a structured and systematic process aimed at developing knowledge,',
2970:'skills, and other abilities; it is a process that is typically but not exclusively conducted in academic or learning environments.',
2971:'paragraph 4.06 effect or potential effect: the outcome or consequence resulting from the difference between the condition and the criteria.',
2972:'paragraphs 6.28, 7.30, and 8.127 engagement: a financial audit, attestation engagement, review of financial statements, or performance audit conducted in',
2973:'accordance with gagas. paragraph 1.27h engagement partner or director: the partner or director assigned responsibility for a specific engagement as',
2974:'designated by the audit organization. paragraph 5.37 engagement team or audit team: auditors assigned to planning, directing, performing engagement procedures',
2975:'or reporting on gagas engagements. paragraph 1.27i engaging party: the party that engages the auditor to conduct a gagas engagement.',
2976:'paragraph 1.27j entity objective: what an entity wants to achieve; entity objectives are intended to meet the entity’s mission, strategic',
2977:'plan, and goals and the requirements of applicable laws and regulations. paragraph 1.27k examination: consists of obtaining reasonable assurance by',
2978:'obtaining sufficient, appropriate evidence about the measurement or evaluation of subject matter against criteria in order to be able to',
2979:'draw reasonable conclusions on which to base the auditor’s opinion about whether the subject matter is in accordance with or',
2980:'based on the criteria or the assertion is fairly stated, in all material respects. paragraph 1.18a experience: workplace activities that',
2981:'are relevant to developing professional proficiency. paragraph 4.06 external audit organization: an audit organization that issues reports to third parties',
2982:'external to the audited entity, either exclusively or in addition to issuing reports to senior management and those charged with',
2983:'governance of the audited entity. paragraph 1.27l familiarity threat: the threat that aspects of a relationship with management or personnel',
2984:'of an audited entity, such as a close or long relationship, or that of an immediate or close family member,',
2985:'will lead an auditor to take a position that is not objective. paragraph 3.30d financial audits: provide an independent assessment',
2986:'of whether an entity’s reported financial information e.g., financial condition, results, and use of resources is presented fairly, in all',
2987:'material respects, in accordance with recognized criteria. paragraph 1.17 finding: an issue that may involve a deficiency in internal control;',
2988:'noncompliance with provisions of laws, regulations, contracts, or grant agreements; or instances of fraud. elements of a finding generally include',
2989:'criteria, condition, cause, and effect or potential effect. paragraphs 6.17, 6.19, 7.19, 7.21, 8.116, and 8.118 fraud: involves obtaining something',
2990:'of value through willful misrepresentation. whether an act is, in fact, fraud is determined through the judicial or other adjudicative',
2991:'system and is beyond auditors’ professional responsibility. paragraph 8.73 independence in appearance: the absence of circumstances that would cause a',
2992:'reasonable and informed third party to reasonably conclude that the integrity, objectivity, or professional skepticism of an audit organization or',
2993:'member of the engagement team had been compromised. paragraph 3.21b independence of mind: the state of mind that permits the',
2994:'conduct of an engagement without being affected by influences that compromise professional judgment, thereby allowing an individual to act with',
2995:'integrity and exercise objectivity and professional skepticism. paragraph 3.21a inputs: the amount of resources in terms of, for example, money,',
2996:'material, or personnel that is put into a program. these resources may come from within or outside the entity operating',
2997:'the program. measures of inputs can have a number of dimensions, such as cost, timing, and quality. paragraph 8.38d integrity:',
2998:'auditors performing their work with an attitude that is objective, factbased, nonpartisan, and nonideological with regard to audited entities and',
2999:'users of the audit reports and making decisions consistent with the public interest of the program or activity under audit.',
3000:'paragraphs 3.09 and 3.10 internal audit organization: an audit organization that is accountable to senior management and those charged with',
3001:'governance of the audited entity and that does not generally issue reports to third parties external to the audited entity.',
3002:'paragraph 1.27m internal control: a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance',
3003:'that the objectives of an entity will be achieved. paragraph 1.22b likelihood of occurrence: the possibility of a deficiency impacting',
3004:'an entity’s ability to achieve its objectives. paragraph 8.56b magnitude of impact: the likely effect that a deficiency could have',
3005:'on the entity achieving its objectives. paragraph 8.56a management participation threat: the threat that results from an auditor’s taking on',
3006:'the role of management or otherwise performing management functions on behalf of the audited entity, which will lead an auditor',
3007:'to take a position that is not objective. paragraph 3.30f methodology: the nature and extent of audit procedures for gathering',
3008:'and analyzing evidence to address the audit objectives. paragraph 8.11 monitoring of quality: a process comprising an ongoing consideration and',
3009:'evaluation of the audit organization’s system of quality control. paragraph 5.47 nature of the deficiency: involves factors such as the',
3010:'degree of subjectivity involved with the deficiency and whether the deficiency arises from fraud or misconduct. paragraph 8.56c nonsupervisory auditor:',
3011:'an auditor who plans or performs engagement procedures and whose work situation is characterized by low levels of ambiguity, complexity,',
3012:'and uncertainty. paragraph 4.10a objectivity: the basis for the credibility of auditing in the government sector. objectivity includes independence of',
3013:'mind and appearance when conducting engagements, maintaining an attitude of impartiality, having intellectual honesty, and being free of conflicts of',
3014:'interest. paragraph 3.11 outcomes: accomplishments or results of a program. paragraph 8.38g outputs: the quantity of goods or services produced',
3015:'by a program. paragraph 8.38f partners and directors: auditors who plan engagements, perform engagement procedures, or direct or report on',
3016:'engagements and whose work situations are characterized by high levels of ambiguity, complexity, and uncertainty. partners and directors may also',
3017:'be responsible for reviewing engagement quality prior to issuing the report, for signing the report, or both. paragraph 4.10c peer',
3018:'review risk: the risk that the review team 1 fails to identify significant weaknesses in the reviewed audit organization’s system',
3019:'of quality control for its auditing practice, its lack of compliance with that system, or a combination thereof; 2 issues',
3020:'an inappropriate opinion on the reviewed audit organization’s system of quality control for its auditing practice, its compliance with that',
3021:'system, or a combination thereof; or 3 makes an inappropriate decision about the matters to be included in, or excluded',
3022:'from, the peer review report. paragraph 5.68 performance audits: engagements that provide objective analysis, findings, and conclusions to assist management',
3023:'and those charged with governance and oversight to, among other things, improve program performance and operations, reduce costs, facilitate decision',
3024:'making by parties with responsibility to oversee or initiate corrective action, and contribute to public accountability. in a performance audit,',
3025:'the auditors measure or evaluate the subject matter of the audit and present the resulting information as part of, or',
3026:'accompanying, the audit report. paragraphs 1.21 and 8.14 period of professional engagement: the period beginning when the auditors either sign',
3027:'an initial engagement letter or other agreement to conduct an engagement or begin to conduct an engagement, whichever is earlier.',
3028:'the period lasts for the duration of the professional relationship—which, for recurring engagements, could cover many periods—and ends with the',
3029:'formal or informal notification, either by the auditors or the audited entity, of the termination of the professional relationship or',
3030:'with the issuance of a report, whichever is later. paragraph 3.23 performing engagement procedures: performing tests and procedures necessary to',
3031:'accomplish the engagement objectives in accordance with gagas. paragraph 4.11c planning: determining engagement objectives, scope, and methodology; establishing criteria to',
3032:'evaluate matters subject to audit; or coordinating the work of the other audit organization. this definition excludes auditors whose role',
3033:'is limited to gathering information used in planning the engagement. paragraph 4.11a presumptively mandatory requirements: auditors and the audit organization',
3034:'must comply in all cases where such a requirement is relevant except in rare circumstances discussed in paragraphs 2.03, 2.04,',
3035:'and 2.08. gagas uses should to indicate a presumptively mandatory requirement. paragraph 2.02b professional behavior: behavior that includes auditors avoiding',
3036:'any conduct that could bring discredit to their work and putting forth an honest effort in performing their duties in',
3037:'accordance with the relevant technical and professional standards. paragraph 3.16 professional judgment: use of the auditor’s professional knowledge, skills, and',
3038:'abilities, in good faith and with integrity, to diligently gather information and objectively evaluate the sufficiency and appropriateness of evidence.',
3039:'professional judgment includes exercising reasonable care and professional skepticism. paragraphs 3.109 through 3.117 program: includes processes, projects, studies, policies, operations,',
3040:'activities, entities, and functions. paragraph 8.08 program operations: the strategies, processes, and activities management uses to convert inputs into outputs.',
3041:'program operations may be subject to internal control. paragraph 8.38e public interest: the collective wellbeing of the community of people',
3042:'and entities that the auditors serve. paragraph 3.07 reasonable and informed third party: as evaluated by a hypothetical person, a',
3043:'person who possesses skills, knowledge, and experience to objectively evaluate the appropriateness of the auditor’s judgments and conclusions. this evaluation',
3044:'entails weighing all the relevant facts and circumstances, including any safeguards applied, that the auditor knows, or could reasonably be',
3045:'expected to know, at the time that the evaluation is made. paragraph 3.46 reporting: determining the report content and substance',
3046:'or reviewing reports to determine whether the engagement objectives have been accomplished and the evidence supports the report’s technical content',
3047:'and substance prior to issuance. this includes signing the report. paragraph 4.11d responsible party: the party responsible for a gagas',
3048:'engagement’s subject matter. paragraph 1.27n review: consists of obtaining limited assurance by obtaining sufficient, appropriate review evidence about the measurement',
3049:'or evaluation of subject matter against criteria in order to express a conclusion about whether any material modifications should be',
3050:'made to the subject matter in order for it to be in accordance with or based on the criteria or',
3051:'to the assertion in order for it to be fairly stated. reviewlevel work does not include reporting on internal control',
3052:'or compliance with provisions of laws, regulations, contracts, and grant agreements. paragraph 1.18b review of financial statements: the objective of',
3053:'the auditor when performing a review of financial statements is to obtain limited assurance as a basis for reporting whether',
3054:'the auditor is aware of any material modifications that should be made to financial statements in order for the financial',
3055:'statements to be in accordance with the applicable financial reporting framework. a review of financial statements does not include obtaining',
3056:'an understanding of the entity’s internal control, assessing fraud risk, or certain other procedures ordinarily performed in an audit. paragraph',
3057:'1.20 safeguards: actions or other measures, individually or in combination, that auditors and the audit organization take that effectively eliminate',
3058:'threats to independence or reduce them to an acceptable level. paragraph 3.49 scope: the boundary of the audit and is',
3059:'directly tied to the audit objectives. the scope defines the subject matter that the auditors will assess and report on,',
3060:'such as a particular program or aspect of a program, the necessary documents or records, the period of time reviewed,',
3061:'and the locations that will be included. paragraph 8.10 selfinterest threat: the threat that a financial or other interest will',
3062:'inappropriately influence an auditor’s judgment or behavior. paragraph 3.30a selfreview threat: the threat that an auditor or audit organization that',
3063:'has provided nonaudit services will not appropriately evaluate the results of previous judgments made or services provided as part of',
3064:'the nonaudit services when forming a judgment significant to a gagas engagement. paragraph 3.30b significance: the relative importance of a',
3065:'matter within the context in which it is being considered, including quantitative and qualitative factors. in the performance audit requirements,',
3066:'the term significant is comparable to the term material as used in the context of financial statement engagements. paragraph 8.15',
3067:'source documents: documents providing evidence that transactions have occurred for example, purchase orders, payroll time records, customer orders, and contracts.',
3068:'such records also include an audited entity’s general ledger and subsidiary records or equivalent. paragraph 3.92 specialist: an individual or',
3069:'organization possessing special skill or knowledge in a particular field other than accounting or auditing that assists auditors in conducting',
3070:'engagements. a specialist may be either an internal specialist or an external specialist. paragraph 1.27p structural threat: the threat that',
3071:'an audit organization’s placement within a government entity, in combination with the structure of the government entity being audited, will',
3072:'affect the audit organization’s ability to perform work and report results objectively. paragraph 3.30g sufficiency: a measure of the quantity',
3073:'of evidence used to support the findings and conclusions related to the audit objectives. paragraph 8.99 supervisory auditor: an auditor',
3074:'who plans engagements, performs engagement procedures, or directs engagements, and whose work situation is characterized by moderate levels of ambiguity,',
3075:'complexity, and uncertainty. paragraph 4.10b technical comments: comments that address points of fact or are editorial in nature and do',
3076:'not address substantive issues, such as methodology, findings, conclusions, or recommendations. paragraphs 6.61, 7.59, and 9.54 those charged with governance:',
3077:'the individuals responsible for overseeing the strategic direction of the entity and obligations related to the accountability of the entity.',
3078:'this includes overseeing the financial reporting process, subject matter, or program under audit, including related internal controls. those charged with',
3079:'governance may also be part of the entity’s management. in some audited entities, multiple parties may be charged with governance,',
3080:'including oversight bodies, members or staff of legislative committees, boards of directors, audit committees, or parties contracting for the engagement.',
3081:'paragraph 1.04 unconditional requirement: requirement with which auditors and the audit organization must comply in all cases where such requirement',
3082:'is relevant. gagas uses must to indicate an unconditional requirement. paragraph 2.02a undue influence threat: the threat that influences or',
3083:'pressures from sources external to the audit organization will affect an auditor’s ability to make objective judgments. paragraph 3.30e waste:',
3084:'the act of using or expending resources carelessly, extravagantly, or to no purpose. waste can include activities that do not',
3085:'include abuse and does not necessarily involve a violation of law. paragraphs 6.21, 7.23, and 8.120 acknowledgments comptroller general’s advisory',
3086:'council on government auditing standards 2016 2020 drummond kahn, chair international institute and government audit training institute graduate school usa',
3087:'corey arvizu heinfeld, meech & co., p.c. dr. brett m. baker u.s. nuclear regulatory commission, office of the inspector general',
3088:'jon hatfield u.s. federal maritime commission, office of the inspector general philip m. heneghan u.s. international trade commission, office of',
3089:'the inspector general mary l. kendall u.s. department of the interior, office of the inspector general deborah v. loveless tennessee',
3090:'comptroller of the treasury, division of state audit martha s. mavredes auditor of public accounts of the commonwealth of virginia',
3091:'kimberly k. mccormick grant thornton llp amanda nelson kpmg llp dr. demetra smith nightingale urban institute dr. annette k. pridgen',
3092:'jackson state university dianne ray colorado office of the state auditor harriet richardson city of palo alto randy c. roberts',
3093:'arizona office of the auditor general brian a. schebler rsm us llp ronald smith rhr smith & company cpas gao',
3094:'project team james r. dalkin, director kristen a. kociolek, assistant director christie a. pugnetti, auditor in charge michael f. bingham,',
3095:'senior auditor mary ann hardy, senior auditor rebecca a. riklin, senior auditor j. lawrence malenich, managing director, financial management and',
3096:'assurance robert f. dacey, chief accountant staff acknowledgments in addition to the project team named above, also contributing were mark',
3097:'cheung, clayton t. clark, oliver a. culley, francine m. delvecchio, vincent gomes, john r. grobarek, sean p. joyce, jason m.',
3098:'kelly, delores j. lee, aaron m. livernois, quang d. nguyen, grant l. simmons, adrienne n. walker, kimberly y. young, and',
3099:'matthew p. zaun. 104743 gao’s mission the government accountability office, the audit, evaluation, and investigative arm of congress, exists to',
3100:'support congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for',
3101:'the american people. gao examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and',
3102:'other assistance to help congress make informed oversight, policy, and funding decisions. gao’s commitment to good government is reflected in',
3103:'its core values of accountability, integrity, and reliability. obtaining copies of gao reports and testimony the fastest and easiest way',
3104:'to obtain copies of gao documents at no cost is through our website. each weekday afternoon, gao posts on its',
3105:'website newly released reports, testimony, and correspondence. you can also subscribe to gao’s email updates to receive notification of newly',
3106:'posted products. order printed copies the printed version of the government auditing standards 2018 revision technical update april 2021 can',
3107:'be ordered through the government publishing office gpo online http://bookstore.gpo.gov/ or by calling 2025121800 or 1 8665121800 toll free. connect',
3108:'with gao connect with gao on facebook, flickr, twitter, and youtube. subscribe to our rss feeds or email updates. listen',
3109:'to our podcasts. visit gao on the web at https://www.gao.gov. to report fraud, waste, and abuse in federal programs contact',
3110:'fraudnet: website: https://www.gao.gov/about/whatgaodoes/fraudnet automated answering system: 800 4245454 or 202 5127700 congressional relations orice williams brown, managing director, williamso@gao.gov, 202',
3111:'5124400, u.s. government accountability office, 441 g street nw, room 7125, washington, dc 20548 public affairs chuck young, managing director,',
3112:'youngc1@gao.gov, 202 5124800 u.s. government accountability office, 441 g street nw, room 7149 washington, dc 20548 recycle!pleaseprintrecycledpaper pleaseprintonrecycledpaper. strategic planning',
3113:'and external liaison stephen j. sanford, acting managing director, spel@gao.gov, 202 5124707 u.s. government accountability office, 441 g street nw,',
3114:'room 7814, washington, dc 20548',