Using the name GAGAS in Vain

Do you ever use the words “Jesus!” or “God!” to punctuate a sentence?

My aunt couldn’t stand it when we used the Lord’s name in vain. Using the Lord’s name in vain was a big no-no to her (and many others). She would cuss us out if we kids ever made that mistake in her presence. It’s pretty funny when you think about it, but as a kid, you don’t appreciate irony.

The GAO also doesn’t appreciate it when you use the name GAGAS in vain, either. By that, I mean that they do not want GAGAS to be mentioned in the audit report unless you follow all of their standards.

When an auditor follows GAGAS (Generally Accepted Government Auditing Standards – also known as the Yellow Book) they say so in their audit report with a sentence that sounds something like, “We conducted this audit in accordance with Generally Accepted Government Auditing Standards.”

If you don’t want to get cussed out by your peer reviewer, you had better make sure you follow every must and should statement in GAGAS before you put that sentence in your audit report. The GAO does not want auditors to follow GAGAS in spirit only.

What is the difference between ‘must’ and ‘should’?

In general, “must” means mandatory and “should” means mandatory unless you have a compelling reason to deviate.

The GAO emphasizes that not every paragraph of the Yellow Book contains mandatory requirements. Here is how the GAO explains the differences:

2.02     GAGAS uses two categories of requirements, identified by specific terms, to describe the degree of responsibility they impose on auditors and audit organizations:

1. Unconditional requirements: Auditors and audit organizations must comply with an unconditional requirement in all cases where such requirement is relevant. GAGAS uses must to indicate an unconditional requirement.

2. Presumptively mandatory requirements: Auditors and audit organizations must comply with a presumptively mandatory requirement in all cases where such a requirement is relevant except in rare circumstances discussed in paragraphs 2.03, 2.04, and 2.08. GAGAS uses should to indicate a presumptively mandatory requirement.

“Unconditional requirement” means that you do not have an option to follow the requirement. You must comply with these requirements. When you see the word “must,” you will not be able to refer to the GAO in your report.

But, if you see the word “should,” then you have a little more wiggle room. You can choose not to comply with a “should” statement, but you will need to justify the departure in your working papers and disclose your non-compliance in your audit report. Ouch!

2.03     In rare circumstances, auditors and audit organizations may determine it necessary to depart from a relevant presumptively mandatory requirement. In such rare circumstances, auditors should perform alternative procedures to achieve the intent of that requirement.

2.04     If, in rare circumstances, auditors judge it necessary to depart from a relevant presumptively mandatory requirement, they must document their justification for the departure and how the alternative procedures performed in the circumstances were sufficient to achieve the intent of that requirement.

The serious stuff is in a box

Not every statement in the Yellow Book is a must or should statement. Some start with “may,” “might,” or “could.” Those statements are called explanatory guidance and are not mandatory.

The 2018 version of the Yellow Book conveniently puts the must and should statements in a box and the may, might, or could statements live outside the box. If you would like a copy of every “must” and “should” statement in the 2018 Yellow Book in an Excel spreadsheet, you can download one here.

What your report will look like if you don’t comply

After explaining that you need to follow every “must” and “should,” the GAO goes on to say that you can’t claim to follow the Yellow Book if you didn’t follow every “must.” If you do not follow a “should” statement, you can claim to have followed the Yellow Book in your report, but you are going to have to disclose which should statement you did not follow. The GAO calls these “modified compliance statements.”

2.17     Auditors should include one of the following types of GAGAS compliance statements in reports on GAGAS engagements, as appropriate.

1. Unmodified GAGAS compliance statement: Stating that the auditors conducted the engagement in accordance with GAGAS. Auditors should include an unmodified GAGAS compliance statement in the audit report when they have

(1) followed unconditional and applicable presumptively mandatory GAGAS requirements or (2) followed unconditional requirements, documented justification for any departures from applicable presumptively mandatory requirements, and achieved the objectives of those requirements through other means.

2. Modified GAGAS compliance statement: Stating either that (1) the auditors conducted the engagement in accordance with GAGAS, except for specific applicable requirements that were not followed, or (2) because of the significance of the departure(s) from the requirements, the auditors were unable to and did not conduct the engagement in accordance with GAGAS.

 2.18    When auditors use a modified GAGAS statement, they should disclose in the report the applicable requirement(s) not followed, the reasons for not following the requirement(s), and how not following the requirement(s) affected or could have affected the engagement and the assurance provided. 

So if you follow every must and should, you can clearly say, “We conducted this audit in accordance with GAGAS.”

If you don’t follow a must, you do not get to say that sentence at all. That would be using the term GAGAS in vain!

If you follow all of the musts, but break a should, you put a “modified compliance statement” in your report. It would say something like, “We conducted this audit in accordance with GAGAS except we didn’t do bla bla…”

It is not OK to just follow the Yellow Book in spirit

One team of monitors who was not required under any statute, law, or policy to follow the Yellow Book decided to brag that they followed Yellow Book standards in their audit reports. It was a point of pride with the team, and the client was duly impressed with their extra professionalism.

However, the monitoring team had never undergone a peer review and had no plans to suffer one! Also, the management of the team didn’t want to pay for everyone on the team to be current with the 80-hour CPE requirements. At best, the team members got 20 or so hours of education every two years.

So, because the monitors couldn’t follow the Yellow Book in actuality, they reasoned that they were following the Yellow Book in spirit. Just about as good, right? Well, no. They were using the name of GAGAS in vain.

In light of the definitions of “must” and “should,” they had a choice to make. They needed to either (1) explain in their audit reports that they were following most governmental standards but were uneducated or unwilling to undergo the scrutiny that they put their clients to, or (2) drop reference to the Yellow Book in their audit reports altogether. They chose the latter.

Want to learn more about the Yellow Book? It is as fascinating as it sounds.  🙂  These videos may help you out.