My comments to the GAO on the 2017 exposure draft of GAGAS

Here is the short response that I sent to the GAO on the 2017 exposure draft of GAGAS.  The deadline for comments is July 6.  Please send your comments to YellowBookComments@gao.gov.

6/20/17

GAO GAGAS Team –

Thank you for giving the audit community a chance to comment.  I am in the relatively unique position of having the privilege to work with teams using every chapter of the Yellow Book.  I work with CPA firms who apply the financial audit standards in the conduct of the Single Audit, internal audit shops and monitors in government who follow the performance audit standards, and legislative auditors who apply both financial and performance standards.  I also work with shops that don’t want to hear anything about the Yellow Book at all (!) and instead follow only IIA or AICPA standards.

Here are a half-a-dozen items I ask you to consider for the finalized 2017 revision:

1. Disclose all auditor responsibilities and the corresponding results and conclusions in the audit report

Please require auditors to include a more direct statement regarding the auditor’s responsibilities for all five reportable conditions in the audit report as well as the auditor’s results or conclusions regarding those responsibilities. 

In the proposed revision, an auditor is responsible for five reportable conditions – fraud, internal control weaknesses, non-compliance, waste, and abuse – but per the reporting standards the auditor need only describe their responsibilities regarding two of these conditions – internal control and compliance – to the reader of the audit report.  The reporting requirements have not evolved along with the audit standards to include statements regarding fraud, waste and abuse.

The AICPA’s canned audit reports regarding internal controls and compliance are opaque and user-unfriendly.  I know that you do not have the power to revise these letters, but I also know that you can influence the content of the AICPA’s letters and encourage clarity and transparency in all auditors’ reports if you decide to alter the required disclosures.

2. Revive the report quality elements
Please revive the ‘report quality elements’ listed in the 2011 version of the Yellow Book at A7.02.  I use the report quality elements quite a bit in my teaching – especially the guidance reminding auditors about timeliness and conciseness.

3. Revive the clear reference to the Single Audit
The 2007 version of the Yellow Book contained a clear reference to the Single Audit that was removed in the 2011 version.  Will you please add it back so there is no doubt that the Single Audit is classified as a financial audit?  It was in section 1.22(b) of the 2007 version and said “(5) auditing compliance with regulations relating to federal award expenditures and other governmental financial assistance in conjunction with or as a by- product of a financial statement audit. “

4. Define the term ‘performance aspect’ and remind auditors of the danger of vague performance aspects
Would you please define the term ‘performance aspects’? Section 8.08 mentions ‘performance aspects’ but does not define the term. The International Standards for Supreme Audit Organizations defines the term ‘performance aspect”, but most auditors I work with are unaware of those standards.

It would be very helpful if you would go on to remind auditors that the terms effective, efficient and economical are very general and vague and that the auditor would benefit from using a more specific performance aspect in their objective – such as timeliness or accuracy.  I have witnessed countless audit teams suffering from scope creep and messy audit reports when they include the words efficient and effective in their audit objectives.

5. Simplify the peer review requirements
Please simplify and shorten the peer review requirements by including only the minimum requirements at the “Requirements for Audit Organizations Not Affiliated with Recognized Organizations” in paragraphs 5.80 through 5.113.   By mentioning specific organization’s peer review programs in section 5.64, you are creating more work for yourself and the audit community because now you will need to approve these organization’s approaches each time you revise the Yellow Book.  You will also have to screen other organization’s systems before inclusion in the Yellow Book. This can easily become political and bureaucratic and can be completely avoided by mentioning the minimum requirements only.

6. Revise an awkward sentence
This sentence is a bit convoluted:
6.20 Auditors should consider potential internal control deficiencies in their evaluation of identified findings when developing the cause element of the identified findings when significant to the audit objectives.
Maybe just say – Auditors should consider whether an internal control deficiency is the cause for identified findings.

Thank you again for the chance to comment, and thank you for working to make the Yellow Book the most comprehensive and clear audit standard in existence today.

Leita