New Internal Audit Disclosure

An internal auditor following 2018 Yellow Book standards should add a statement to their audit report regarding their independence. This is new and I didn’t want you to miss it!

GAGAS 2018 9.04 Audit organizations that meet the independence requirements for internal audit organizations, but not those for external audit organizations, should include in the GAGAS compliance statement, where applicable, a statement that they are independent per the GAGAS requirements for internal auditors.

What are the Yellow Book’s requirements for Internal Audit independence? Here is one part of the requirements to consider.

GAGAS 2018 3.56 Government internal auditors who work under the direction of the audited entity’s management are considered structurally independent for the purposes of reporting internally, if the head of the audit organization meets all of the following criteria:

1. is accountable to the head or deputy head of the government entity or to those charged with governance;

2. reports the engagement results both to the head or deputy head of the government entity and to those charged with governance;

3. is located organizationally outside the staff or line management function of the unit under audit;

4. has access to those charged with governance; and

5. is sufficiently removed from pressures to conduct engagements and report findings, opinions, and conclusions objectively without fear of reprisal.

For more on auditor independence, see this blog post.

Why this new reporting requirement?

The GAO has always been tough about auditor independence because they recognize that audit results are trustworthy only if they are objective and unbiased.

GAGAS 2018 3.19 Auditors and audit organizations should avoid situations that could lead reasonable and informed third parties to conclude that the auditors and audit organizations are not independent and thus are not capable of exercising objective and impartial judgment on all issues associated with conducting the engagement and reporting on the work.

But I suspect another reason the GAO is so tough is that they lack empathy for audit shops who are not blessed with the GAO’s structural independence.

The GAO is about as independent as an audit shop can be. The GAO reports on their audits of federal agencies directly to Congress. And these federal agencies have zero control over the GAO’s operating budget because it is appropriated by Congress. Therefore, the GAO can tell the truth about who they are auditing and not suffer political ramifications. That is a very sweet, and rare place to be.

Not even 007 is that independent

Not even super-cool James Bond is as objective as the GAO.

In most 007 movies, James must choose whether to kill or abandon the beautiful spy he fell for earlier in the movie. It sure would be better for everyone involved (excepting the beautiful spy!) if he remained objective about her and just did his job.

It would also be easier for internal auditors if they could report the blunt, bold, honest truth without worrying about how it impacts their employer. But that would be career suicide. For this reason, internal auditors can never be purely independent of their subject matter.

Most other auditors are in the same boat

But let’s be real here, most auditors have something keeping them from being completely independent. Most auditors do have to care about the beautiful spy, I mean the auditee.

For instance, CPA firms who audit government programs are often paid by the folks that run the government programs. If the CPA wants to do that audit again next year, they would be wise to make the folks who pay them happy. And blunt, honest truth rarely makes auditees happy.

In some audit shops, the head auditor is elected and could be more concerned about winning a higher elected office than holding auditees accountable. This underlying political agenda could sway the shop to avoid politically charged topics and auditees.

The GAO loves the concepts of transparency and accountability

Another possible reason for the new disclosure is a little philosophical. The introductory paragraphs of the Yellow Book remind government auditors that they should seek transparency and accountability. Here is a quote.

GAGAS 2018 1.07 Engagements conducted in accordance with GAGAS provide information used for oversight, accountability, transparency, and improvements of government programs and operations. GAGAS contains requirements and guidance to assist auditors in objectively obtaining and evaluating sufficient, appropriate evidence and reporting the results. When auditors conduct their work in this manner and comply with GAGAS in reporting the results, their work can lead to improved government management, better decision making and oversight, effective and efficient operations, and accountability and transparency for resources and results.

And the GAO makes it clear throughout the standards, that the concepts of transparency and accountability aren’t just for the auditee, but for the auditor as well.

The public doesn’t know all of the nuances of an auditor’s situation and expects auditors to be truly independent, so the GAO wants to be transparent with the reader and let them know that internal auditors are in a unique position and therefore are not truly independent.

So if most auditors are compromised, why single out the internal audit shop?

I’m not crazy about this new requirement because it seems like the GAO is singling out internal auditors.

So in an effort to enhance transparency regarding independence for all auditors, I think the GAO should also require CPA firms who conduct audits of government programs to disclose who is paying them to do the audit. But the GAO hasn’t gone there… yet.

As always, I welcome feedback, opinions, and questions. Audit on!