Performance Audit vs. Financial Audit

So how do you tell the difference? Performance audit vs. financial audit? You might expect that it would be as simple as saying that a financial audit deals with money and a performance audit does not. But oh no! The audit standards are never that straightforward.

As a matter of fact, the most comprehensive audit standard out there – the Yellow Book – lays out four types of assurance engagements.

1. financial audits
2. attestation engagements
3. reviews of financial statements
4. performance audits

Why do I say that the Yellow Book is the most comprehensive? Because AICPA standards do not cover performance audits and the IIA standards do not cover financial audits. Only the GAO covers all types.

And notice that only two of the assurance engagements on the list are called ‘audits’ – financial audits and performance audits. Let’s concentrate on those two audit types in this blog post and I’ll cover attestation engagements and reviews of financial statements some other time.

Performance Audits are a Catch-All

The easiest way to decide – performance audit vs. financial audit – is to describe what a performance audit is NOT. Performance audits are a catch-all term for anything that is NOT a financial audit.

A classic financial audit evaluates whether the financial statements are presented in accordance with an accounting standard (usually Generally Accepted Accounting Principles). Financial auditors in the United States must also follow AICPA standards in the conduct of their audit.

Here is how the GAO defines a financial audit:

GAGAS 2018 1.17      Financial audits provide independent assessments of whether entities’ reported financial information (e.g., financial condition, results, and use of resources) is presented fairly, in all material respects, in accordance with recognized criteria. Financial audits conducted in accordance with GAGAS include financial statement audits and other related financial audits.

a. Financial statement audits: The primary purpose of a financial statement audit is to provide financial statement users with an opinion by an auditor on whether an entity’s financial statements are presented fairly, in all material respects, in accordance with an applicable financial reporting framework. Reporting on financial statement audits conducted in accordance with GAGAS also includes reports on internal control over financial reporting and on compliance with provisions of laws, regulations, contracts, and grant agreements that have a material effect on the financial statements.

b. Other types of financial audits: Other types of financial audits conducted in accordance with GAGAS entail various scopes of work, including

1. obtaining sufficient, appropriate evidence to form an opinion on a single financial statement or specified elements, accounts, or line items of a financial statement;

2. issuing letters (commonly referred to as comfort letters) for underwriters and certain other requesting parties

3. auditing applicable compliance and internal control requirements relating to one or more government programs; and

4. conducting an audit of internal control over financial reporting that is integrated with an audit of financial statements (integrated audit)

A performance audit can be any other audit! The auditor can take on any subject matter and evaluate it against any criteria.

Can a performance audit center on money?

And can a performance auditor take on a subject matter that deals with money? Yes, they can as long as they do not evaluate whether the financial statements are presented in accordance with an accounting standard. That audit is ruled by AICPA and PCAOB auditing standards.

As a matter of fact, the CPA designation was invented in order to create a pool of qualified professionals who knew the intricacies of how to perform a financial audit. Estate planning and tax preparation were added to a CPA’s repertoire later.

What sort of things do performance auditors look at?

Performance audits are wide open! The only thing a performance auditor cannot do is opine on whether the financial statements are presented in accordance with GAAP. Every other audit objective is fair game in this category.

Performance auditors can check any subject matter against any of these criteria:

• laws
• regulations
• contract terms
• grant agreements
• standards
• measures
• expected performance
• benchmarks

Some performance auditors call themselves “compliance auditors”; some call themselves “operational auditors”. Most internal auditors would classify all of their audit work as a performance audit under the Yellow Book’s definition.

Here are some examples of audit objectives for performance auditors:

• Determine if county bridges meet Federal safety standards.
• Do University dorm rooms satisfy student and parent expectations identified in the 2017 student and parent survey?
• Is program strategy developed using methodologies recommended by the Strategy Institute of America?
• Do state-run foster care homes administer medication to foster children according to physician’s orders?
• Is the performance data shared on the website accurate and reported in accordance with performance measurement standards established by the budget office?
• Are department employees following City travel policy?
• Determine if expenditures are backed up with supporting documentation as required by grant terms.

See? Just about any audit you can imagine.

Why does it matter what you call it: performance audit vs. financial audit?

It matters because the auditing standards for financial audits don’t completely align with auditing standards for performance audits. Financial auditors in the US must follow AICPA standards; performance auditors do not. The AICPA standards focus solely on one subject matter – the financial statements – and as such they sound different than the performance audit standards, which are necessarily broader.

The standards are different enough to get you into trouble during technical review if you aren’t careful. For instance, the Yellow Book performance audit standards require granular documentation and reporting on internal controls. Financial audit standards require that auditors state their objectives using ‘management assertions’.

If the standards are that close, why don’t we all use the same standard? Well, somewhere along the line, performance auditors got it in their head that they are completely different than financial auditors. But I have worked on both types of audits and with both types of audit teams, and the process an auditor goes through to complete both of these types of audits are the same. With just a little work, we could come up with one master standard that would apply to everyone. But auditor unity is a topic for another blog post.

Do you want to learn more about the GAO’s Yellow Book? Check out the Yellow Book Bundle available from YellowBook-CPE.