Are You Qualified to Conduct a Yellow Book Audit?

Have you heard that crazy rumor that the GAO certifies auditors to conduct Yellow Book audits?  Well, they don’t!  I think the GAO has plenty to do without adding that to their to-do list!

But before you take a Yellow Book audit on, I recommend that you do five things:

1.Make sure your team is competent 

Do you remember Larry, Darryl and Darryl from the Newhart Show?  The three bumpkin brothers who came straight out of the Vermont woods? Until the final episode, only Larry spoke.  The Darryls always stood quietly behind Larry looking incredibly stupid.

But under the right circumstances, Larry, Darryl and Darryl could have made the perfect audit team because per Yellow Book standards, audit teams are evaluated on their collective competence, not their individual competence.

GAGAS 2018 4.02 The audit organization’s management must assign auditors to conduct the engagement who before beginning work on the engagement collectively possess the competence needed to address the engagement objectives and perform their work in accordance with GAGAS.

One smart guy and two dummies will suffice.  Three guys each possessing a third of a brain will work, too.

And what is the team supposed to know?  Well, someone needs to know the Yellow Book, someone needs to know something about the audit criteria, and someone needs to know how to audit!

GAGAS 2018 4.07 The knowledge, skills, and abilities needed when conducting an engagement in accordance with GAGAS include the understanding necessary to proficiently apply

• GAGAS;
• standards, statutory requirements, regulations, criteria, and guidance applicable to auditing or the objectives for the engagement(s) being conducted; and
• techniques, tools, and guidance related to professional expertise applicable to the work being performed.

2. Get your CPE

One way that you can make sure that you earn competence is education.  The Yellow Book calls education by a fancy title – Continuing Professional Education (CPE) –  and requires 80 hours of it every two years.  24 of the 80 hours need to be related to government auditing, the government environment, or the specific or unique environment in which your audited entity operates.

There are a few twists and turns to this requirement, so check out this more detailed article or chapter 4 of the Yellow Book for more.

3. Guard your independence

The GAO sets a very high bar for auditor independence.  So high, that many auditors can’t comply.  The GAO, as a legislative auditor, is as independent as an auditor can be and they aren’t super empathetic to CPAs in public practice or internal auditors.

When it comes to CPAs in public practice, the GAO puts up as many barriers as it can to CPAs both preparing and auditing financial statements.  For more on independence for CPAs see this journal article.

And section 9.04 of the Yellow Book requires internal auditors to add a clause to their report that explains that they are independent according to GAO standards for internal auditors.  The unspoken part of that requirement is that the GAO wants readers to know that internal auditors are not truly independent because they are employees of  the organization they are auditing.   For more on independence for performance auditors, check out this article.

4. Set up a system of quality control 

Most audit organizations need to set up layers of review of their audit work in order to comply with the quality control standards in the Yellow Book.  For one, the results of the quality control reviews need to be summarized and resolved at least annually.  In addition the audit team must undergo a review of its quality control system by an external party every three years.  For more detail on what a quality control system entails and what a peer review involves, see Chapter 5 of the Yellow Book.

5. Follow every must and should statement

Here is an Excel spreadsheet that lists all of the non-negotiable requirements of the Yellow Book (any statement in the Yellow Book that includes the words  ‘must’ or ‘should’).

However, not all requirements listed in the Yellow Book are applicable to all four engagement types.  So, your very first task in applying Yellow Book standards is to figure out which type of engagement you are conducting. And yes, sometimes that choice can be tricky.

This is just a beginning; there is plenty more to know about the Yellow Book.  And since I assume you don’t want to stand back and look stupid like one of the Darryls, you are welcome to check out a variety of courses that will make you look smarter than Larry.