What are the Yellow Book CPE requirements?

One of the toughest aspects of doing a Yellow Book audit is complying with the Yellow Book CPE requirements. CPE stands for continuing professional education, by the way.

And the requirements are a little bit involved – so involved that the GAO dedicated 17 pages (!)  to the requirements in chapter 4 of the 2018 Yellow Book.

So, let me cut through all of that and answer some of the more significant questions that auditors have about the requirements here:

1. What topics should the CPE cover?
2. How much CPE do I need to get?
3. When do I have to get it?
4. Who do I report my CPE to?
5. Where do I get it?
6. Does everyone in my audit shop have to get it?
7. Why so much CPE?

1. What topics should the CPE cover?

The GAO requires us to earn CPE from two categories.

Category 1: 

Subject matter directly related to the government environment, government auditing, or the specific or unique environment in which the audited entity operates

Category 2:

Subject matter that directly enhance auditors’ professional expertise to conduct engagements

Notice that both categories are wide and flexible.

More about Category 1:

Category 1 has three subcategories – and one is ‘government environment’.  Wow. That could encompass a lot of different topics.   A long list of possible topics in section 4.23 includes these areas:

• statutory requirements, regulations, criteria, guidance, trends, risks, or topics relevant to the subject matter of the engagement, such as scientific, medical, environmental, educational, or any other specialized subject matter;
• topics directly related to the government environment, such as the nature of government (structures, financing, and operations), economic or other conditions and pressures facing governments, common government financial management issues, appropriations, measurement or evaluation of government financial or program performance, and application of general audit methodologies or techniques to a government environment or program;

The first category also contains two more subcategories, government auditing (which includes government audit standards) and the last subcategory, the specific or unique environment in which the audited entity operates.

What does ‘specific or unique environment’ mean?  Well for me, it meant that for one two-year measurement cycle, I earned my 24 hours by taking a very interesting and extremely relevant class on how large institutions traded investments.  It was relevant because I was auditing investments at a state retirement system.  In this case, pension system investments was my unique environment.  Maybe you are auditing HUD projects, school districts, or municipal utilities. Those are also unique environments.

More about Category 2:

Category 2 is also broad. Any topic that you think enhances your ability to conduct audits is included here.

While this may be an obvious choice for some auditors because all they do is audit, some auditors also wear other hats so determing whether a CPE class qualifies is not so simple.

In a CPA firm, for instance, staff might prepare taxes, create estate plans, as well as conduct audits.  The CPE they earn to help them keep up with individual and corporate taxation rules and estate laws is probably not going to count toward the second category of Yellow Book CPE requirements because those topics do not contribute to the auditor’s ability to conduct audits.

2. How much CPE do I need to get?

24 hours from category 1 and 56 hours from category 2.

3. When do I have to get it?

Every two years.

Whatever time you choose to start counting your hours, you simply stick with that timing year after year.  So be careful where you start!  You might start counting as soon as your begin a Yellow Book engagement, or you might use a fiscal year.

Most audit shops keep all auditors on the same 2 year cycle regardless of when they started performing Yellow Book audits.

I get a lot of questions about this, as I expect the GAO does.  So if you aren’t sure, check out sections 4.42-4.48 as this issue is very idiosyncratic to each auditor and each audit team.

4. Who do I report my CPE to?

The generic answer, for the purposes of compliance with the Yellow Book, is no one.  The GAO doesn’t ask that audit teams report CPE hours to them.

The folks who care about whether an auditor complied with the CPE requirements are the leaders of the audit shop, the internal quality control reviewer, and the peer reviewer.

The leaders of the audit shop are responsible for making sure that the audit teams they assign to audits are collectively competent to perform the audit.  CPE is a key way that auditors remain competent.

The internal quality control reviewer will check that the team received the required CPE at least annually and the external peer reviewer will check that the team is keeping records and staying compliant with the requirements every three years.

However, if individual team members hold professional certifications, the certifying body might require these individuals to report their CPE to them periodically.  For instance, I am a Texas CPA.  I must report my CPE hours (including topics and sources) to the Texas State Board of Public Accountancy every year.  However, the Texas Board of Accountancy doesn’t track whether I earned my necessary Yellow Book hours; that is my job. I also hold a certification from the IIA and their requirements are much lighter. They simply require that I promise I earned my hours; they don’t want the details of what, when, or where.

Be careful here, some certifying bodies are tougher. Other state boards of public accountancy do require CPAs to report the details on the 24 Yellow Book hours – so check with the body that certifies you for more info.

5. Where do I get it?

Thankfully, there are literally hundreds of sources of Yellow Book hours – from professional organizations to online vendors.

You DO NOT have to make sure that the course description includes the words ‘qualifies for Yellow Book credits’ for it to qualify.  Whether or not it qualifies is up to the subject to the your judgment and the judgment of your audit leader, internal quality control reviewers, and peer reviewers).   Also, again, check with whoever regulates your certification to make sure they are comfortable with your choice.

6. Does everyone in my audit shop have to get the CPE?

No. Per section 4.26, nonsupervisory auditors who charge less than 40 hours of their time annually to engagements conducted in accordance with GAGAS may be exempted from all CPE requirements.

Also, support staff and interns are exempt. For more on exemptions see sections 4.25-4.29.

7. Why so much CPE?

Government audits are a little tricky – I mean, let’s face it, all auditing is tricky –  and the GAO does not want auditors claiming that they performed an audit according to standards if they aren’t competent to perform an audit.  Here is what the GAO wants auditors to know.

YB 2018 4.07 The knowledge, skills, and abilities needed when conducting an engagement in accordance with GAGAS include the understanding necessary to proficiently apply

1. GAGAS;
2. standards, statutory requirements, regulations, criteria, and guidance applicable to auditing or the objectives for the engagement(s) being conducted; and
3. techniques, tools, and guidance related to professional expertise applicable to the work being performed.

You can always contact the GAO if you have any questions

Simply write to yellowbook@gao.gov and pose your question about the Yellow Book CPE requirements.  But I recommend you review Chapter 4 of the 2018 Yellow Book before you contact them.  The GAO has no authority over you (there are no men in yellow who come down to verify that you are meeting standards!), so you don’t need to be shy.

You are also more than welcome to ask me, but I am no where near as cool and authoritative as the GAO.  Write to Leita@yellowbook-cpe.com.

As always, thanks for reading!