Reviewing Workpapers -- Avoiding Deficient Audits

Transcription

1 Reviewing Workpapers -- Avoiding Deficient Audits I. Participant Supplemental Material 1 A. Exhibit 1: Examples of Deficiencies Noted in Peer Reviews 1 B. Exhibit 2: Engagement Partner Review Responsibilities Exercise 7 C. Exhibit 3: Common Peer Review Deficiencies Related to Compliance with Statements on Quality Control Standards No. 8 8 cpenow.com / info@cpenow.com i Copyright 2014 Surgent McCoy Self-Study CPE, LLC A6M1/14/S1

2

3 Reviewing Workpapers -- Avoiding Deficient Audits I. Participant Supplemental Material A. Exhibit 1: Examples of Deficiencies Noted in Peer Reviews The following is a listing of common peer review deficiencies. Accounting and Reporting Matters Uncertain Income Tax Positions -- Disclosures relative to uncertain tax positions failed to include open tax years as required by FASB ASC Fair Value -- Failure to disclose the fair value of investments by Levels 1/2/3 as required by FASB ASC Debt -- Failure to disclose five years of debt maturities as required by FASB ASC and improper classifications between current and long-term debt. Leases -- Improper recording of capital leases as operating leases. Statement of Cash Flows -- Failure to properly identify certain cash flow items as operating, investing, or financing activities as required by FASB ASC Risks and Uncertainties -- Failure to properly disclose risks and uncertainties such as nature of operations, use of estimates, and concentrations as required by FASB ASC Subsequent Events -- Failure to disclose date through which subsequent events have been evaluated as required by FASB ASC Omitted Disclosures -- Common omitted disclosures include accounting policies, inventory, valuation allowances, long-term debt, related-party transactions, concentrations of credit risk, deferred income taxes, variable interest entities, and employee benefit plans. Special Purpose Framework -- Inadequate description of the basis of accounting and how it differs from generally accepted accounting principles (GAAP) or inadequate disclosure over related to financial statement elements that are the same or similar to items in GAAP-based financial statements. Industry Format -- Significant departures from the financial statement formats prescribed by industry accounting and audit guides. Compilation Services Engagement Letter -- Failure to have an appropriately signed and worded engagement letter or documentation justifying why an engagement letter is not required. Independence -- Failure to include all reasons for independence impairment, when a reason is disclosed. Basic Presentation -- Basic presentation requirements, including financial statements containing current liabilities without the appropriate caption or description and income statement noting the wrong periods (e.g., 2013 instead of 2012). Special Purpose Framework -- Failure to appropriately title financial statements or adequately describe basis if not U.S. GAAP. cpenow.com / info@cpenow.com 1 Copyright 2014 Surgent McCoy Self-Study CPE, LLC A6M1/14/S1

4 Reporting on the Financial Statements -- Basic report elements were missing or all periods presented in the compilation report not addressed. Form of Standard Compilation Report -- Not modifying the report for a material departure from the applicable financial reporting framework, such as omission of: Significant income tax provisions. Significant disclosures related to defined employee benefit plans. Required supplementary information for a common interest realty association. Statement of Cash Flows -- For financial statements prepared in accordance with U.S. GAAP, when a balance sheet and income statement are present, there must be a statement of cash flows for each period presented in the income statement. If there is an income statement for three and six months ended, there should be a statement of cash flows for both periods -- not just for six months ended. Substantially Omitted Disclosure -- Failure to disclose the omission of substantially all disclosures, when appropriate. Review Services Analytical Procedures -- Failure to document expectations when performing analytical procedures and to compare results to those expectations. Review Documentation -- Failure to document significant findings or issues, including unusual matters and their disposition. Inquiry -- Failure to document matters covered in the accountant s inquiry. Fraud -- Failure to document communications regarding identified fraud. Management Representations -- Omissions and errors, such as failure to include all periods covered by the accountant s review report or not including a statement about management s responsibility to detect and prevent fraud. Reporting on the Financial Statements -- Basic report elements were missing. Engagement Letter -- Errors or omissions, such as: Missing required signatures. Required wording that the engagement cannot be relied upon to disclose errors, fraud, or illegal acts. Required wording that the accountant would inform the appropriate level of management if certain matters came to his/her attention unless clearly inconsequential. Comparative Financial Statements and Supplemental Information -- Indication of accountant s responsibility with respect to all periods and any supplemental information presented missing. Audit and Attest Services Planning and Supervision -- Incomplete or undocumented planning procedures related to risk, including assessing risk at the relevant assertion level for significant accounts, classes of transactions, and disclosures. Predecessor Auditor -- Failure to document communications between predecessor and successor auditors. Audit Documentation -- Failure to prepare audit documentation in accordance with AU- 230, Audit Documentation, including following the premise of if you didn t document it, you didn't do it. cpenow.com / info@cpenow.com 2 Copyright 2014 Surgent McCoy Self-Study CPE, LLC A6M1/14/S1

5 Analytical Procedures -- General analytical procedures and specifically the failure to document expectations prior to performing analytical procedures and then failing to compare final results to expectations as well as document the procedures performed. Sampling -- Failure to adequately document sample size determination, methodology, failure to project the results of sampling to the population. Omitted Audit Procedures -- Lack of written audit program or insufficient procedures applied to key audit areas. Inventory -- Failure to observe the physical inventory count, when material. Receivables -- Failure to confirm significant receivables or document that sufficient and appropriate alternative audit evidence was obtained in accordance with AU-C 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained. Communicating Internal Control Matters Failure to note the auditor s responsibility for communicating internal control matters identified in an audit in the engagement letter. Failure to complete or inaccurate completion of the internal control matters section of the firm s audit work programs in accordance with quality control policies and procedures. Failure to identify internal control matters during the planning stage of the engagement. Failure to disclose significant deficiencies identified. Communication with Those Charged with Governance -- Failure to document those communications in accordance with AU-C 260, The Auditor s Communication with Those Charged with Governance. Inadequate Practice Aids -- Use of outdated practice aids or those inappropriate for the type of industry. Supplemental Information -- Failure to reference or report on supplemental information that accompanies the financial statements. Qualified Report -- Failure to appropriately qualify an auditor s report for a scope limitation or departure from the basis of accounting used for the financial statements. Report Time Periods -- Failure to reference all time periods covered by the financial statements. Special Purpose Frameworks -- Failure to use appropriate titles for special purpose framework financial statements, including cash-basis and income tax-basis. Attestation Engagements Failure to obtain a client management representation letter for an examination of internal control. Failure to obtain a client management representation letter regarding managements assumptions for a pro forma financial statement. Failure to appropriately label pro forma financial information to distinguish it from historical financial information. Employee Benefit Plans Inadequate testing of participant data. Inadequate testing of investments, particularly when held by outside parties. Inadequate disclosures related to participant directed investment programs. cpenow.com / info@cpenow.com 3 Copyright 2014 Surgent McCoy Self-Study CPE, LLC A6M1/14/S1

6 Failure to understand testing requirements of a limited-scope engagement. Inadequate consideration of prohibited transactions. Incomplete description of the plan and its provisions. Inadequate or missing disclosures related to investments. Failure to properly report on a DOL limited-scope audit. Improper use of limited-scope exemption because financial institution did not qualify for such an exemption. Inadequate or missing disclosures related to participant data. Failure to properly report on and/or include the required supplemental schedules related to ERISA and DOL. Governmental and Not-for-Profit A. Risk-based audit approach The basis for the risk assessments not documented, or the required risk analyses not documented at all; Risk assessment decisions not consistent with other information in the audit documentation; Using budgeted amounts instead of actual expenditures; Using prior year amounts instead of current actual expenditures; Using rounded amounts for threshold calculations; Lack of documentation why programs are considered low-risk; Inappropriate assessment of auditee as a low-risk; Failure to audit as major program Type A high-risk programs; Failure to audit a Type A major program that was an unaudited Type B program in the prior year; Type B program risk determined on a global basis rather than on an individual program basis; Not identifying an entire cluster of programs as a major program; and Not meeting percentage-of-coverage rule. B. Audit sampling Lack of documentation of sampling plan and methodology; Lack of documentation of basis for sample size; Lack of documentation of rationale for items selected; Lack of documentation of analysis of exceptions; Lack of documentation of conclusions reached; Inadequate sample sizes; and Omitting part of the sampling population. C. Internal control Not documenting an understanding of internal control over compliance in a manner that addresses the five elements of internal control; Lack of documentation of the internal control testing related to the 14 compliance requirements, as relevant; Lack of risk assessments for each component of internal control; Using a single transaction walk-through to justify a low assessed level of risk; Lack of explanation of resolution of exceptions, including why exceptions were not included as audit findings; cpenow.com / info@cpenow.com 4 Copyright 2014 Surgent McCoy Self-Study CPE, LLC A6M1/14/S1

7 Inquiry used as the sole test of internal controls; Audit documentation evidencing an understanding of internal control but not concluding whether or not implemented; Lack of testing of the computer system or source information when eligibility is tested using information from the client s computer system; and Audit documentation not evidencing the auditor s consideration of the effect of the use of information technology on internal control -- in particular, the audit documentation not evidencing the basis upon which the auditor concludes to assess control risk at maximum, when controls are significantly dependent upon computerized information systems. D. Compliance Audit documentation did not always include evidence that the auditor tested major program requirements or explain why certain generally applicable requirements were not applicable to the audit (i.e., do not just mark a compliance requirement as N/A, but rather explain why ); Not following the guidance in Part 7 of the Compliance Supplement for identifying applicable compliance requirements (Part 7 relates to guidance for auditing programs not included in the Compliance Supplement); Inadequate design and documentation of compliance and internal control tests; Not properly identifying direct and material compliance requirements related to a major program; and Not using the most recent Compliance Supplement. E. Audit findings Not documenting consideration of materiality of findings at the individual major program level, which is a lower materiality than all programs combined; No documentation explaining why apparent audit findings were not reported; Attempting to eliminate a finding by indicating that management will correct the finding; Insufficient documentation of finding to allow for corrective action; Not documenting specific items tested; Lack of documentation of additional work performed to resolve issues; Not properly including exceptions as audit findings or otherwise resolved; and Not reporting material questioned costs as audit findings. F. Documentation Lack of sufficient documentation of procedures performed and issues considered; Relying on inadequate audit programs; Relying on inadequate or outdated reference material; Relying too heavily on inquiry procedures as audit evidence, without corroboration or supporting evidence; Engagement letter deficiencies; Inadequate engagement planning documentation; Lack of written audit programs; Documentation not indicating CPE compliance; Documentation not showing auditor s consideration of an internal audit function or use of a service organization; cpenow.com / info@cpenow.com 5 Copyright 2014 Surgent McCoy Self-Study CPE, LLC A6M1/14/S1

8 Lack of documentation about the use of information technology on internal control; No documentation of materiality or control risk; Lack of fraud risk documentation; and Dating some documentation after the report date. G. Reporting Misreporting coverage of major programs; Identifying major programs as being audited on the SEFA that were not; Using inappropriate wording; Not referring to GAS in audit of financial statements report; Not modifying report for GAAP departures if the entity follows GAAP; Omitting required reports; Not modifying compliance opinion when instances of noncompliance exist; Not updating legal inquiries thought the audit report date; Some or all management representations not obtained, or obtaining management representations several days prior to the dates of the auditor s reports; Failing to observe or report on inadequate financial statement disclosures or the auditee s incorrect application of GAAP, including the improper accounting for a particular fund or inadequate financial statement disclosure; Not modifying reports for financial statements issued under statutory accounting provisions or an unqualified opinion was given for financial statements issued using a grant basis of accounting; Not including in the GAS report the appropriate restrictions on use; Not referring to the appropriate titles of the applicable financial statements in the auditor s report; Giving the omission of the statement of cash flows as the reason for OCBOA financial statements; Not indicating the responsibility for supplemental information in the auditor s report; Making numerous typographical errors in the report; and Failing to use a prudent official test in challenging how deficiencies and findings are classified in reporting. cpenow.com / info@cpenow.com 6 Copyright 2014 Surgent McCoy Self-Study CPE, LLC A6M1/14/S1

9 B. Exhibit 2: Engagement Partner Review Responsibilities Exercise Instructions: Brainstorm 10 questions that an engagement partner should ask when reviewing an audit engagement file cpenow.com / info@cpenow.com 7 Copyright 2014 Surgent McCoy Self-Study CPE, LLC A6M1/14/S1

10 C. Exhibit 3: Common Peer Review Deficiencies Related to Compliance with Statements on Quality Control Standards No. 8 The following is a listing of common peer review deficiencies related to compliance with Statements on Quality Control Standards No. 8: Quality Control Documentation -- Failure to document the firms compliance with policies and procedures for its system of quality control as required by AICPA Quality Control Standards. Monitoring -- Failure to monitor, which involves an ongoing consideration and evaluation of a firm s system of quality control to determine the appropriateness of the design and the effectiveness of the operation of the system of quality control. This includes a review of the firm s other elements of quality control and engagements. Engagement Quality Control Review -- Failure to perform the engagement quality control (pre-issuance) review of engagement working papers and/or reports and accompanying financial statements with an objective party not associated with the engagement as required by firm policy. Monitoring for Sole Practitioners -- Some sole practitioners do not have experienced staff (not involved in the engagement) that can perform engagement quality control preissuance reviews. A possible solution for appropriate monitoring could be for the sole practitioner to perform a post-issuance review prior to the start of the next engagement. The checklists already in the files can be used to help, eliminating the need to produce new ones. Monitoring Non-Audit Services -- Failure to extend monitoring policies and procedures to non-audit services (e.g., compilation and review engagements). Monitoring is required of all firms, whether they perform audits or not. Annual Inspection -- Failure to perform an annual inspection, including the functional elements of quality control, as required by firm policy. Consultation -- Failure to properly consult on engagements when faced with complex subject matter or newly issued technical pronouncements. Engagement Performance -- Failure to perform an adequate review of the engagement working papers and/or the accountant s and/or auditor s report and accompanying financial statements by the practitioner-in-charge of the engagement prior to the issuance of report. Disclosure Checklist -- Failure to complete a disclosure and reporting checklist as required by firm policy. Continuing Education -- Failure of professional staff to take adequate continuing professional education (CPE) in specialized industries, or accounting and audit related subjects, which resulted in disclosure, reporting, and documentation deficiencies on engagements selected for review. cpenow.com / info@cpenow.com 8 Copyright 2014 Surgent McCoy Self-Study CPE, LLC A6M1/14/S1