STATE OF NEW MEXICO Office of the State Auditor

Transcription

1 STATE OF NEW MEXICO Office of the State Auditor AUDIT DOCUMENTATION REVIEW GUIDE Revised November 2006 To be used for review of audits of the Fiscal year ended June 30, 2006

2 AGENCY UNDER REVIEW AGENCY # DATE REPORT RECEIVED AUDITOR REPORTS FOR FISCAL YEAR ENDED NOTES/CONTACTS CONCLUSIONS Generally Accepted Auditing Standards Auditor Auditor did Review (1) General Standards (2), Field Work Standards (3), and Reporting complied not comply Guide Standards (4) Generally Accepted Auditing Standards. (SAS AU ) Does the Auditor have sufficient knowledge of the SAS s to identify those with this Standard with this Standard Page Reference that are applicable to his or her audit? Did the auditor justify any departure from SAS? (SAS AU ) G (1) The audit is to be performed by a person or persons having adequate technical training and proficiency as an auditor. (SAS AU 210) 5-9 G (2) In all matters relating to the assignment, an independence in mental attitude is to be maintained by the auditor or auditors. (SAS AU 220) 9-12 G (3) Due professional care is to be exercised in the performance of the audit and the preparation of the report. (SAS AU 230) FW (1) The work is to be adequately planned and assistants, if any, are to be properly supervised. (SAS AU 310 to 317) FW (2) A sufficient understanding of the internal control structure is to be obtained to plan the audit and to determine the nature, timing, and extent of tests to be performed. (SAS AU 319 to 325) FW (3) Sufficient competent evidential matter is to be obtained through inspection, observation, inquiries, and confirmations to afford a reasonable basis for an opinion regarding the financial statements under audit. (SAS AU 326 to 390) R (1) The report shall state whether the financial statements are presented in accordance with accounting principles generally accepted in United States (SAS AU 410, 411, and AU h) R (2) The report shall identify those circumstances in which such principles have not been consistently observed in the current period in relation to the preceding period. (SAS AU 420) R (3) Informative disclosures in the financial statements are to be regarded as reasonably adequate unless otherwise stated in the report. (SAS AU 431) If management omits from the financial statements, including the accompanying notes, information that is required by GAAP, the auditor should express a qualified or an adverse opinion and should provide the information in his report, if practicable, unless its omission from the auditor s report is recognized as appropriate by a specific SAS. (AU ) R (4) The report shall either contain an expression of opinion regarding the financial statements, taken as a whole, or an assertion to the effect that an opinion cannot be expressed. When an overall opinion cannot be expressed, the reasons therefore should be stated. In all cases where an auditor s name is associated with financial statements, the report should contain a clear-cut indication of the character of the auditor s work, if any, and the degree of responsibility the auditor is taking. (SAS AU 504 to 561) z/review Guides/FYE June Review Guides/Audit Document Review Page 2

3 REVIEWER DATE SUPERVISOR DATE Purpose: To determine whether the audit documentation for this engagement meets applicable auditing, accounting and financial reporting standards and related requirements. The purpose of this checklist is to ensure the scope of the audit documentation review is consistent and sufficient to form a conclusion on the quality of work performed. Description: This checklist is organized by AICPA and Government Auditing Standards: general; fieldwork; and reporting. All questions in the checklist have been designed to show yes or n/a (not applicable) answers as favorable responses. All unfavorable responses, no, must be fully explained and if applicable, addressed in the letter to the independent public accountant summarizing the deficiencies in the audit documentation. Unfavorable answers may identify issues that require further review but do not automatically mean that the auditor did not comply with the applicable auditing standard. The reviewer must exercise professional judgment when determining whether the auditing standard was complied with. As a general rule, if a determination is made that any of the auditing standards besides due professional care was not complied with, that automatically indicates lack of compliance with due professional care. References: AAG-SLV AICPA Audit and Accounting Guide State and Local Governments (May 1, 2005) AAG-GAS AICPA Audit Guide: Government Auditing Standards and Circular A-133Audits (May 1, 2005) AC AU Financial Accounting Standards (FASB), Current Text Codification of Statements on Auditing Standards, AICPA G-05 Governmental Accounting, Auditing, and Financial Reporting, using the GASB 34 Model, 2005, GFOA GAGAS United States General Accounting Office, Government Auditing Standards, 2003 Revision (Yellow Book) GASB Codification of Governmental Accounting and Financial Reporting Standards as of June 30, 2005, GASB OMB A-133 Office of Management Budget (OMB) Circular A-133, Audits of State and Local Governments and Non-Profit Organizations, Revised June 27,2003 SAO Rule NMAC, Requirements for Contracting and Conducting Audits of Agencies, May 13, 2005 SAS AU AICPA Statements on Auditing Standards Nos. 1 to 101 (as of January 1, 2005) ET Code of Professional Conduct in AICPA Professional Standards z/review Guides/FYE June Review Guides/Audit Document Review Page 3

4 TABLE OF CONTENTS I. Standards: Page A. General Standards (1) Competence 5 (2) Quality Control and Assurance 8 (3) Independence 9 (4) Professional Judgment 12 B. Fieldwork Standards (1) Planning and Supervision 14 (2) Internal Control 24 (3) Information Systems Checklist 28 (4) Evidence and Working Papers a. General 31 b. Single Audit 38 c. Cash 40 d. Receivables 41 e. Inventories 43 f. Investments 43 g. Prepaid Expenses 45 h. Capital Assets 45 i. Liabilities 46 j. Deferred Revenue 48 k. Commitments and Contingencies 49 l. Fund Equity 50 m. Revenues and Expenditures 50 (5) Fraud, Illegal Acts and Other Noncompliance 53 C. Reporting Standards 56 A. General Standards z/review Guides/FYE June Review Guides/Audit Document Review Page 4

5 (1) Competence The first general standard under generally accepted auditing standard AU Section 210 is: The audit is to be performed by a person or persons having adequate technical training and proficiency as an auditor. The third general standard for government financial audits is: the staff assigned to perform the audit or attestation engagement should collectively possess adequate professional competence for the tasks required. (GAGAS 3.39) GUIDANCE: This standard places responsibility on the audit organization to ensure that each engagement is performed by staff who collectively have the knowledge, skills, and experience necessary for that assignment. Staff members should collectively possess: knowledge of applicable GAGAS and education, skills, and experience to apply such knowledge to the work; general knowledge of the environment in which the audited entity operates and the subject matter under review; skills to communicate clearly and effectively; skills appropriate for the work being performed (i.e. sampling, information systems, complex engineering data, specialized audit methodologies or analytical techniques). (GAGAS 3.42) Auditors performing financial audits should be knowledgeable in generally accepted accounting principles (GAAP) and the AICPA s generally accepted auditing standards for field work and reporting and the related Statements on Auditing Standards (SAS) and they should be competent in applying these standards and SASs to the task assigned. (GAGAS 3.43) Auditors engaged to perform financial audits or attestation engagements should be licensed certified public accountants or persons working for a licensed certified public accounting firm or a government auditing organization. Public accountants and accounting firms meeting licensing requirements should also comply with the applicable provisions of the public accountancy law and rules of the jurisdiction(s) where the audit is being performed and the jurisdiction(s) in which the public accountants and their firms are licensed. (GAGAS 3.44) Section B (1) of NMAC requires audit documentation review to include a test of audit firm documentation of continuing professional education for compliance with GAGAS requirements. Do not skip this required procedure because the OSA performs some related review during the IPA Firm Profile review process. Although this review does not require an understanding of the entire audit organization process as listed in GAGAS par. 3.40, be aware of the firm s hiring practices, recruitment efforts and evaluation process to help identify systemic problems. a. Review the audit firm s education or experience requirements and copies of CPE certificates for staff assigned to the audit engagement under review to answer the following questions: Yes No N/A Ref (1) Has the audit firm established policies and procedures to ensure that its financial audits will be conducted by staff who collectively possess the technical knowledge, skills, and experience necessary to be competent for the type of work being performed before beginning work on the assignment? (GAGAS 3.42 ) This includes knowledge of GAGAS, the client, and appropriate other skills. (2) Does it appear from the review of the audit firm s files that the audit firm s financial audit staff collectively possessed the skills needed to be competent for the financial and compliance audit undertaken? (GAGAS 3.42) For Single Audits, IPA firm concurring reviewers should have knowledge of Government Auditing Standards and OMB A-133. (AICPA Single Audits 2003, Appendix B, Common Engagement Deficiencies) These skills would include knowledge of GAAP, GAAS and SAS s. z/review Guides/FYE June Review Guides/Audit Document Review Page 5

6 (3) If applicable, did the audit firm have policies and procedures for determining whether outside consultants hired to do financial audit work would have the skills needed to perform the required tasks? External and internal specialists assisting in performing a GAGAS assignment should be qualified and should maintain professional competence in their areas of specialization but are not required to meet the CPE requirements described here. However, auditors who use the work of external and internal specialists should ensure that such specialists are qualified in their areas of specialization and should document such assurance. (GAGAS 3.48) (4) If applicable, did the audit firm establish policies and procedures for determining whether sub-contractors hired to assist the firm on the audit meet all the required education and experience requirements? Most subcontractors do not qualify or act as specialists. These arrangements usually are close to a joint venture. For this reason, all participant firms must meet these requirements. (5) Are all persons working on the audit licensed CPAs or are they working for a licensed CPA firm or government auditing organization (GAGAS par. 3.44)? b. Has the audit firm established continuing education and training requirements that meet the standard of GAGAS 3.45 that requires auditors performing work under GAGAS to maintain their professional competence through continuing professional education? Therefore, each auditor performing work under GAGAS should complete, every 2 years, at least 80 hours of CPE that directly enhance the auditor s professional proficiency to perform audits and/or attestation engagements. At least 24 of the 80 hours of CPE should be in subjects direct related to government auditing, the government environment, or the specific or unique environment in which the audited entity operates. At least 20 hours of the 80 should be completed in any 1 year of the 2-year period. Guidance and a related amendment on this subject are available in a GAO document, Government Auditing Standards Guidance on GAGAS Requirements for Continuing Professional Education (GAO G) and a GAQC Alert #2 April 22, 2005, at Who is required to obtain the 24 hour type CPE and the 80 hour type CPE is answered in paragraphs 5 through 9 of the guidance and in the amendment to GAGAS What training applies toward the 24-hour requirement and the 80- hour requirement is answered in paragraphs 16 through 23 of the guidance. Programs and activities that do not apply are described in paragraph 24. Prorated CPE requirements described in paragraph 12 of the guidance apply to individuals hired sometime during the organization s 2-year CPE period. CPE deficiency make-up is allowed as described in paragraph 14 of the guidance. c. Based on the review of the audit documentation and the level of work performed that the documentation reflects, does it appear that the staff assigned to the audit collectively had the skills needed to conduct the audit? (GAGAS 3.42) z/review Guides/FYE June Review Guides/Audit Document Review Page 6

7 Based on your review of the above steps, did the audit firm establish policies and procedures suitably designed for the size of the firm, its work and structure (GAGAS 3.40), to reasonably ensure that staff assigned to conduct the audit collectively possessed adequate professional competence for the tasks required? (2) Quality Control The fourth general standard for government audits is: (GAGAS 3.49) Each audit organization performing audits and/or attestation engagements in accordance with GAGAS should have an appropriate internal quality control system in place and should undergo an external peer review. GUIDANCE: An audit organization s system of quality control encompasses the audit organization s structure and the policies adopted and procedures established to provide the organization with reasonable assurance of complying with applicable standards governing audits and attestation engagements. An audit organization s internal quality control system should include procedures for monitoring, on an ongoing basis, whether the policies and procedures related to the standards are suitably designed and are being effectively applied. (GAGAS 3.50) Audit organizations performing audits and attestation engagements in accordance with GAGAS should have an external peer review of their auditing and attestation engagement practices at least once every 3 years by reviewers independent of the audit organization being reviewed. (GAGAS 3.52) Confirm the following facts about the IPA firm s most recent peer review by using OSA IPA firm profiles files, the IPA office documentation, and/or IPA inquiry: a. Is the IPA s peer review current? Note that the letter of acceptance will indicate the due date for the next review. See B (1) for requirements for new firms. b. Was the IPA s peer review performed on-site at the IPA s office? (Sec B (4) c. Did the reviewing firm receive an unqualified opinion on the review of their organization s system of quality controls? (Sec B (8) (d) d. Did the IPA s peer review include the review of at least one GAGAS audit? (Sec B (10)(c)(ii)) e. Does the audit engagement under review for the completion of this guide appear to follow the internal quality review process established by the IPA firm? (GAGAS 3.50) f. Were questions or deficiencies noted in the IPA s peer review appropriately resolved? (GAGAS 3.54 (d)) g. Discuss with the firm their monitoring process. The monitoring process is how the firm verifies that the professional standards are being met on a continuous basis. If the firm has adopted the AICPA Peer Review Program, then examine the firm s monitoring documentation required by GAGAS par The peer review does not replace this monitoring. z/review Guides/FYE June Review Guides/Audit Document Review Page 7

8 Based on your review of the steps above, did the audit firm have an appropriate internal quality control system in place, including having undergone an external peer review and maintaining an appropriate monitoring system GAGAS Sec. 3.49? The second general standard of Generally Accepted Auditing Standards is: In all matters relating to the assignment, an independence in mental attitude is to be maintained by the auditor or auditors. (AU Sec. 220) (3) Independence The first general standard for government financial audits is: In all matters relating to the audit work, the audit organization and the individual auditor, whether government or public, should be free both in fact and appearance from personal, external, and organizational impairments to independence. (GAGAS 3.03) GUIDANCE: Auditors and audit organizations have a responsibility to maintain independence so that opinions, conclusions, judgments, and recommendations will be impartial and will be viewed as impartial by knowledgeable third parties. Auditors should avoid situations that could lead reasonable third parties with knowledge of the relevant facts and circumstances to conclude that the auditors are not able to maintain independence and, thus, are not capable of exercising objective and impartial judgment on all issues associated with conducting and reporting on the work. (GAGAS 3.04) Auditors should consider three general classes of impairments to independence personal, external and organizational. If one or more of these impairments affects an individual auditor s capability to perform the work and report results impartially, that auditor should decline to perform the work per GAGAS The SAO prior written approval process required by Sec I.(4) for all contracts between governmental agencies and IPAs on the SAO approved IPA list, is designed to determine whether proposed non-audit services would impair auditor independence. If a professional services contract for nonaudit services did not receive prior written approval from the SAO, refer to GAGAS par (f) and I (2) of NMAC for prohibited services to determine whether the audit firm s independence was impaired by the performance of the nonaudit engagement. REF YES NO N/A a. For the financial auditors who were assigned to this audit, review the records, forms or other documents the audit firm requires its auditors to use to disclose personal impairments to answer the following: (1) Does the audit firm have policies and procedures for determining whether its financial audit staff has any personal impairments to independence? The standard makes auditors responsible for notifying the appropriate official within their audit firm if they have any personal impairments. (GAGAS 3.08) (2) Did the financial audit staff meet the audit firm s requirements in this area? (GAGAS 3.07) (3) Does the firm have policies and procedures in place and operating effectively to ensure that both specialist and sub-contractors meet the GAGAS and AICPA Independence Standards (GAGAS par. 3.06, AU 220)? Verify documentation if applicable and required by firm standards. z/review Guides/FYE June Review Guides/Audit Document Review Page 8

9 b. Does the audit firm have policies and procedures for handling personal impairments that have been identified or disclosed? The standard requires the audit organization to resolve the impairment in a timely manner by mitigating the personal impairment (eliminating it), removing the auditor from work on that assignment, or withdrawing from the audit. In situations in which government auditors cannot withdraw from the audit, they should report the personal impairment in the scope section of the audit report. (GAGAS 3.05 and 3.09) c. Does the audit firm have policies and procedures for handling external impairments to independence once they have been identified? Examples of external impairments are external interference or influence that could improperly limit or modify the scope of an audit, including pressure to reduce inappropriately the extent of work performed in order to reduce costs or fees, unreasonable restrictions on time allowed to complete an audit, influences that jeopardize the auditors employment for reasons other than incompetence, misconduct, or the need for audit services, etc. Examples of interference external to the audit organization in the assignment are: appointment, and promotion of audit personnel; restriction on funds or other resources (did they provide staff support) provided to the audit organization that adversely effected the audit firm s abilities to carry out its responsibilities; improper influence on auditor judgment as to the appropriate content of the report; or threat of replacement over a disagreement with content of audit report, conclusions or application of an accounting principle. (GAGAS 3.05 and 3.19) d. Did the audit documentation review reveal any impairment of auditor independence? (GAGAS 3.07 to 3.32) If yes, how was it resolved? e. Inquire whether the auditor had any professional service contracts (PSCs) with the auditee. Review any such PSCs that exist. (1) Did the state auditor give prior written approval for the PSC as required by I(4)? (2) Did any non-audit services violate the two overarching principles described in GAGAS 3.13? (If the answer is yes, the auditor was not independent for purposes of performing an audit on that agency) f. Did the auditor document the safeguards for any non-audit services provided under a PSC or included with the audit contract as required by GAGAS 3.17? (1) The audit firm must document its rationale that providing the non-audit services does not violate the two overarching principles. (GAGAS z/review Guides/FYE June Review Guides/Audit Document Review Page 9

10 3.17(a)) (2) Before performing the services, the audit firm should establish and document an understanding with the audited entity regarding the objectives, scope of work, and product or deliverables of the non-audit service. The audit firm should also establish and document an understanding with management per GAGAS 3.17 b (1) through (4). (3) Note that in the Government Auditing Standards Answers to Independence Standard Questions, Question 46 allows the auditor to prepare the working trial balance and financial statement only from appropriate books and records that balance when the agency has knowledgeable management that can accept responsibility for the work. When such non-audit services are provided the auditor must document compliance with the safeguards except for the safeguard that precludes personnel who provided the non-audit service from high-level audit work. (GAGAS 3.17(c)) If these nonaudit services were provided, did the firm document the safeguards as required? (4) The audit organization is precluded from reducing the scope and extent of the audit work below the level that would be appropriate if the nonaudit work was performed by an unrelated party. (GAGAS 3.17 (d)) If allowable nonaudit services were provided, did the audit firm conduct the audit with adequate procedures, as if the nonaudit services had been provided by another firm? g. Did the management representation letter acknowledge the audit organization s role in performing specified non-audit services and management s review, approval, and responsibility for the accrual adjustments? (Government Auditing Standards Answers to Independence Standard Questions, Question 46) (1) If the auditor converted cash-based financial statements to accrual-based financial statements and management was in the position to make informed judgment to review, approve, and take responsibility for the appropriateness of the conversion, did the management representation letter acknowledge the audit organization s role in reflecting accruals and management s review, approval, and responsibility for the accrual adjustments? (Government Auditing Standards Answers to Independence Standard Questions, Question 46) (2) If the audit firm prepared the trial balance and draft financial statements related notes, and adjusting journal entries, does the management representation letter acknowledge the audit organization s role in preparing those items and management s review, approval and responsibility for them? (Government Auditing Standards Answers to Independence Standard Questions, Question 46) (3) Did the auditor avoid preparing any indirect cost proposal or cost z/review Guides/FYE June Review Guides/Audit Document Review Page 10

11 allocation plan as required by Section I.(2)(a) of NMAC? Based on your review of the audit firm policies, procedures and the audit documentation of this engagement, did the audit firm (auditor) have and comply with controls appropriate for the size of the firm, and maintain personal, external, and organizational independence both in fact and appearance? (4) Professional Judgment and Due Professional Care The third general standard of Generally Accepted Auditing Standards is: Due professional care is to be exercised in the performance of the audit and the preparation of the report. (AU ) The general standard related to professional judgment is: Professional judgment should be used in planning and performing audits and attestation engagements and in reporting the results. (GAGAS 3.33) GUIDANCE: This GAGAS standard requires auditors to exercise reasonable care and diligence and to observe the principles of serving the public interest and maintaining the highest degree of integrity, objectivity, and independence in applying professional judgment to all aspects of their work. This standard also imposes a responsibility upon each auditor performing work under GAGAS to observe GAGAS. If auditors state they are performing their work in accordance with GAGAS, they should justify any departures from GAGAS. (GAGAS 3.34) Auditors neither assume that management is dishonest not assume unquestioned honesty. In exercising professional skepticism, auditors should not be satisfied with less than persuasive evidence because of a belief that management is honest. (GAGAS 3.37) The exercise of professional judgment allows the auditor to obtain reasonable assurance that material misstatements or significant inaccuracies in data will likely be detected if they exist. (GAGAS 3.38) Professional judgment requires auditors to exercise professional skepticism, which is an attitude that includes a questioning mind and a critical assessment of evidence. Auditors use the knowledge, skills, and experience called for by their profession to diligently perform, in good faith and with integrity, the gathering of evidence and the objective evaluation of the sufficiency, competency, and relevancy of evidence. Since evidence is gathered and evaluated throughout the assignment, professional skepticism should be exercised throughout the assignment. (GAGAS 3.36) The AICPA third general standard requires Due Professional Care to be exercised in the planning and performance of the audit and the preparation of the report. (SAS AU ) This standard requires the independent auditor to plan and perform his or her work with due professional care. Due professional care imposes a responsibility upon each professional within an independent auditor s organization to observe the standards of field work and reporting. (SAS AU ) Auditors should be assigned to tasks and supervised commensurate with their level of knowledge, skill, and ability so that they can evaluate the audit evidence they are examining. The auditor with final responsibility for the engagement should know, at a minimum, the relevant professional accounting and auditing standards and should be knowledgeable about the client. The auditor with final responsibility is responsible for the assignment of tasks to and supervision of assistants. (SAS AU ) The exercise of due professional care allows the auditor to obtain reasonable assurance that the financial statements are free of material misstatement, whether caused by error or fraud. (SAS AU ) The independent auditor s objective is to obtain sufficient competent evidential matter to provide him or her with a reasonable basis for forming an opinion. The nature of most evidence derives, in part, from the concept of selective testing of the data being audited, which involves judgment regarding both the areas to be tested and the nature, timing, and extent of the tests to be performed. In addition, judgment is required in interpreting the results of audit testing and evaluating audit evidence. Even with good faith and integrity, mistakes and errors in judgment can be made. Furthermore, accounting representations contain accounting estimates, the measurement of which is inherently uncertain and depends on the outcome of future events. The auditor exercises professional judgment in evaluating the z/review Guides/FYE June Review Guides/Audit Document Review Page 11

12 reasonableness of accounting estimates based on information that could reasonably be expected to be available prior to the completion of field work. As a result of these factors, in the great majority of cases, the auditor has to rely on evidence that is persuasive rather than convincing. (AU ) Because of the characteristics of fraud, a properly planned and performed audit may not detect a material misstatement. Characteristics of fraud include (a) concealment through collusion among management, employees, or third parties; (b) withheld, misrepresented, or falsified documentation; and (c) the ability of management to override or instruct others to override what otherwise appears to be effective controls. For example, auditing procedures may be ineffective for detecting an intentional misstatement that is concealed through collusion among personnel within the entity and third parties or among management or employees of the entity. Collusion may cause the auditor who has properly performed the audit to conclude that evidence provided is persuasive when it is, in fact, false. In addition, an audit conducted in accordance with generally accepted auditing standards rarely involves authentication. Furthermore, an auditor may not discover the existence of a modification of documentation through a side agreement that management or a third party has not disclosed. Finally, management has the ability to directly or indirectly manipulate accounting records and present fraudulent financial information by overriding controls in unpredictable ways. (AU ) Based on the work performed: YES NO N/A REF a. Does the audit firm have policies and procedures requiring all applicable generally accepted government audit standards to be followed during all phases in conducting its financial audits including OMB Circular A-133 Revised June 27, 2003, where applicable? Do the results of the audit documentation review show compliance with these firm policies and procedures? (GAGAS 3.34) b. If there was any departure from Government Auditing Standards during the conduct of the audit, was the departure justified? (GAGAS 3.34) c. Does the audit documentation reflect objective auditor evaluation in good faith with integrity (professional judgment) with regard to: (1) Determining the type of assignment to be performed and the standards that apply; (2) Defining the scope of work (in compliance with Section A of NMAC); (3) Selecting the methodology; (4) Determining the type and amount of evidence to be gathered; (5) In choosing the tests and procedures; (6) In evaluating the results of the work; and (7) In reporting the results of the work? (GAGAS 3.35) z/review Guides/FYE June Review Guides/Audit Document Review Page 12

13 d. Do not answer this question until the entire review guide has been completed. Noncompliance with any of the other auditing standards, general, field work, or reporting, is indicative of noncompliance with the due professional care standard. Did the audit firm perform this engagement in accordance with generally accepted auditing standards, NMAC, and where applicable, the requirements of the OMB Circular No. A- 133 Revised June 27, 2003? Based on this review of the audit firm s policies and procedures and audit documentation for the engagement under review and the results of the rest of this review guide, the preliminary review guide, and the full desk review guide, did the audit firm (auditor) exercise professional judgment and due professional care in conducting this audit engagement and in preparing the related reports? B. Field Work Standards (1) Planning and Supervision The first field work standard per the AICPA and the GAO is: The work is to be adequately planned and assistants, if any, are to be properly supervised. (SAS AU 310 to 317, and GAGAS 4.03 (a)) The GAO s additional field work standards pertaining to financial statement audit planning are requirements for (a) auditor communication and (b) consideration of results of previous audits. a. Auditors should communicate information regarding the nature, timing, and extent of planned testing and reporting and the level of assurance provided to officials of the audited entity and to the individuals contracting for or requesting the audit. (GAGAS 4.06) b. Auditors should consider the results of previous audits and attestation engagements and follow up on known significant findings and recommendations that directly relate to the objectives of the audit being undertaken. (GAGAS 4.14) Audit Rule 2004 also addresses these additional GAO requirements. The Section M (2) of NMAC requires the IPA to prepare a written and dated engagement letter during the planning stage of the audit and submit a copy to the OSA within ten days of the audit entrance conference. A list of client prepared documents with expected delivery dates should be attached. Section I (2) of the Rule indicates that follow up on results of previous audits includes findings reported in financial, special and internal audits. GUIDANCE: Audit planning involves developing an overall strategy for the expected conduct and scope of the examination. The nature, extent, and timing of planning vary with the size and complexity of the entity, experience with the entity, and knowledge of the entity s business. (AU ) Supervision involves directing the efforts of assistants, including outside consultants, specialists, and sub-contractors who are involved in accomplishing the objectives of the examination and determining whether those objectives were accomplished. Elements of supervision include instructing assistants, keeping informed of significant problems encountered, reviewing the work performed, and dealing with differences of opinion among audit firm personnel. The extent of supervision appropriate in a given instance depends on many factors, including the complexity of the subject matter and the qualifications of persons performing the work. (AU ) a. Does the audit documentation (engagement letter) establish the following elements of understanding with the client regarding the services to be z/review Guides/FYE June Review Guides/Audit Document Review Page 13

14 performed for each engagement? (AU ) (1) Is the engagement letter addressed to: the head of the audited entity; the audit committee, board of directors or equivalent oversight body; the chief financial officer; and individuals contracting for or requesting the audit? (GAGAS 4.08 and 4.09) (2) The objective of the engagement is the expression of an opinion on the financial statements (AU ) (3) Management & client responsibilities i. Management is responsible for the agency financial statements ii. Management is responsible for establishing and maintaining effective internal control over financial reporting iii. Management is responsible for identifying and ensuring that the entity complies with the laws and regulations applicable to its activities iv. Management is responsible for making all financial records and related information available to the auditor v. At the conclusion of the engagement, management will provide the auditor with a letter that confirms certain representations made during the audit vi. Statement that management is responsible for adjusting the financial statements to correct material misstatements (AU ); (4) The auditor s responsibilities (AU ) i. Auditor is responsible to conduct the audit in accordance with generally accepted auditing standards ii. Auditor responsible to obtain reasonable rather than absolute assurance about whether the financial statements are free of material misstatement, caused by error or fraud (AU ) iii. An audit includes obtaining an understanding of internal control sufficient to plan the audit and to determine the nature, timing, and extent of audit procedures to be performed. (a) Does the engagement letter communicate the auditor s responsibility for testing internal controls over financial reporting and compliance with laws, regulation, and provisions of contracts or grant agreements? (GAGAS 4.10) (b) Does the engagement letter indicate that a written report on internal control will be issued? (GAGAS 4.10) iv. Auditor is responsible for ensuring that the audit committee or others with equivalent authority or responsibility are aware of any reportable conditions which come to the auditor s attention (AU 310.6) v. Auditor will bring fraud to the attention of the client, even if it is inconsequential? (SAS , Section , NMSA 1978, and K (1)(g) vi. Was an understanding reached with the governing body about nature and extent of communication about fraud? (5) Limitations on the engagement i. The auditor is responsible to obtain reasonable rather than absolute assurance about whether the financial statements are free of material misstatement, caused by error or fraud. Accordingly, a material misstatement may remain undetected. Also, an audit is not designed z/review Guides/FYE June Review Guides/Audit Document Review Page 14

15 to detect error or fraud that is immaterial to the financial statements. ii. If the auditor is unable to complete the audit or is unable to form an opinion, the auditor may decline to express opinion or decline to issue a report iii. An audit is not designed to provide assurance on internal control or to identify reportable conditions. (6) Other i. Are the types of financial statements, names of component units, individual funds, combining statements, applicable SI and RSI ( A (1)(e) and (2)(d)) that will be audited identified and do they meet the requirements of Section A(1) and (2)? ii. Are the services to be provided clearly described and correct for the engagement? All OSA audit engagements are required by the Rule and the OSA contract to be in accordance with: Government Auditing Standards (Yellow Book); OMB Circular A-133 Revised June 27, 2003 (if the agency expended $500,000 or more of federal funds during the fiscal year); and NMAC Requirements for Contracting and Conducting Audits of Agencies. iii. Are other non-audit services to be performed by the audit firm included in the engagement letter like preparation of: the working trial balances; the accrual journal entries; or draft financial statements? (Government Auditing Standards Answers to Independence Standard Questions, Question 46) b. Does audit documentation show that assistants were informed of their responsibilities and the objectives of the procedures they performed? (AU ) c. Does audit documentation show that work performed is reviewed for adequacy of work and consistency with conclusions and the auditor s report? (AU ) d. If applicable, does audit documentation show that differences of opinion concerning accounting and auditing issues among staff were appropriately resolved? Such procedures should enable an assistant to document his disagreement with the conclusions reached if, after appropriate consultation, he believes it necessary to disassociate himself from the resolution of the matter. In this situation, the basis for the final resolution should also be documented. (AU ) e. Did the audit firm inquire about the existence of reports related to previous financial audits, attestation engagements performance audits or other studies including related significant findings and recommendations? (GAGAS par and SAO Rule I.(2) f. Does audit documentation show that the auditor followed-up on known material findings and recommendations from previous audits or engagements in (e) above? (GAGAS 4.14) g. Did the follow-up include reporting any special audit findings in the findings of the annual financial and compliance audit as required by SAO Rule z/review Guides/FYE June Review Guides/Audit Document Review Page 15

16 I.(2)? h. If specialists were used, does the audit documentation show that the specialist was determined to be independent and objective in relation to the auditee, and that his/her qualifications were evaluated by the audit firm? Was the specialist s work properly analyzed? (AU ) i. If an internal audit function exists, did the auditor determine whether the internal audit function was sufficient to identify those internal audit activities that were relevant to planning the audit? (AU ) (1) If an internal audit function exists, did the auditor assess the competence and objectivity of the internal function in light of the intended effect on the audit and determine if it would be efficient to consider how the internal auditors work might affect the nature, timing, and extent of audit procedures? (AU ) (2) If an internal audit function exists, did the IPA consider how the internal auditors work would affect the audit, including procedures the IPA performed to obtain an understanding of internal control and to assess risk, and substantive procedures? (AU ) (3) If an internal audit function exists, and its work affected the IPA s procedures, did the IPA perform his/her own procedures to obtain sufficient, competent, evidential matter to support the auditor s report? (AU ) (4) If the internal auditor s work was used, did the IPA perform procedures to evaluate the quality and effectiveness of the work that significantly affected the nature, timing, and extent of the IPA procedures, including testing some of the internal auditors work? (AU ) (5) If direct assistance was provided by internal auditors in matters that affected the nature, timing, and extent of audit procedures, did the IPA assess their competence and objectivity and supervise, review, evaluate, and test the work performed by the internal auditors? Did the IPA inform the internal auditors of their responsibilities and the objectives of procedures they were to perform? (AU ) j. If material component units were examined by another auditor, does the audit evidence show contact with the auditor to determine the appropriate qualifications, independence, and verification of work as well as inform the auditor of planned use of his/her audit report in conjunction with this audit? (AU ) (1) If the audit report did not make reference to the work of the other auditor, did the auditor of the primary government perform additional steps to obtain satisfaction with the other auditor s examination? (AU ) z/review Guides/FYE June Review Guides/Audit Document Review Page 16

17 k. If the audit is a joint examination, is a formal understanding of the joint responsibilities developed? (AAG-SLV 3.35) l. Did the auditor properly consider: (1) What type of engagement is being performed and whether the engagement is intended to meet the governmental oversight agency s audit requirements? (AU Sec , fn. 9, , and ) (2) Matters affecting the industry in which the entity operates, such as accounting practices, economic conditions, laws and governmental regulations, contractual obligations and technological changes? (AU Sec and ) (3) Definition of the reporting entity indicating the related organizations, functions, and activities that are either included or excluded from the financial statements in accordance with professional standards? (GASB No. 14, GASB No. 39, and AAG-SLV (4) Preliminary judgment about materiality levels made? (AU Sec , , AAG-SLV, ) Did the auditor plan materiality at the individual fund level as required by the SAO Rule (Sec A.(1)(d) and (2)(a)? Note that this requirement does not apply to colleges and universities (Sec E(3)) (5) Factors affecting the continued functioning of the government, such as legal limitations on revenue, expenditures, or debt service? (AU Sec. 341 and AAG-SLV to13.18) m. Are considerations of the extent of the entity s computer processing, the complexity of computer operations, the organizational structure of computing activities, the availability of data, and the auditor s use of computer assisted audit techniques evidenced in planning the audit procedures? (AU ) n. Are considerations of the nature, extent, and timing of work to be performed evidenced in planning the audit procedures? (AU ) o. Are written audit programs prepared? (AU ) 1. Were the audit programs responsive to the needs of the engagement and the understanding of internal controls obtained during the planning process (AU and )? 2. Was consideration given to the applicable assertions in developing audit objectives and in designing substantive tests? (AU Sec ) 3. If conditions changed during the course of the audit, was the audit program modified as appropriate in the circumstances? (AU Sec and to.37) 4. Have all the procedures called for in the audit program been completed? z/review Guides/FYE June Review Guides/Audit Document Review Page 17

18 (AU Sec. 339) p. Are considerations of whether specialized skills are needed to consider the effect of computer processing on the audit, to understand the internal control structure, and or to design and perform audit procedures evidenced in planning the audit procedures? (AU ) Consider AU 319 specific requirement to hire specialist if necessary. q. Are considerations of audit risk and materiality evidenced in planning the audit procedures including an assessment of the risk of material misstatement due to fraud so that audit risk will be limited to a low level, appropriate for issuing an opinion on the financial statements? (AU ,.16,.26, AU ,.37) r. Were analytical procedures used in planning stage of the audit? (AU ,.20) (1) Enhancing the auditor s understanding of the entity since the last audit date? (AU ) (2) Identifying areas that may represent specific risks relevant to the audit? (AU ) (3) Investigating any significant differences from expectations? (AU ,.21) Are expectations documented? s. Do planning documents evidence a need to identify material related party transactions? (AU , AAG-SLV 4.34) t. Do planning documents evidence a need to evaluate the entity s (or the component unit s) ability to operate as a going concern? (GASB 14 par. 29 and AU to.06) u. If the auditor succeeded a predecessor auditor, did he: (1) Make inquiries of the predecessor auditor, with audit client approval, (prior to accepting the engagement, not necessarily before proposal, but before contract is signed) on significant matters including: information that might bear on the integrity of management; disagreements with management as to accounting principles, auditing procedures, or other similarly significant matters; communications to audit committees or others with equivalent authority and responsibility regarding fraud, illegal acts by clients, and internal control related matters; and the predecessor auditor s understanding as to the reasons for the change of auditors? (AU ) (2) Review the predecessor s working papers, with audit client approval, including documentation of planning, internal control, audit results, and other matters of continuing accounting and auditing significance, such as the working paper analysis of balance sheet accounts, and those relating z/review Guides/FYE June Review Guides/Audit Document Review Page 18

19 to contingencies? (AU ) (3) If financial statements prepared by a predecessor auditor are to be presented on a comparative basis with audited financial statement of a subsequent period, did the predecessor auditor obtain representation letters from management of the former client and from the successor auditor before reissuing (or consenting to the reissue of) a report previously issued on the financial statements of a prior period? (AU ) v. During the planning of the audit, did the auditor determine whether the auditee used a service organization to process certain transactions? A service organization s services are part of an entity s information system if they affect any of the following: (1) classes of transactions significant to the agency s financial statements; (2) procedures (automated or manual) by which the agency s transactions are initiated, recorded, processed, and reported from their occurrence to their inclusion in the financial statements; (3) the accounting records (electronic or manual) supporting information, and specific accounts in the agency s financial statements, involved in initiating, recording, processing and reporting the agency s transactions; (4) how the agency s information system captures other events and conditions that are significant to the financial statements; or (5) the financial reporting process used to prepare the agency s financial statements, including significant accounting estimates and disclosures. (AU and ) Examples of possible service organizations are: tax collection agencies (i.e. counties), Regional Education Service Centers (school districts), Public Housing Authority Fee Accountants W2(c), etc. (1) If the service organization s services were part of the auditee s information system, did the auditor obtain an understanding of the service organization s components of internal control: control environment; risk assessment; control activities; information and communications; and monitoring? (AU and ) (2) If the auditee used a service organization, did the auditor inquire of management as to whether it is aware of any subsequent events through the date of the service auditor s report that would have a significant effect on user organizations? (AU ) (3) The IPA shall consider whether any fee accountant used by the housing authority is a service organization according to the criteria of SAS 70. See Subsection V of NMAC, SAS AU 324, and the SAS 98 amendment to SAS 70 for further explanation regarding Service Organizations and related auditing requirements. If the housing authority has not implemented effective internal controls over the fee accountant s work product, the auditor will have to obtain sufficient understanding of the internal controls the fee accountant has over his/her work product to plan the audit. A service auditor s report on controls placed in operation at the fee accountant s organization should be helpful in providing a sufficient understanding to plan the audit of the z/review Guides/FYE June Review Guides/Audit Document Review Page 19