It’s Time For Year-End Audits

The end of the year traditionally starts the “busy season” for external auditors. But all of the hectic activity is no reason to neglect a highly-developed, measured, and methodical year-end strategic audit plan.

In addition to fulfilling the CPA firm’s own quality control policies and procedures, audit engagements are examined during peer review. A rating of Fail, or even Pass With Deficiencies, can shake the confidence of the firm’s leadership and its clients — to say nothing of the public’s confidence in the results.

Here are some of the key factors we’ve had to address while working with CPA firms that have received negative peer review results:

A thorough and well-crafted audit approach will have to address and satisfy seven basic issues:

• Common peer review challenges
• Audit planning and supervision
• Audit risk and risk assessment procedures
• Obtaining and documenting an understanding of the audit client and its environment, including its internal controls
• Materiality considerations
• Linking audit procedures to mitigate the risks identified and reach audit conclusions
• Required auditor communications with those charged with governance

When conducting a risk-based audit approach to the financial statements, the auditor’s overall objective is to provide reasonable assurance that the financial statements, as a whole, are free from material misstatement by error or fraud. This permits the auditor to express an opinion on whether the financial statements are prepared, in all material respects, in accordance with it’s applicable financial reporting framework (e.g., Accounting Principles Generally Accepted in the United States of America (U.S. GAAP).

Right From the Start

It’s worth noting that if you’re going to bring in an engagement quality control reviewer (EQCR), the time to do it is right at the beginning of the engagement.

The idea is to make sure the EQCR hears what the engagement team is thinking and has their attention during planning, rather than at the end of the engagement when work is done and that person begins to review the financial statements and the work papers. That way the EQCR can chime in and give their perspective on things for the engagement team to think about rather than raising them after the fact, potentially delaying the issuance of the audit report.

Audit efficiency is another issue worth focusing on at the beginning, reminding engagement teams to focus on the areas with the most risk — that is, audit smarter and know when they’ve gotten a sufficient amount of audit evidence in an area to make further testing unnecessary.

The EQCR can also make sure the team is up to date on any new rules or requirements that have kicked in — and several have in the last year or so, such as the new standard on current expected credit losses, and the new AICPA standards on risk assessment and auditing of material accounting estimates.

Common Peer Review Problems

There are a number of common mistakes made in risk assessment, starting with the failure to link the substantive procedures performed to the results of the risk assessment.

Another is audit procedures failing to link the client’s financial statement and relevant assertion-level risks for significant classes of transactions, account balances, or disclosures.

A third is designing audit procedures with little regard for the results of those assessments as required by AU-C 315, Understanding the Entity and its Environment and Assessing Risks of Material Misstatements.

Risk Assessment Shortcomings

A commonly cited shortcoming by peer reviewers is auditors’ failure to understand the entity and its internal controls. When conducting risk assessment, it’s useful to remember that it will generally be more effective at the start of the engagement, and that internal control procedures may be performed before the risk assessment document is completed. The auditor, however, is required to obtain understanding of whether the client’s controls have been properly designed and implemented, not required to test internal controls unless mandated under certain circumstances.

AICPA Professional Standards have dramatically changed over the last decade or so due to the issuance of risk assessment standards and Clarity Standards.

Audit Documentation Problems

Audit documentation is defined as “the record of audit procedures performed, relevant audit evidence obtained, and conclusions the auditor reached.”

It is evidence that the audit was properly planned and performed in accordance with the U.S. Generally Accepted Auditing Standards (GAAS), as well as evidence of the auditor’s basis for a conclusion.

Audit documentation should be enough to enable an experienced auditor — one who is independent and competent enough to challenge the engagement team’s procedures and conclusions — to understand the nature, timing and extent of the audit. That applies to understanding the results of the audit procedures performed and any significant findings or issues.

Properly executed audit documentation should answer the basic questions of who, what, when, where, why and how without any verbal explanations from the auditor.

Improve Audit Quality

Audit documentation should provide sufficient and appropriate evidence that risk assessment procedures were performed and that there was appropriate response to address the risk of misstatement at the financial statement level.

It also requires proof that the nature, timing and extent of audit procedures performed were adequate for the engagement, and that those procedures were linked to the assessed risks.

The audit team must document the results of the audit procedures, the conclusions reached, and that significant risks were reasonably considered.

Any departures from presumptively mandatory requirements to Professional Standards must be justified. It must also identify the engagement team that performed the work, when it was completed, the person who reviewed the work, and the date and extent of the review.

Audit workpaper documentation should also identify characteristics of the specific items tested, and discuss significant findings or issues with management or those charged with governance. Any information that contradicted or was inconsistent with the final conclusion on a significant audit finding or issue that was addressed should also be documented.

Remember the Lawyers

Over the years we’ve worked with litigation attorneys who have shared some “flash points” with us about notes and other workpaper matters that can come back to haunt the auditor.

One key point is to be sure to avoid any extraneous or irrelevant comments on the work papers that could turn up to bite you later. You want to avoid leaving comments like “the client’s books are a complete mess” or “these expenses seem questionable.”

Also beware of statements that discredit the auditors’ work, like “close enough for government work.”

Don’t leave personal files containing memos, schedules and other matters related to an engagement, or superseded or outdated workpapers.

Properly prepare workpaper files by initialing and dating each audit program step. Sign off any audit program step determined to be not applicable “N/A,” or as not considered necessary “N/C/N”, followed by an explanation.

Any “Open Items Lists” should be reviewed and any conclusions regarding unique issues should be thoroughly documented. Additionally, time budgets explaining any overages and underages should be maintained, and the completion date should be documented.

Professional Standards require that workpapers should be retained for a minimum of five years from the report release date — although practice, legal, regulatory, or other factors may dictate a longer retention period. You should also consider the requirements by your State Board of Accountancy.

Don’t Forget Your Independence

The AICPA Code of Professional Conduct requires auditors to be independent in both fact and appearance. Auditor independence issues can be classified into four high-level areas:

• Financial interest
• Family relationship
• Management function
• Management decision making

If you plan to perform permissible non-attest services, the audit client must first agree to make all management decisions and perform all management responsibilities.

This begins with designating a person with suitable skills, knowledge, and/or experience (SKE requirement) — preferably within senior-level management — to oversee the performance of the permissible non-attest services.

The client must evaluate the adequacy of and accept responsibility for the results of the non-attest services, as well as establish and maintain internal controls, including monitoring ongoing activities.

Auditors should exercise caution when it comes to matters that can raise red flags about their independence in a peer review or in litigation. Areas of concern include:

• Providing multiple non-attest services without adequate firm safeguards
• Significant concentration of revenue coming from one audit client
• Taking on management responsibilities
• Providing consultation that goes beyond routine audit advice

Also be wary of inadvertently engaging in other non-compliance activities like performing non-attest services for a company before it becomes an attest client; loaning staff members to an attest client; certain mergers or purchase of a CPA firm; employment of, or association with, an attest client; performing attest services for a client with unpaid fees; and engaging a client employee.

Finally, other red-flag issues to consider include having a financial interest in an attest client and its affiliates, the adequacy of the fees charged, and the existence of a group audit.

Collemi Consulting leverages nearly three decades of experience to provide trusted technical accounting and auditing expertise when you need it the most. We regularly work with CPA firm leadership to help them reduce risk and maximize efficiencies. To schedule an appointment, contact us at (732) 792-6101.