The U.S. Government Accountability Office (GAO) has issued technical updates to the 2018 Revision of Generally Accepted Government Auditing Standards (GAGAS), also known as the “Yellow Book.” Show The Yellow BookThe Yellow Book provides standards and guidance for auditors and audit organizations. It outlines the requirements for audit reports, professional qualifications for auditors, and audit organization quality control. Auditors of federal, state, and local government programs use these standards to perform their audits and produce their reports. The GAO first issued the Yellow Book in 1972. The GAO issued a major revision of the Yellow Book in 2018. The 2018 amendments modernized GAGAS and covered developments in the auditing, accountability, and financial management professions since the previous Revision made in 2011. Technical Update April 2021The GAO set out the 2021 technical updates and the original 2018 Revision in a side by side comparison table on pages i. and ii. in front of the Contents page of the Yellow Book. In addition to the Technical Update April 2021, the GAO issued accessible text of the same document. Yellow Book revisions undergo an extensive process, including public comments and input from the Comptroller General's Advisory Council on Government Auditing Standards. GAO considers these comments and input in finalizing revisions to the standards. Effective DatesThe 2018 revision of the Yellow Book is effective for financial audits, attestation engagements, and reviews of financial statements for periods ending on or after June 30, 2020, and for performance audits beginning on or after July 1, 2019. Early implementation is not permitted. The amendments included in the 2018 Revision of the Yellow Book, Technical Update April 2021, are effective upon issuance. In August, the Government Accountability Office (GAO) issued proposed standards revising Generally Accepted Government Auditing Standards (GAGAS), commonly known as the “Yellow Book.” The update revises the July 2007 Yellow Book and is expected to be effective for audits beginning after Dec. 15, 2011, with the exception of the financial chapter, which will have an effective date to coincide with the AICPA’s Auditing Standards Board (ASB) Clarity Project. This article highlights the significant changes in the proposed standards.The Yellow Book was first published in 1972 and has been updated and revised over the years. Two primary factors are driving the current Yellow Book update:
Another important consideration in updating the Yellow Book has been the ASB Clarity Project. As the ASB more closely aligns U.S. auditing standards with those issued by the International Auditing and Assurance Standards Board, the GAO reviews the standards and assesses their potential impact on GAGAS.
The proposed standards include other changes to further clarify and harmonize the standards. For instance, emphasis has been placed on removing duplication with ASB requirements and clarifying what represents an additive standard for GAGAS. Another example will be the elimination of the AICPA definitions for material weaknesses and significant deficiencies. These definitions will now be incorporated by reference. In addition, to provide a format consistent with the ASB Clarity Project, the footnote format has been refined to include only a direct reference to another standard.
CHAPTER REORGANIZATION Readers will quickly notice a reorganization of the Yellow Book. Ethical principles, formerly in chapter two, have now been incorporated into chapter one on the foundational concepts of GAGAS. Chapter two now emphasizes the application of GAGAS. Also, financial audit chapters four and five have been merged into a single chapter.
INDEPENDENCE REVISIONS Substantial changes have been incorporated into chapter three covering independence. The 2007 revision emphasized overarching principles of independence such as auditors not auditing their own work or taking the role of management. The principles were augmented by a question-and-answer guide that featured specific facts and circumstances. The guide had limitations in its applicability and usefulness due to its specificity.
The Yellow Book Advisory Council and staff concluded that a more formalized conceptual framework could provide a uniform structure for analyzing the many independence issues that can arise, each with its own facts and circumstances.
Under the new framework, the auditor identifies threats to independence and then assesses the significance of the threats. If identified threats are deemed significant to the engagement, the auditor then determines whether safeguards could be put in place to mitigate the threats to an acceptable level. The framework also provides guidance on the significance of certain specific threats and whether those threats can be mitigated.
This threat assessment and application of safeguards requires professional judgment. If the auditor concludes that there are no safeguards sufficient to reduce a threat to an acceptable level, then the threat would result in an impairment to independence, and the auditor should respond accordingly. The auditor is required to document any independence issue that requires significant discussion or analysis.
THREATS AND SAFEGUARDS The proposed standards identify categories of threats that occur through:
Under the proposed standards, if a nonaudit service is not expressly prohibited, the auditor should apply the conceptual framework to conclude whether a potential impairment exists. In some cases, safeguards may mitigate threats to an acceptable level. However, even if properly applied, safeguards may not always be sufficient to reduce some threats. The proposed standards identify safeguards created by the profession as well as those directly related to the work environment. Examples include:
PROHIBITIONS WITHIN CERTAIN NONAUDIT SERVICES While the proposed standards provide a conceptual framework for independence issues, certain specific prohibitions still exist. These prohibitions involve areas that have been problematic in the past and particularly so in a governmental public-sector environment. It is important to note that the entire nonaudit service is not prohibited, just certain services. Within each of the following nonaudit categories, specific services are expressly prohibited:
Internal Audit Services
Internal Control Monitoring and Assessments
Information Technology (IT) Services
Valuation Services
Financial Statement Preparation, Bookkeeping, and Client Assistance An area that the profession continues to struggle with involves maintaining independence when the auditor provides the audited entity with assistance in bookkeeping and financial statement preparation. Whether it involves converting cash statements to accrual basis or preparing financial statements, the auditor frequently walks a fine line between independence and impairment. The GAO’s proposed standards are consistent with those of the AICPA in identifying certain activities that create an automatic impairment. These include:
The proposed standards do not expressly prohibit a practitioner from providing bookkeeping or financial statement preparation other than the activities listed as prohibited in the standards. Before performing bookkeeping and financial services not expressly prohibited, the auditor should evaluate them within the conceptual framework to determine whether an impairment exists.
For bookkeeping and financial statement activities that are not expressly prohibited, management charged with overseeing the nonaudit service should possess suitable skill, knowledge or experience to evaluate the adequacy and results of the services performed. If management does not have suitable skill knowledge or experience to evaluate the adequacy and results of the services performed, an impairment exists. This requirement currently exists for CPAs under the AICPA’s Code of Professional Conduct, Rule 101, Independence (Interpretation 101-3, Performance of Nonattest Services).
AUDITS SUBSEQUENT TO NONAUDIT SERVICES The proposed standards introduce the concept of a post-impairment period. This period reflects the audit period immediately after the auditor provides an independence- impairing service. Under the proposed standards, auditors who perform independence-impairing nonaudit services may audit in subsequent periods only after sufficient safeguards have been identified to mitigate the threat. One example of a safeguard would be the performance of an audit by an auditor not providing the original nonaudit service. The auditor should also consider issues of independence in appearance that may arise should an audit be performed after an impairing nonaudit service has been provided.
QUESTION-AND-ANSWER GUIDE RETIREMENT The Answers to Independence Standards Questions (QA Guide) issued in July 2002 will be superseded by the new standards once they are finalized. Under the new independence framework, unless the service is specifically prohibited, the conceptual framework should be applied. Certain specific situations addressed in the original QA Guide such as “de minimis,” nonaudit services, and safe harbors have not been included in the proposed standards and will no longer apply. Instead, under the more principle-based framework, auditors will need to address the threats and safeguards within the conceptual framework.
QUALITY CONTROL The proposed standards have further harmonized quality control with that of the AICPA. Audit organizations and firms that are in compliance with AICPA quality-control requirements would be consistent with the requirements of the proposed standards.
SPECIALISTS AND CONTINUING EDUCATION REQUIREMENTS The basic continuing professional education (CPE) requirements under GAGAS have not changed from the 2007 Yellow Book. However, the proposed standard clarifies continuing education requirements for internal specialists such as actuaries. Auditors who work under GAGAS should complete a minimum of 24 hours of CPE every two years. Internal specialists who apply their specialized knowledge to the audit should complete 24 hours of CPE in their area of specialty. For example, an actuary may satisfy the educational requirement with 24 hours of CPE training in actuarial science. Consistent with the extant standards, external specialists are not required to follow the CPE requirements; however, auditors are required to consider whether external specialists are qualified to serve an engagement.
FINANCIAL AUDIT CHAPTER The combined financial audit chapter does not contain any new requirements. However, the revision did reduce redundancy and changed certain terminology. Consistent with the ASB Clarity Project, the term “field work” has been replaced with “performance.” The proposed standards will continue to use the term “field work” when discussing attest engagements until the AICPA revises its wording in the AICPA attestation standards.
In addition, requirements already included in the AICPA audit standards have been eliminated from the proposed standards. These include:
ATTESTATION ENGAGEMENTS The volume of calls to the Yellow Book technical assistance line prompted revisions to the chapter on attestation engagements. One area of confusion has been determining whether an engagement is a form of attest (examination, review, or agreed-upon procedure) or a performance audit. The chapter has been revised to more clearly delineate between the types of engagements. Additional guidance has been incorporated into the chapter to direct the reader to the proper service. In all cases, if the auditor provides attest services, he or she should review and follow all guidance provided by the AICPA on these services. The proposed standards provide supplemental requirements and guidance, while the AICPA audit standards provide the foundational requirements.
PERFORMANCE AUDITS The performance audit chapter has been updated but has not been substantially changed. One change clarifies fraud reporting requirements within performance audits to specify that reporting is required for occurrences that are significant within the context of the audit objectives.
PRACTITIONER IMPLEMENTATION AND ASSISTANCE As with any proposed standard, practitioners need to read carefully and understand the nature of the changes before attempting to apply them. The GAO offers technical assistance for questions related to government auditing standards. The AICPA offers guidance through its Governmental Audit Quality Center.
The comment deadline was Nov. 22, 2010. The Yellow Book Advisory Council and GAO are evaluating the comment letters and will make changes to the final draft as appropriate. Government Auditing Standards, 2010 Exposure Draft, can be downloaded at gao.gov/govaud/ybk01.htm.
AICPA Independence Rule 101 and the Yellow Book
by Lisa Snyder, CPA
The GAO independence proposal is substantially consistent with the independence requirements contained in the AICPA Code of Professional Conduct (AICPA Code) as well as the IESBA code. The GAO’s proposal, if adopted, would lead to greater harmonization of the accounting profession’s independence standards.
The GAO has recognized that a conceptual framework approach would provide a better means to address independence matters in today’s complex environment. With one exception, the GAO, AICPA and IFAC frameworks cover the same threats with minor differences in the name or description of the threats (for example, the GAO’s “bias threat” comprises both the AICPA’s “advocacy threat” and “adverse interest threat”). The GAO “structural threat” is unique in that it addresses the threat associated with an audit organization’s placement within a government entity.
There are some areas where the GAO proposal may be viewed as more restrictive than the AICPA rules. For example, the AICPA Code requires documentation of threats and safeguards in cases where threats to independence are not at an acceptable level and safeguards are applied to eliminate the threats or reduce them to an acceptable level. The GAO is proposing documentation in other circumstances as well, such as in areas of substantive discussion or analysis on independence. In addition, the proposal requires auditors to consider the impact that prohibited nonaudit services may have on independence in subsequent periods.
For example, auditors who design and implement a financial reporting system for a client may need to consider the (self-review) threat to independence in future periods including the possible safeguard of having another independent auditor perform an audit subsequent to the performance of the prohibited nonaudit services.
Another example where the GAO proposal is more restrictive involves the use of specialists on the audit. The GAO is proposing that auditors should assess the independence of specialists and apply any necessary safeguards in the same manner as they would for auditors contributing to the audit. Under the AICPA Code, external specialists are not required to be independent but, rather, the relevant auditing standards require that the auditor assess the objectivity and competence of any specialists used on the audit.
To assist members and other interested parties in analyzing the GAO independence proposal, the AICPA has prepared a comparison of the GAO proposal to relevant provisions of the AICPA and IESBA codes. The document is available at tinyurl.com/2fsztfu.
Lisa Snyder ([email protected]) is AICPA director–Professional Ethics Division. EXECUTIVE SUMMARY
particularly in a governmental public-sector environment.
James R. Dalkin ( [email protected]) is a director in the GAO’s Financial Management and Assurance Division.
To comment on this article or to suggest an idea for another article, contact Loanna Overcash, senior editor, at [email protected] or 919-402-4462.
AICPA RESOURCES
Publications
For more information or to place an order, go to cpa2biz.com or call the Institute at 888-777-7077.
On-Site Training
Go to aicpalearning.org to access courses. Click on “On-Site Training” then search by “Acronym Index.” If you need assistance, please contact a training representative at 800-634-6780 (option 1).
Archived GAQC Web event (open to the public) “What You Need to Know About the 2010 Yellow Book Exposure Draft—Member Web Event,” presented by both GAO staff and AICPA Ethics Division representatives, tinyurl.com/2vsygde
Independence Comparison Tool To assist members and other interested parties in analyzing the GAO independence proposal, the AICPA has prepared a comparison of the GAO proposal to relevant provisions of the AICPA and IESBA codes. The document is available at tinyurl.com/2fsztfu.
Governmental Audit Quality Center The Governmental Audit Quality Center (GAQC) is a firm membership center that helps member firms achieve the highest standards in Yellow Book, not-for-profit, HUD or government audits through targeted e-mail alerts, resources and teleconferences. Visit the GAQC at aicpa.org/GAQC. When was yellow book issued?In June 1972, the Comptroller General issued the original version of the Yellow Book, entitled Standards for Audits of Governmental Organizations, Programs, Activities & Functions.
WHO issued the yellow book?It was published at The Bodley Head Publishing House by Elkin Mathews and John Lane, and later by John Lane alone, and edited by the American Henry Harland. The periodical was priced at 5 shillings and lent its name to the "Yellow Nineties", referring to the decade of its operation.
In which year was the Yellow Book first issued a 1954 B 1972 C 1996 D 2011?Since 1972, GAO has produced and maintained Government Auditing Standards, also known as the Yellow Book.
What is a Yellowbook?The Yellow Book is used by auditors of government entities, entities that receive government awards, and other audit organizations performing Yellow Book audits. It outlines the requirements for audit reports, professional qualifications for auditors, and audit organization quality control.
|
