Dear Center Members
GAQC Issues Internal Control Over Compliance & Compliance Practice Aids
The purpose of this Governmental Audit Quality Center (GAQC) Alert is to inform you about the issuance of several GAQC Practice Aids that are designed to assist our members in documenting the work performed relating to understanding and testing internal control over compliance and compliance (ICC) in single audit engagements. These Practice Aids have been developed by the GAQC in response to audit quality deficiencies cited in a federal study on single audit quality and were reviewed by both the AICPA's auditing standards team and several federal agencies involved in the single audit process prior to this issuance. After reading this GAQC Alert, you will understand:
The GAQC launched a series of task forces to address deficiencies that were noted in a federal study on the quality of audits performed under Office of Management and Budget (OMB) Circular A-133, Audits of States, Local Governments, and Non-Profit Organizations (Circular A-133)—also referred to as single audits. As we reported in GAQC Alert #52, the study results are detailed in a report titled, Report on National Single Audit Sampling Project (the PCIE report), that was issued by the President's Council on Integrity and Efficiency (PCIE).1 The report can be accessed in its entirety at http://www.ignet.gov/pande/audit/NatSamProjRptFINAL2.pdf. One of the AICPA task forces established in response to the PCIE report was the ICC Task Force (TF). The ICC TF charge was to: (1) review the deficiencies noted in federal study relating to testing and documentation of ICC issues; (2) review the PCIE report recommendations; and (3) determine appropriate responses.
ICC Deficiencies Noted in the PCIE Report. The following are among the ICC deficiencies cited in the PCIE report:
- Audit documentation did not contain adequate evidence of the auditor's understanding of the five elements of internal control and testing of internal controls for many or all applicable compliance requirements.
- Audit documentation did not contain evidence of internal control testing and/or compliance testing for more than a few compliance requirements, or did not explain why they were not applicable for the auditee.
ICC-Related PCIE Report Recommendations. The PCIE report included a number of recommendations, including several specifically directed at the AICPA to enhance existing guidance or develop new guidance. Among the ICC-related recommendations, the PCIE report recommended that the AICPA better describe the minimum audit documentation required to document the auditor's understanding of, and testing of, internal controls related to compliance by developing examples of such documentation. It also recommended that the AICPA clearly explain how the Part 2 Matrix in the OMB Compliance Supplement be used to identify compliance requirements for testing and the related auditor documentation associated with this process.
ICC TF Actions
. The first step the ICC TF took was to update the AICPA Audit Guide, Government Auditing Standards and Circular A-133 Audits (Guide)
, to more clearly describe the auditor's responsibilities relating to ICC issues. Those updates occurred in the 2008 revision to the Guide. Members should consider reviewing Chapter 9, Consideration of Internal Control Over Compliance for Major Programs,
and Chapter 10, Compliance Auditing Applicable to Major Programs,
of the Guide to ensure an appropriate understanding of ICC responsibilities. The ICC TF then worked to develop illustrative ICC Practice Aids to clarify the procedures to be performed by the auditor and the related documentation for both internal control over compliance and compliance.
1 Note that in 2008 the name of the President's Council on Integrity and Efficiency was changed to Council of the Inspectors General on Integrity and Efficiency
Back to top
ICC Practice Aids
The ICC TF developed three IC Auditor Practice Aids, listed below, to assist the auditor in understanding the procedures to be performed and the related auditor documentation in a single audit when gaining an understanding of internal control over compliance and testing compliance and internal control over compliance. Each Practice Aid is available individually for free to GAQC members in the relevant Word or Excel formats (using the links below) or in one single electronic PDF publication for a nominal fee (see paragraph below for details and instructions). As noted above, auditors should refer to Chapters 9 and 10 of the Guide for a more detailed description of the various auditor requirements in these areas.
These Practice Aids are considered an other auditing publication which have no authoritative status and their use is not required. However, the Practice Aids may help you understand and apply certain auditing standards. Further, the GAQC believes that audit quality will be enhanced by their use. Auditors that already have their own internal ICC documentation templates or guidance and do not wish to use the GAQC Practice Aids are encouraged to compare them to their internal firm guidance to identify areas that are incomplete or may need to be enhanced. Finally, these Practice Aids do not contemplate any additional requirements relating to the American Recovery and Reinvestment Act of 2009 (Recovery Act). Watch the GAQC Recovery Act Resource Center on the GAQC Web site for further updates, illustrations, and tools relating to the Recovery Act.
Major Program Risk Matrix. This Practice Aid provides auditors with a template to illustrate how they might document which of the 14 types of compliance requirements ultimately will be subject to audit for each major program. The template includes an assessment of the applicability of each requirement and whether each requirement also is direct and material to the program. The template also provides the auditor an opportunity to consolidate in one place the assessments of the various risks associated with each type of compliance requirement and references to audit documentation where the risk assessments are supported and testwork is performed. GAQC members can click here to access the Excel version of the matrix. Alternatively, see the paragraph below for instructions on how to purchase all of the Practice Aids in a downloadable PDF format.
Controls Overview Documents (Narrative and Checklist Options). Two different versions of this Practice Aid were developed to illustrate how an auditor might document the audit work associated with internal control over compliance for the types of compliance requirements selected for testing for each major program. Because audit documentation styles vary widely, both a narrative template and a checklist template were developed for the auditor to choose from. GAQC members can click here to access both the Word version of the narrative document and the Excel version of the checklist document. Alternatively, see the paragraph below for instructions on how to purchase all of the Practice Aids in a downloadable PDF format.
- Dual Purpose Testwork. This Practice Aid illustrates how an auditor might document the use of one sample to test both internal control over compliance and compliance. GAQC members can click here to access the Excel version of the dual-purpose testwork illustration. Alternatively, see the paragraph below for instructions on how to purchase all of the Practice Aids in a downloadable PDF format.
Back to top
|PDF Version of Practice Aids Designed for Auditor Documentation Input Also Available to GAQC and non-GAQC Members. Because of the comprehensive nature of the above Practice Aids and to provide more flexibility with how they are used, the GAQC has also published them in a single electronic downloadable publication titled, Documenting and Testing Compliance and Internal Control Over Compliance in a Single Audit (product no. 006662PDF) that is available at CPA2BIZ for a nominal fee (i.e., $39.99 for AICPA members) to both GAQC and non-GAQC members. This electronic document includes each Practice Aid in a PDF format that auditors can use to input their auditor documentation. To order Documenting and Testing Compliance and Internal Control Over Compliance in a Single Audit, click here.
In addition to the Practice Aids described above, the following are ICC resources and tips that we want to ensure members are aware of. GAQC members and their staff should:
Be familiar with the internal control over compliance and compliance related provisions of Circular A-133.
Review the PCIE report to be reminded of the various single audit deficiencies noted, including those relating to ICC.
Review Chapters 9 and 10 of the Guide in their entirety for a description of the various auditor requirements relating to testing and documenting internal control over compliance and compliance procedures.
Listen to an archived member event titled, Internal Control Considerations in Single Audits, as available on the GAQC Web site by clicking here. This event discusses the Circular A-133 requirement that the auditor gain an understanding of internal control over compliance and test internal control over compliance to support a low assessed level of control risk. It also highlights many common deficiencies noted in testing internal control over compliance such as audit documentation not containing adequate evidence of the auditor's understanding of the five elements of internal control and testing of internal controls for many or all applicable compliance requirements. The presenter for this event provides information to help auditors overcome or avoid deficiencies and also discusses the Practice Aids developed by the ICC TF. To access this archived conference member event, click here.
Listen to an archived member event titled, The New Compliance Auditing SAS and an Update on Other AICPA Auditing Standards, as available on the GAQC Web site by clicking here. This event discusses when the new SAS (SAS No. 117, Compliance Audits) applies and what it requires and will help provide perspective on how compliance audits might change under the new SAS. To access this archived conference member event, click here.
Encourage clients to listen to an archived GAQC event titled, Preparing for Your Single Audit: An Auditee Perspective, which is primarily intended to help auditees better understand the requirements of Circular A-133, the various responsibilities placed on auditees, and tips for preparing for a single audit. Among the many topics covered, this event discusses the compliance requirements and provides an overview of the auditee's responsibility for both compliance and internal control over compliance for its federal programs. To access this archived event which has been left open to the public, click here.
Status of Other GAQC Single Audit Quality Efforts
The task forces established to respond to other single audit deficiencies have been busy and are nearing completion of their projects and related audit guidance as well. The following is intended to provide you with a quick status update on their work. The GAQC will notify you as future developments relating to each of the following areas occur.
New Compliance Auditing Standard. The TF established to reexamine Statement on Auditing Standards (SAS) No. 74, Compliance Auditing Considerations in Audits of Governmental Entities and Recipients of Governmental Financial Assistance (AICPA, Professional Standards, vol. 1, AU sec. 801), in light of the deficiencies cited in the PCIE report has developed a new standard that supersedes SAS No. 74. SAS No. 117, Compliance Audits, was issued December 2009 and is now effective for compliance audits (effective for fiscal periods ending on or after June 15, 2010). Note that the 2010 edition of the Guide has been updated to reflect the requirements of SAS No. 117 and is currently available to those with a subscription for electronic access and will be available in hard copy September 7. Click here to obtain a copy of SAS No. 117. Please note that the GAQC has an archived member event titled, The New Compliance Auditing SAS and an Update on Other AICPA Auditing Standards discussed in the ICC Resources section above which discusses how compliance audits might be impacted by this SAS.
Schedule of Expenditures of Federal Awards (SEFA). As we communicated in GAQC Alert # 126, the TF working in this area released two Practice Aids directed at auditors (audit program and disclosure checklist) and two Practice Aids directed at auditees (worksheet for identifying federal program information and disclosure checklist). These Practice Aids are available on the GAQC Web site. The SEFA TF also updated chapter 7, Schedule of Expenditures of Federal Awards, of the Guide to further clarify the various auditor and auditee responsibilities relating to the SEFA. Please note that the GAQC has an archived member event titled, The New GAQC Schedule of Expenditures of Federal Awards Practice Aids and Other Related Issues which is available by clicking here. This event provides information on how to use the GAQC SEFA Practice Aids, as well as additional new reporting responsibilities associated with the Recovery Act.
Sampling in a Single Audit Environment. As we communicated in GAQC Alert # 135, the TF working in this area developed a new chapter that was added to the 2009 version of the Guide. The chapter is comprehensive and covers the specific nuances of sampling in a single audit. It also includes sample size tables. The guidance in the chapter was effective upon issuance. The GAQC hosted a Web event titled, AICPA's New Guidance on Sampling in a Single Audit Environment, which is available by clicking here. This call is as an additional resource to assist members in understanding the guidance.
Findings. The TF working on findings has been on hold due to other pressing initiatives relating to the Recovery Act. It is soon expected to restart its efforts to develop illustrative Practice Aids to assist auditors in developing and documenting finding write-ups. We will inform you in future GAQC Alerts as this project moves ahead.
Peer Review. The TF working in this area is working to establish consistent measures of single audit deficiencies and to develop guidance and training for peer reviewers. Among its recent efforts, the TF has issued Interpretation 63-1a relating to the required selection of a single audit engagement in peer reviews and has made revisions to the peer review checklist, Supplemental Checklist for Review of Single Audit/A-133 Engagements, including breaking the document down into two parts, to facilitate the peer review process over these engagements.
As noted earlier, the GAQC will keep you informed as future developments in these areas occur.
* * * * *
AICPA Governmental Audit Quality Center
Back to top
GAQC members may only reproduce and distribute GAQC e-alerts internally within the firm or State Audit Organization to other Center member personnel as part of the organization's professional services. For information about permission to copy any part of these documents for redistribution or inclusion in other work, please click on the copyright notice
at the bottom of the page or phone the AICPA copyright permission hotline 919-402-4031
©2010 The American Institute of Certified Public Accountants.
AICPA Online privacy policies and copyright information.
AICPA, 1211 Avenue of the Americas, New York, NY 10036
Back to top