Advancing the Audit Documentation Standard

Auditors must leave a clear record in private company audits.

by Ray Whittington, Lynford Graham, Gretchen Fischbach and John Ahern

EXECUTIVE SUMMARY

SAS no. 103 establishes standards and provides guidance for auditors to follow when documenting their work during audits of private companies. It is effective for audits of financial statements of such companies for periods ending on or after December 15, 2006. The terms must, should and may as described in SAS no. 102, Defining Professional Requirements in Statements on Auditing Standards, are used in SAS no. 103. Documentation should be sufficiently detailed to give experienced auditors who were not previously involved in the audit a clear understanding of the work performed, the evidence obtained and the conclusions reached. The new standard says what should be documented and the characteristics of workpapers that should be retained. Oral explanations are not sufficient to document auditors’ work or conclusions, but auditors may use them to clarify or explain information in the documentation. Auditors should document audit evidence that contradicts or is inconsistent with audit conclusions regarding significant findings or issues and also explain how they addressed the contradiction in forming the conclusion. Auditors should assemble audit documentation within 60 days from the audit report date. Subsequent deletions from the documentation are prohibited, and any additions should be documented in keeping with the standard. Audit documentation should be retained until at least five years after the report release date. Ray Whittington, CPA, PhD, is director of the School of Accountancy and Management Information Systems at DePaul University; his e-mail address is rwhittin@depaul.edu. Lynford Graham, CPA, PhD, CFE, is a consultant, recent former member of the Auditing Standards Board and chair of the SAS no. 103 Task Force; his e-mail address is lgrahamcpa@verizon.net. Gretchen Fischbach, CPA, is a manager in the forensic & dispute services practice of Deloitte Financial Advisory Services LLP and a former technical manager on the AICPA audit and attest standards team. Her e-mail address is gfischbach@deloitte.com. The views in this article are hers and those of her coauthors and do not necessarily represent the views of Deloitte Financial Advisory Services LLP. John Ahern, CPA, is associate professor of accounting at DePaul University; his e-mail address is jahern@depaul.edu.

hanges in the audit environment have recently led the Auditing Standards Board (ASB) to significantly revise guidance it had issued less than four years earlier. In January 2002, Statement on Auditing Standards (SAS) no. 96, Audit Documentation, made the most significant changes to audit workpaper guidance in more than three decades. But soon, major frauds and business failures focused attention on audit documentation. So in December 2005 the ASB tightened the requirements governing documentation by issuing SAS no. 103 (see Official Releases, JofA, Mar.06), which bears the same title as its predecessor.

The new guidance requires that engagement workpapers be sufficiently detailed to provide an experienced auditor a clear understanding of the procedures performed, the evidence obtained and the significant conclusions reached during audits of private companies. It is effective for audits of financial statements of private companies for periods ending on or after December 15, 2006. This article discusses crucial changes that the standard introduces and explains how they will affect auditing practice.

THE ROAD TO NEW GUIDANCE
WWhen Enron collapsed and documents were destroyed, the profession, standard setters, regulators and state boards of accountancy became focused on audit documentation requirements and the issue of workpaper retention. In 2002 the Sarbanes-Oxley Act was passed, and it included provisions for increased audit documentation guidance for audits of public companies. Several state boards of accountancy adopted or proposed documentation regulations for all audits within their jurisdictions. Divergent rules started to emerge from the SEC, the state boards, the Government Accountability Office (GAO), the International Federation of Accountants (IFAC) and the Public Company Accounting Oversight Board (PCAOB). So the ASB set out to make its guidance not only more consistent with that of other standard setters, but also more responsive to the needs of U.S. auditors of nonpublic companies and the private company regulators overseeing their activities.

WHAT’S NEW?
SAS no. 103 amends several of SAS no. 96’s provisions (see “How SAS No. 96 and SAS No. 103 Differ,” and “The New Audit Documentation Requirements,” JofA, Apr.02, page 53). Specifically, the new SAS

Revises SAS no. 96’s guidance by requiring that audit documentation be sufficient for an experienced auditor to understand—among other things—the nature, timing, extent and results of auditing procedures the engagement auditors performed, the audit evidence they obtained and the conclusions they reached on significant matters.

Clarifies that auditors cannot use oral explanations alone to support their work or conclusions.

Provides new guidance for determining the date of the auditor’s report.

Establishes a time limit of 60 days for assembling the audit documentation.

Establishes a minimum period for retaining the audit documentation.

Two of these topics relate to the actual documentation process and merit particular emphasis.

The experienced auditor. SAS no. 96 required auditors to prepare audit documentation with the needs of other members of the engagement team in mind. But SAS no. 103 specifies they should document their work in such a way that it is understandable to experienced auditors not previously involved in the audit. The standard defines an experienced auditor as one who “possesses competencies and skills that would have enabled him or her to perform the audit.” SAS no. 103 also identifies areas in which such an auditor is proficient, including audit processes, applicable auditing, legal and regulatory requirements, the entity’s business environment and relevant industry auditing and reporting issues. Audit documentation need not be understandable to individuals with only a basic knowledge of auditing.

Oral explanations. For more than 30 years, standards have permitted auditors to support their audit reports by means other than documentation, but did not specify these means. Some auditors may have thought this allowed them to support major aspects of their audit report with oral explanations instead of documentation, but we do not believe this was the standards’ intent.

While developing SAS no. 96, the ASB decided to retain its earlier guidance from SAS no. 41, Working Papers, on this topic, as audit effectiveness would not necessarily be improved by documenting all information considered during an audit engagement, especially on matters that did not seem significant at the time.

However, concerns persisted that auditors might rely excessively on oral explanations to support major aspects of their work. So in SAS no. 103 the ASB clarified that oral explanations do not, by themselves, provide sufficient support for the auditor’s work, though auditors may use them to further explain or clarify information that is contained in the workpapers.

Tips for Auditors As a preparer of audit documentation, step back and read your work objectively. Would it be clear to another auditor? After preparers, reviewers are best qualified to ensure documentation is clear. As a reviewer of documentation, if you have to ask the audit staff basic questions about the audit, the documentation probably does not contain the detail contemplated in SAS no. 103. The workpapers should contain all information and linkages that are necessary to ensure that all required procedures were performed, evidence was obtained and conclusions were reached by the auditors. Oral explanations may be used only to clarify or explain the documentation. Document the audit clearly the first time to minimize the effort necessary to put the files in order before the documentation completion date—that is, within 60 days of your delivering the audit report to the client. Continually update documentation during the audit, and discard superseded memos and files as the audit progresses, rather than at its conclusion. Carefully determine whether more stringent state laws or other documentation requirements apply to your firm or certain of its audits. Control your responsibility for subsequent events procedures by completing the audit on a timely basis. Ensure staffing and review time is scheduled in time to meet the 60-day final file assembly deadline. As an auditor, assess how SAS no. 103 requires you to change your current documentation approach and policies. Because it may be difficult to perform an objective self-assessment, you may want to consider engaging an objective third party to make specific recommendations. Keep your workpapers safe and retrievable. Consider the standard’s requirement that auditors be able to retrieve files five or more years old. Determine which of your current software programs will run in future environments, and plan to purchase new software or retain old software and hardware as necessary. Determine whether you really need a permanent file. Reconsider its content and ensure that workpapers integral to the annual audit are filed in the annual audit file.

AFTER THE AUDIT WORK IS FINISHED
SAS no. 103 includes expanded and more specific documentation guidance for the period following the date on which the auditor completes the audit fieldwork.

Report date. Until now (see SAS no. 1, AU section 530, “Dating of the Auditor’s Report”) auditors generally dated the audit report as of the day they completed their fieldwork. But under SAS no. 103 auditors should not date the audit report until they have sufficient, appropriate evidence to support the opinion. At that point audit documentation should have been reviewed, financial statements should have been prepared and management should have asserted its responsibility for them. In some cases, the report date will still coincide with the date fieldwork is completed. But in many others, the extent of remaining work auditors may have to perform will cause the auditor to use a date after the fieldwork completion date.

If the report is dated later than before, this increases the period that is subject to the auditor’s subsequent events work. For example, management’s representation letter and inquiries regarding subsequent events need to be updated to the date of the audit report.

Documentation completion date. This is the date by which SAS no. 103 requires auditors to assemble the final audit file, a process that should be completed within 60 days of delivering the audit report to the client. Before the documentation completion date, auditors can add information and replace, delete or discard superseded audit documentation. After that date, they can continue to add workpapers and explanations, but the SAS specifically prohibits deleting or discarding workpapers after the documentation completion date. Other standard setters, such as the GAO and the state boards, supported the ASB’s establishment of these documentation requirements.

Retention period. Because of the Sarbanes-Oxley Act of 2002 and the subsequent changes to various state board rules, there now is more consistency in document retention periods among the various statutes, regulations and standards applicable to audits. This new consistency in the states’ requirements made it feasible for the ASB to stipulate in SAS no. 103 that auditors should retain audit documentation for a specific period—at least five years—after the report release date.

WHAT FIRMS SHOULD DO
Some auditors already document their work and complete and retain their audit documentation in a manner consistent with SAS no. 103’s requirements. Those who do not, however, will have to implement change to ensure their firms comply. Two new requirements have raised the threshold for the adequacy of audit documentation: that workpapers should be understandable to experienced auditors having no connection to the audit and that oral explanations may be used only to explain or clarify written documentation. An advantage that results from these requirements is that the documentation will enable firms’ senior staff to review workpapers more effectively and give new auditors a better understanding of their firms’ clients and related issues.

Because of the requirement to finalize the documentation file within 60 days, a best practice is for auditors to continually update documentation during the audit and discard superseded memos and files as the audit progresses, rather than only at its conclusion, where mistakes can cause confusion and an unclear record. Auditors also should determine whether states or regulators impose other, more stringent requirements than those in SAS no. 103. When establishing documentation retention policies for their firms, auditors should be mindful of all such requirements potentially applicable to their practices or to individual audits they perform. As an example, New York State requires auditors to finalize a copy of their documentation within 45 days of delivering the report to the client rather than within 60 days, as permitted in SAS no. 103. If a state or regulator specifies a retention period exceeding SAS no. 103’s five-year requirement, the auditor should retain the workpapers for the longer period.

The new provisions will strengthen the audit documentation process, and likely may require more documentation. But if implemented properly, they could result in more understandable documentation and enable firms to budget and bill for engagements more accurately and promptly, since engagements will be concluded on a more timely basis.

MANAGING PERMANENT FILES
It’s important for all private companies to have a clear and effective strategy for archiving permanent files containing schedules, documents and charts carried forward from one audit to the next. SAS no. 103, Public Company Accounting Oversight Board (PCAOB) Auditing Standard (AS) 3, Audit Documentation, and the International Federation of Accountants’ International Standard on Auditing (ISA) 230 (revised), Audit Documentation, do not directly address this issue, but certain best practices are emerging. For example, we suggest retaining a copy of the permanent files along with the annual workpapers because it creates a clear record of the audit documentation as of the date the audit was performed. While it is easier to do this with electronic files, it is equally important when the files are in paper format.

Because some schedules and documents—for example, analytical comparisons and ratios—may be located in permanent files, auditors should review permanent file contents each year to determine whether any of them should be in the annual audit file as a schedule or workpaper. A smaller permanent file is easier to update and archive with the annual audit workpapers. In some cases, such an evaluation has led to the conclusion that keeping a separate permanent file is unnecessary.

LOOKING AHEAD
The ASB’s issuance of SAS no. 103 advances audit documentation guidance for U.S. auditors of private companies. Because they take into account recent events and the discussions and requirements of other standard-setting bodies, these new provisions may have a long life. But other issues may arise in a future environment, creating a need for revising the guidance. Auditors should stay abreast of any such changes.