Clarifying the Clarity Standards: Group Audits

Clarifying the Clarity Standards: Group Audits A NASACT Training Webinar May 2, 2012 Randy Roberts, AZ Office of the Auditor General Jeff Markert, KPMG LLP

Special considerations for audits of group financial statements In a group audit, . . .

Key definitions Group financial statements Group management Group-wide controls Group audit Group auditor Group audit opinion • Group • Component

Key definitions – Group examples • Group – All the components whose financial information is included in the group financial statements • Group management – Management responsible for the preparation of the group F/S • Group-wide controls – Controls designed, implemented, and maintained by group management over group financial reporting

Key definitions • Group • Component Component management Component auditor Component materiality Significant component

Key definitions – Component examples • Component – An entity or activity for which group or component management prepares financial information that is required to be included in the group F/S • Component materiality – Materiality for a component determined by the group engagement team for purposes of the group audit • Significant component – Identified by the group engagement team i) of individual significance or ii) likely to include significant risks of material misstatement of the group F/S

Major sections of the standard

Why identifying components is so important

Understanding a component is Critical! A Entity A has its own operations; also owns entities B and C Separately operated in every way, shape, and form B C

Understanding a component is Critical! A Prepares consolidated F/S that include B and C B C

Understanding a component is Critical! A Entity A is a group Entities B and C are components B C

So what’s a component in government financial statements? • Component units (per GASB’s definition)? • Departments? • Funds? • Specific business activities or segments?

Helping us determine components

Other considerations for governments • Existence of components evaluated within individual opinion units • Each opinion usually its own group • Exception when there are other auditors or legally separate entities which would automatically be considered a component • For governments with multiple opinion units, components will commonly exist within: • Aggregate discretely presented component units • Individual component units whether audited by same audit firm or other auditors • Aggregate remaining fund information: • Pension or OPEB trust funds • Investment trust funds • Departments within a major fund that are separately managed may also be components Most governments with multiple opinion units will be a group audit

Basic group auditor responsibilities Other (additional) procedures required when not making reference

The top-down risk based approach Group engagement team must obtain sufficient understanding of the group, its components, and their environment to: • Identify and assess risks of material misstatements at the group level • Identify significant accounts and disclosures and related assertions at the group level • Confirm identification of significant components • Determine the timing and type of work to be performed at significant and non-significant components • Determine which work will be performed by the group and component auditor • Determine the nature, timing, and extent of work to be performed at the group level Overall Group Audit Strategy is Developed Using the Top-down Risk Based Approach

Special considerations when obtaining our understanding • Obtain an understanding of group, components and group-wide controls • Obtain an understanding of the consolidation process • Understanding sufficient to: • Confirm or revise initial identification of components likely to be significant • Assess RMM of group financial statements

Special considerations when obtaining our understanding • Obtain an understanding of the component auditor (whether or not the group auditor will make reference) • Whether a CA will comply with ethical requirements, especially independence • About the CA’s professional competence • The extent, if any, the GA will be able to be involved in the CA’s work • Whether the GA will be able to obtain information affecting the consolidation process • Whether a CA operates in a regulatory environment that oversees auditors

Here’s the pink elephant sitting in the room no one wants see: When a component auditor does not meet the independence requirements relevant to the group audit or the group auditor has serious concerns about the CA (the other matters listed in the previous slide), the group auditor should obtain sufficient appropriate audit evidence relating to the financial information of the component without making reference to the audit of that component auditor in the auditor’s report on the group financial statements or otherwise using the work of that component auditor.

So when can we make reference to the report of a component auditor? • Preconditions to making reference to others’ work • Component f/s prepared on same GAAP basis* • Component auditor followed GAAS • Component auditor report is not restricted as to use *exception for GASB, which addresses this

Materiality – From the group auditor’s perspective • The group auditor should determine: • Materiality, incl. performance materiality, for group financial statements • Whether specific circumstances exist for which something less than materiality would influence users; if so, apply a different materiality to those transactions, balances, or disclosures • Component materiality for components that group engagement team will audit or ask a component auditor to audit or review – component materiality s/b lower than group materiality and component performance materiality s/b lower than group performance materiality • Threshold above which misstatements are trivial

Materiality and Performance Materiality Audit procedures Planning and evaluation Materiality Performance materiality $ or % Component materiality Component performance materiality

Materiality and Performance Materiality Group Components If Group Auditor audits A and B: Will A’s component materiality and component performance materiality be the same as B’s? A B If Component Auditor audits A and Group Auditor audits B: Will A’s component materiality and component performance materiality be the same as B’s?

Materiality and Performance Materiality Group A Components B C How does the significance of the components affect materiality and performance materiality?

What makes a component significant? It’s “Big” Group A Components B C It has significant “RMM”

Group audit performance requirements

Auditing components • Adapt audit of the financial information of a significant component to meet specific needs of the group engagement team • Certain accounts may not be included in audit of component because they are performed at the group level • Shared service centers may be tested at the group level • If same audit team is performing audit of multiple components, there is flexibility in organizing workpapers: • Consider using one electronic file (set of workpapers) and keep audit work together, but clearly delineating substantive test work based on component materiality • Test group-wide controls Perform audit with effectiveness and efficiency !

Considerations related to non-significant components • Risk assessment analytical procedures are required to be performed on non-significant components • Consider the use of substantive audit procedures on aggregation of non-significant components that present reasonable possibility of misstatement to the group financial statements • Audit procedures performed at the group and significant component levels, do not reduce or eliminate the need to perform substantive procedures at non-significant components, if there is a reasonable possibility of misstatement to the group financial statements

Scoping Example – State (Aggregate Discretely Present Component Units) Group Materiality = $22,000 / Group Performance Materiality = $16,600

Testing group-wide controls and consolidation process Group auditor Component auditor

Subsequent events issues • Who is responsible for performing subsequent events procedures? • As GA, • Can the component auditor do it? • Do you have access to component? • Can group management give you the necessary information?

Communications with component auditors • Group auditor (GA) to component auditor (CA) • Will the CA to cooperate with the GA? • Here are the ethical requirements relevant to the GA • Here are related parties the GA is aware of; what other related parties is the CA aware of? • Here are the significant RMM at the group level that are relevant to the CA

Communications with component auditors • Group auditor (GA) asks component auditor (CA) to communicate back to GA • What matters did the CA identify that are relevant to the GA’s conclusions? • Did the CA comply with ethical requirements? • Exactly which component financial information did the CA report on? • What were the CA’s overall findings, conclusions, or opinions? Whether making reference or not!

Assuming responsibility for components Now let’s see what happens when other auditors audit components and we don’t make reference . . . Here are the additional requirements when “assuming responsibility” . . .

Additional group auditor requirements for “assuming responsibility” • Evaluate the appropriateness of performance materiality for component financial statement audits • Determine the nature, timing, and extent of involvement in the component auditor's work • Determine the type of work necessary at the component

Additional requirements for “assuming responsibility” • For individually significant components: • The GA or CA should perform an audit of the component f/s using component materiality • For significant RMM: • An audit (see above) • An audit of one or more account balances, class of transactions, or disclosures relating to the likely significant RMM at the group level • Specific audit procedures addressing the likely significant RMM at the group level

Additional requirements for “assuming responsibility” • Components that are not significant : • The GA should perform analytical procedures at the group level

Additional requirements for “assuming responsibility” • Components that are not significant : • When insufficient evidence for group audit opinion still exists: • Audit of one or more of these components • Audit of one or more accounts, class of transactions, etc. for one or more of these components • A review of component financial information • Specified audit procedures

Additional requirements for “assuming responsibility” • Significant components’ risk assessments: • GA should be involved in that risk assessment to identify significant RMM at group level, including: • Discussing with CA or CM business activities of significance to the group • Discussing with CA the susceptibility of the component to material misstatement • Reviewing the CA’s documentation of identified significant RMM

Additional requirements for “assuming responsibility” • We’re not done yet!! • GA should evaluate the appropriateness of the further audit procedures to be performed and whether to be involved in those procedures • GA requests the CA to notify them of subsequent events that affect group level

Additional requirements for “assuming responsibility” • We’re not done yet!! • GA should communicate to CA the items in slides 31 and 32 • Setting out the work to be performed and the form and content of the CA’s communication • Communications in addition to these items, additional communications such as . . .

Additional requirements for “assuming responsibility” • We’re not done yet!! • . . . Whether the CA complied with the GA • Instances of noncompliance with laws and regulations that could give rise to material misstatements • Significant RMM and responses to those risks • List of corrected and uncorrected misstatements • Indicators of management bias in estimates • Description of MW and SD at component level • Significant findings/issues for component governance, or other matters

Additional requirements for “assuming responsibility” • We’re not done yet!! • When evaluating CA’s communication and adequacy of work, • Whether to review other parts of the CA’s documentation • When CA work is insufficient, determine additional procedures for GA or CA

Additional requirements for “assuming responsibility” • We’re not done yet!! • GA should determine with MW and SD at component level are MW or SD at group level • GA should document nature, timing and extent of involvement, including the review of CA documents and conclusions

Finishing this one off—in all circumstances • Evaluate sufficiency of CA communications • Evaluate sufficiency of evidence for group financial statement opinions • Communicate with governance and management • Specifically document • Analysis of components and indication of significant ones • Components for which reference was made, incl. their F/S and CA reports • Communications with CA

A final “tease” Q. True or False: The procedures required for group audits in a financial statement audit apply to federal compliance (i.e., SAS 117 audit) procedures. A. ____

A final “tease” Q. True or False: The procedures required for group audits in a financial statement audit apply to federal compliance (i.e., SAS 117 audit) procedures. • ______________________________________ ___________________________________ True. This is still unsettled territory. What are the most likely places group audits applies? • Relying on other auditors who audit major programs • Auditing major programs when the administration of a major program has “components”

Questions?

Clarifying the Clarity Standards: Group Audits