Auditing Standards Update

1. Auditing Standards Update Mike Glynn, CPA Technical Manager AICPA Audit and Attest Standards Team April 24, 2009 mglynn@aicpa.org

2. Session Objectives • Discuss the recent activities of the ASB • Clarity project • SAS No. 115, Communicating Internal Control Related Matters Identified in an Audit • SAS No. 116, Interim Financial Information • SQCS No. 7, A Firm’s System of Quality Control

3. Session Objectives • Proposed SASs: • Compliance Audits • Required Supplementary Information • Other Information in Documents Containing Audited Financial Statements • Other Information in Relation to the Financial Statements as a Whole

4. Session Objectives • Discuss the recent activities of the Accounting and Review Services Committee. • Current status of the ARSC’s Reliability Project

5. Session Objectives (Continued) • Interpretation No. 31, Preparation of Financial Statements for Use by an Entity’s Auditors • Technical Practice Aid (TIS 9150.25), Determining Whether Financial Statements Have Been Prepared by the Accountant

6. Recent Activities of the Auditing Standards Board

7. Recent Auditing Standards Board Activities Clarity Project 7

8. Clarity Background Discussion paper issued March 2007 ASB considered comments received and approved direction forward August 2007 Goals: Address concerns over length and complexity of standards Make standards easier to read, understand and implement Will lead to enhancements in audit quality 8

9. Clarity Drafting Conventions Introduction Objective Definitions Terms used in the SAS are defined Establish separate glossary of terms Requirements and Application Material 9

10. Other Special considerations sections for governmental entities for smaller, less complex entities Convergence with ISAs Removal of unnecessary differences 10

11. Audit and Attest UpdateClarity Project During this period, few new standards will be issued Only those that are needed to respond to emerging issues “Clarified standards” will be exposed over the next year or so and finalized Target date for final approval June 2010 11

12. Audit and Attest UpdateClarity Project Once finalized, they’ll be made available to practitioners. However, the standards will not become effective piecemeal. With limited exceptions, all “clarified standards” will become effective at the same time Most likely 2011 12

13. Recently Issued Standards Statement on Auditing Standards No. 115, Communicating Internal Control Related Matters Identified in an Audit

14. SAS 115 • Effective for periods ending after 12/15/09 • Early adoption is allowed • Supersedes SAS 112 of the same title

15. SAS 115 • Why revised? – • To eliminate differences resulting from the issuance of SSAE No. 15, An Examination of an Entity’s Internal Control Over Financial Reporting That is Integrated With an Audit of Financial Statements • SSAE 15 conform definitions of control deficiency, material weakness and significant deficiency to AS 5 • Provide for more professional judgment • Not intended to reduce quality of communication

16. Control Deficiency • A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct misstatements on a timely basis.

17. Material Weakness • A material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented or detected on a timely basis. • Reasonable possibility = the likelihood of the event is either "reasonably possible" or "probable," as those terms are used in SFAS No. 5, Accounting for Contingencies

18. The Significant Deficiency • A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.

19. Deficiencies • As with SAS 112, nothing is an automatic material weakness or significant deficiency • Preparation of financial statements • Professional judgment must be applied

20. Deficiencies • Revises the list of deficiencies in internal control that are indicators of a material weaknesses to consist of: • Identification of fraud, whether or not material, on the part of senior management • Restatement of previously issued financial statements to reflect the correction of a material misstatement due to fraud or error

21. Deficiencies • Identification by the auditor of a material misstatement of the financial statements under audit in circumstances that indicate that the misstatement would not have been detected by the entity’s internal control; and • Ineffective oversight of the entity’s financial reporting and internal control by those charged with governance

22. Deficiencies • SAS 115 does not include the list of deficiencies that ordinarily would be considered at least significant deficiencies

23. Communication • Needs to be writing • SAS 115 contains a revised illustrative written communication to management and those charged with governance of material weaknesses and significant deficiencies • Prior year comments can be communicated by reference to the prior year letter • Best made by report release date but needs to be made by 60 days from release date

24. Impact on yellow book and single audits • GAO has issued Interim Guidance on Reporting Deficiencies in Internal Control for GAGAS Financial Audits and Attestation Engagements (November 2008) • http://www.gao.gov/govaud/icguidance0811.pdf

25. Impact on yellow book and single audits • Auditors may satisfy the internal control reporting requirements in GAGAS paragraph 5.11 by: • Including in the report on internal control all identified material weaknesses and significant deficiencies using the SAS 115 definitions • Providing those definitions • Describing the scope of testing performed on the entity’s internal control over financial reporting

26. Impact on yellow book and single audits • Auditors must comply with all other relevant GAGAS requirements related to reporting deficiencies in internal control • Developing findings and providing recommendations for corrective action if findings are sufficiently developed (GAGAS paragraphs 5.21 and 6.42) • Obtaining views of responsible officials (GAGAS paragraphs 5.32 – 5.38 and 6.44-6.50). • Ensuring appropriate report distribution (GAGAS paragraphs 5.44 and 6.56).

27. Recently Issued Standards Statement on Auditing Standards No. 116, Interim Financial Information 27

28. SAS 116 • Effective for reviews of interim financial information for interim periods beginning after December 15, 2009. Early application is permitted • Supercedes SAS 100

29. SAS 116 • Amends SAS 100/AU 722 to accommodate reviews of interim financial information of nonissuers. • Would apply when the interim financial information is intended to provide a periodic update of year end reporting

30. SAS 116 • Applies when: • The entity’s latest annual financial statements have been audited by the accountant or a predecessor; • The accountant has been engaged to audit the entity’s current year financial statements, or the accountant audited the entity’s latest annual financial statements and expects to be engaged to audit the current year financial statements

31. SAS 116 • The client prepares its interim financial information in accordance with the same financial reporting framework as that used to prepare the annual financial statements • If any of the following are not met, the review should be performed in accordance with SSARSs.

32. SAS 116 • If the interim financial information is condensed all of the following are met: • The condensed interim financial statements purports to conform with an appropriate financial reporting framework • The condensed interim financial information includes a note that the financial information does not represent complete financial statements and should be read in conjunction with the entity’s latest annual audited financial statements

33. SAS 116 • The condensed interim financial information accompanies the entity’s latest audited financial statements or such audited annual financial statements are made readily available by the entity. • Readily available = a third party can obtain the financial statements without any further action by the entity. • F/S on the web may be readily available • “Available upon request” are not readily available

34. Audit and Attest Standards Update Statement Quality Control Standard 7, A Firm’s System of Quality Control

35. SQCS No. 7 • Issued October 2007 • Effective as of January 1, 2009 • Supersedes all previous SQCSs

36. SQCS No. 7 The firm must establish a system of quality control designed to provide it with reasonable assurance that: • The firm and its personnel comply with professional standards and applicable regulatory and legal requirements, and • Reports issued are appropriate in the circumstances

37. SQCS No. 7 Documentation and Communication Required to document QC policies and procedures. Extent based on firm characteristics Required to communicate QC policies and procedures to personnel. More effective if in writing, but not required to be. 37

38. Required Elements of QC System Leadership responsibilities for quality within the firm (the “tone at the top”) Relevant ethical requirements Acceptance and continuance of client relationships and specific engagements Human resources Engagement performance Monitoring 38

39. Tone at the Top Objective – Promote a quality-oriented internal culture Requires firms to assign its management responsibilities so that commercial considerations do not override the quality of work performed. Address personnel performance evaluation, compensation and advancement to demonstrate the firm’s overarching commitment to quality. 39

40. Relevant Ethical Requirements Objective - reasonable assurance that the firm and its personnel comply with relevant ethical requirements. Independence – more specific guidance Communicate independence requirements to personnel Identify and evaluate threats Annually obtain written confirmation from all personnel required to be independent 40

41. Acceptance and Continuance Objective - Firm should undertake or continue relationships and engagements only where it: Has considered the integrity of the client and the risks associated with providing professional services in the particular circumstances. Is competent to perform the engagement and has the capabilities and resources to do so. Can comply with legal and ethical requirements. Has reached an understanding with the client regarding the services to be performed. 41

42. Human Resources Objective – reasonable assurance of sufficient personnel with the necessary capabilities, competence and commitment to ethical principles 42

43. Engagement Performance Objectives - engagements are consistently performed in accordance with professional standards and regulatory and legal requirements, and the firm or the engagement partner issues reports that are appropriate in the circumstances. 43

44. Engagement Quality Control Review (EQCR) Establish firm criteria for determining whether an engagement quality control review should be performed, Evaluate all engagements against the criteria Perform an engagement quality control review for all engagements that meet the firm’s criteria, and complete the review before the report is released. Establish procedures addressing the nature, timing, extent and documentation of the engagement quality control review. 44

45. Monitoring Objective – reasonable assurance that QC policies and procedures are Relevant Adequate Operating effectively Complied with in practice 45

46. Monitoring - Requirements Ongoing evaluation of appropriateness of design and operating effectiveness Assign responsibility for the monitoring process to a partner. Assign performance of the monitoring process to competent individuals. Perform sufficiently comprehensive procedures. 46

47. Monitoring Monitoring procedures may be accomplished through the performance of: Engagement quality control review Post-issuance review of engagement working papers, reports, and clients’ financial statements for selected engagements Inspection procedures 47

48. Monitoring - Communication To engagement partners and others: • Deficiencies noted as a result of the monitoring process • Recommendations for appropriate remedial action. To all relevant personnel: • Monitoring results at least annually. 48

49. Monitoring Procedures to deal appropriately with complaints and allegations Clear channels for personnel to raise concerns without fear of reprisal Documentation of complaints and responses 49

50. SQCS No. 7 - Practice Aid AICPA Audit and Accounting Practice Aid Series, Establishing and Maintaining a System of Quality Control for a CPA Firm’s Accounting and Auditing Practice Product No. 006636