Gagas 2018
Gagas 2018
By the Comptroller General of the
United States
July 2018
GOVERNMENT
AUDITING
STANDARDS
2018 Revision
Accessible Version
GAO-18-568G
Contents
Letter 1
Chapter 1: Foundation and Principles for the Use and Application of Government Auditing Standards 3
Introduction 3
Types of GAGAS Users 6
Types of GAGAS Engagements 7
Financial Audits 8
Attestation Engagements and Reviews of Financial Statements 9
Performance Audits 11
Terms Used in GAGAS 15
The GAGAS Format 17
Chapter 7: Standards for Attestation Engagements and Reviews of Financial Statements 129
Examination Engagements 130
Compliance with Standards 130
Licensing and Certification 131
Auditor Communication 131
Results of Previous Engagements 132
Investigations or Legal Proceedings 133
Noncompliance with Provisions of Laws, Regulations, Contracts,
and Grant Agreements 133
Findings 134
Examination Engagement Documentation 137
Availability of Individuals and Documentation 138
Reporting the Auditors’ Compliance with GAGAS 138
Reporting Deficiencies in Internal Control 139
Reporting on Noncompliance with Provisions of Laws,
Regulations, Contracts, and Grant Agreements or Instances of
Fraud 140
Presenting Findings in the Report 141
Reporting Findings Directly to Parties outside the Audited Entity 141
Obtaining and Reporting the Views of Responsible Officials 142
Reporting Confidential or Sensitive Information 144
Distributing Reports 145
Review Engagements 146
Compliance with Standards 146
Licensing and Certification 146
Noncompliance with Provisions of Laws, Regulations, Contracts,
and Grant Agreements 147
Reporting Auditors’ Compliance with GAGAS 147
Distributing Reports 148
Agreed-Upon Procedures Engagements 148
Compliance with Standards 148
Licensing and Certification 149
Noncompliance with Provisions of Laws, Regulations, Contracts,
and Grant Agreements 149
Reporting Auditors’ Compliance with GAGAS 149
Distributing Reports 150
Reviews of Financial Statements 151
Compliance with Standards 151
Licensing and Certification 151
Glossary 212
Acknowledgments 223
Comptroller General’s Advisory Council on Government Auditing
Standards (2016-2020) 223
GAO Project Team 224
Staff Acknowledgments 224
Figures
Figure 1: Generally Accepted Government Auditing Standards
Conceptual Framework for Independence 60
Figure 2: Independence Considerations for Preparing Accounting
Records and Financial Statements 63
Figure 3: Developing Peer Review Communications for Observed
Matters in Accordance with Generally Accepted
Government Auditing Standards 109
Figure 4: Consideration of Internal Control in a Generally
Accepted Government Auditing Standards Performance
Audit 193
Abbreviations
AICPA American Institute of Certified Public Accountants
AR-C AICPA Codification of Statements on Standards for
Accounting and Review Services
AT-C AICPA Codification of Statements on Standards for Attestation
Engagements
AU-C AICPA Codification of Statements on Auditing Standards
Letter
Audits provide essential accountability and transparency over government
programs. Given the current challenges facing governments and their
programs, the oversight provided through auditing is more critical than
ever. Government auditing provides the objective analysis and
information needed to make the decisions necessary to help create a
better future. The professional standards presented in this 2018 revision
of Government Auditing Standards (known as the Yellow Book) provide a
framework for performing high-quality audit work with competence,
integrity, objectivity, and independence to provide accountability and to
help improve government operations and services. These standards,
commonly referred to as generally accepted government auditing
standards (GAGAS), provide the foundation for government auditors to
lead by example in the areas of independence, transparency,
accountability, and quality through the audit process.
This revision contains major changes from, and supersedes, the 2011
revision. These changes, summarized below, reinforce the principles of
transparency and accountability and strengthen the framework for high-
quality government audits.
I extend special thanks to the members of the Advisory Council for their
extensive input and feedback throughout the process of developing and
finalizing the standards.
Gene L. Dodaro
Comptroller General of the United States
July 2018
Chapter 1: Foundation and Principles for the
Use and Application of Government Auditing
Standards
1.01 This chapter provides guidance for engagements conducted in
accordance with generally accepted government auditing standards
(GAGAS). This chapter also
Introduction
1.02 The concept of accountability for use of public resources and
government authority is key to our nation’s governing processes.
Management and officials entrusted with public resources are responsible
for carrying out public functions and providing service to the public
effectively, efficiently, economically, and ethically within the context of the
statutory boundaries of the specific government program.
1.09 The following are some of the laws, regulations, and other
authoritative sources that require the use of GAGAS:
1.10 Other laws, regulations, or authoritative sources may require the use
of GAGAS. For example, auditors at the state and local government
levels may be required by state and local laws and regulations to follow
GAGAS. Also, auditors may be required by the terms of an agreement or
contract to follow GAGAS. Auditors may also be required to follow
GAGAS by federal audit guidelines pertaining to program requirements.
Being aware of such other laws, regulations, or authoritative sources may
assist auditors in performing their work in accordance with the required
standards.
1.11 Even if not required to do so, auditors may find it useful to follow
GAGAS in conducting engagements pertaining to federal, state, and local
government programs as well as engagements pertaining to state and
local government awards that contractors, nonprofit entities, and other
nongovernmental entities administer. Though not formally required to do
so, many audit organizations, both in the United States and in other
countries, voluntarily follow GAGAS.
Types of GAGAS Users
1.12 GAGAS provides standards that are used by a wide range of
auditors and audit organizations that audit government entities, entities
that receive government awards, and other entities. These auditors and
audit organizations may also be subject to additional requirements unique
to their environments. Examples of the various types of users who may
be required or may elect to use GAGAS include the following:
Types of GAGAS Engagements
1.13 This section describes the types of engagements that audit
organizations may conduct in accordance with GAGAS. This description
is not intended to limit or require the types of engagements that may be
conducted in accordance with GAGAS.
1.14 All GAGAS engagements begin with objectives, and those objectives
determine the type of engagement to be conducted and the applicable
standards to be followed. This document classifies financial audits,
attestation engagements, reviews of financial statements, and
performance audits, as defined by their objectives, as the types of
engagements that are covered by GAGAS.
Financial Audits
1.17 Financial audits provide independent assessments of whether
entities’ reported financial information (e.g., financial condition, results,
and use of resources) is presented fairly, in all material respects, in
accordance with recognized criteria. Financial audits conducted in
accordance with GAGAS include financial statement audits and other
related financial audits.
1See AU-C section 805, Special Considerations – Audits of Single Financial Statements
and Specific Elements, Accounts, or Items of a Financial Statement (AICPA, Professional
Standards).
2See AU-C section 920, Letters for Underwriters and Certain Other Requesting Parties
(AICPA, Professional Standards).
Attestation Engagements and Reviews of Financial
Statements
1.18 Attestation engagements can cover a broad range of financial or
nonfinancial objectives about the subject matter or assertion depending
on the users’ needs. In an attestation engagement, the subject matter or
an assertion by a party other than the auditors is measured or evaluated
in accordance with suitable criteria. The work the auditors perform and
the level of assurance associated with the report vary based on the type
of attestation engagement. The three types of attestation engagements
are as follows:
Performance Audits
1.21 Performance audits provide objective analysis, findings, and
conclusions to assist management and those charged with governance
and oversight with, among other things, improving program performance
and operations, reducing costs, facilitating decision making by parties
responsible for overseeing or initiating corrective action, and contributing
to public accountability.
8See AR-C section 90, Review of Financial Statements (AICPA, Professional Standards).
Terms Used in GAGAS
1.27 This paragraph describes certain terms used in GAGAS. When
terminology differs from that used at an organization subject to GAGAS,
auditors use professional judgment to determine if there is an equivalent
term.9
j. Engaging party: The party that engages the auditor to conduct the
GAGAS engagement.
The GAGAS Format
1.28 GAGAS uses a format designed to allow auditors to quickly identify
requirements and application guidance related to those requirements.
GAGAS requirements are differentiated from application guidance by
borders surrounding the text. The requirements are followed immediately
by application guidance that relates directly to the preceding
requirements. The auditors’ responsibilities related to requirements and
application guidance are discussed in paragraphs 2.02 through 2.10.
Chapter 2: General Requirements for
Complying with Government Auditing
Standards
2.01 This chapter establishes general requirements for complying with
generally accepted government auditing standards (GAGAS) that are
applicable to all GAGAS engagements. The information it contains relates
to how auditors conducting GAGAS engagements identify and apply the
requirements contained in GAGAS. The chapter also contains
requirements for using other audit standards in conjunction with GAGAS
and for reporting compliance with GAGAS in the audit report.
Complying with GAGAS
Requirements: Complying with GAGAS
10See para. 2.19 for additional documentation requirements for departures from GAGAS
requirements.
Application Guidance: Complying with GAGAS
2.07 GAGAS contains requirements together with related explanatory
material in the form of application guidance. Not every paragraph of
GAGAS carries a requirement. Rather, GAGAS identifies the
requirements through use of specific language. GAGAS also contains
introductory material that provides context relevant to a proper
understanding of a GAGAS chapter or section. Having an understanding
of the entire text of applicable GAGAS includes an understanding of any
financial audit, attestation, and reviews of financial statement standards
incorporated by reference.13
Relationship between GAGAS and Other
Professional Standards
Requirement: Relationship between GAGAS and Other Professional
Standards
2.11 When auditors cite compliance with both GAGAS and another set of
standards, such as those listed in paragraphs 2.13, 2.15, 6.01, and 7.01,
auditors should refer to paragraph 2.17 for the requirements for citing
compliance with GAGAS. In addition to citing GAGAS, auditors may also
cite the use of other standards in their reports when they have also met
the requirements for citing compliance with the other standards. Auditors
should refer to the other set of standards for the basis for citing
compliance with those standards.
Application Guidance: Relationship between GAGAS and
Other Professional Standards
2.12 Auditors may use GAGAS in conjunction with professional standards
issued by other authoritative bodies.
14See the Sarbanes-Oxley Act of 2002 (Public Law 107-204) for a discussion of issuers
(generally, publicly traded companies with a reporting obligation under the Securities
Exchange Act of 1934).
15AICPA, Professional Standards.
16AICPA, Professional Standards.
Stating Compliance with GAGAS in the Audit
Report
Requirements: Stating Compliance with GAGAS in the Audit Report
requirements, the auditors were unable to and did not conduct the
engagement in accordance with GAGAS.
Application Guidance: Stating Compliance with GAGAS in
the Audit Report
2.20 Situations for using modified compliance statements include scope
limitations, such as restrictions on access to records, government
officials, or other individuals needed to conduct the engagement.
Chapter 3: Ethics, Independence, and
Professional Judgment
3.01 The first section of this chapter sets forth fundamental ethical
principles for auditors in the government environment. The second
section establishes independence standards and provides guidance on
this topic for auditors conducting financial audits, attestation
engagements, reviews of financial statements, and performance audits
under generally accepted government auditing standards (GAGAS). This
section emphasizes the importance of independence of the auditor and
the audit organization. The third section establishes the standard for the
auditor’s use of professional judgment and provides related application
guidance. The requirements of this chapter are intended to be followed in
conjunction with all other applicable GAGAS requirements.
Ethical Principles
3.02 The ethical principles presented in this section provide the
foundation, discipline, and structure, as well as the environment, that
influence the application of GAGAS.17
17See para. 5.08 for a discussion of ethical requirements in an audit organization’s system
of quality control.
3.06 The ethical principles that guide the work of auditors who conduct
engagements in accordance with GAGAS are
b. integrity;
c. objectivity;
e. professional behavior.
The Public Interest
3.07 The public interest is defined as the collective well-being of the
community of people and entities that the auditors serve. Observing
integrity, objectivity, and independence in discharging their professional
responsibilities helps auditors serve the public interest and honor the
public trust. The principle of the public interest is fundamental to the
responsibilities of auditors and critical in the government environment.
18See paras. 3.18 through 3.108 for requirements and guidance related to independence.
19See paras. 4.02 through 4.15 for additional information on competence.
Integrity
3.09 Public confidence in government is maintained and strengthened by
auditors performing their professional responsibilities with integrity.
Integrity includes auditors performing their work with an attitude that is
objective, fact-based, nonpartisan, and nonideological with regard to
audited entities and users of the audit reports. Within the constraints of
applicable confidentiality laws, regulations, or policies, communications
with the audited entity, those charged with governance, and the
individuals contracting for or requesting the engagement are expected to
be honest, candid, and constructive.
3.10 Making decisions consistent with the public interest of the program
or activity under audit is an important part of the principle of integrity. In
discharging their professional responsibilities, auditors may encounter
conflicting pressures from management of the audited entity, various
levels of government, and other likely users. Auditors may also encounter
pressures to inappropriately achieve personal or organizational gain. In
resolving those conflicts and pressures, acting with integrity means that
auditors place priority on their responsibilities to the public interest.
Objectivity
3.11 Auditors’ objectivity in discharging their professional responsibilities
is the basis for the credibility of auditing in the government sector.
Objectivity includes independence of mind and appearance when
conducting engagements, maintaining an attitude of impartiality, having
intellectual honesty, and being free of conflicts of interest. Maintaining
objectivity includes a continuing assessment of relationships with audited
entities and other stakeholders in the context of the auditors’
responsibility to the public. The concepts of objectivity and independence
are closely related. Independence impairments affect auditors’
objectivity.20
20See paras. 3.18 through 3.108 for independence requirements and guidance.
Proper Use of Government Information, Resources, and
Positions
3.12 Government information, resources, and positions are to be used for
official purposes and not inappropriately for the auditors’ personal gain or
in a manner contrary to law or detrimental to the legitimate interests of the
audited entity or the audit organization. This concept includes the proper
handling of sensitive or classified information or resources.
3.14 Accountability to the public for the proper use and prudent
management of government resources is an essential part of auditors’
responsibilities. Protecting and conserving government resources and
using them appropriately for authorized activities are important elements
of the public’s expectations for auditors.
3.15 Misusing the auditor position for financial gain or other benefits
violates an auditor’s fundamental responsibilities. An auditor’s credibility
can be damaged by actions that could be perceived by an objective third
party with knowledge of the relevant information as improperly benefiting
an auditor’s personal financial interests or those of an immediate or close
family member; a general partner; an entity for which the auditor serves
as an officer, director, trustee, or employee; or an entity with which the
auditor is negotiating concerning future employment.
Professional Behavior
3.16 High expectations for the auditing profession include complying with
all relevant legal, regulatory, and professional obligations and avoiding
any conduct that could bring discredit to auditors’ work, including actions
that would cause an objective third party with knowledge of the relevant
information to conclude that the auditors’ work was professionally
deficient. Professional behavior includes auditors putting forth an honest
effort in performing their duties in accordance with the relevant technical
and professional standards.
Independence
3.17 GAGAS’s practical consideration of independence consists of four
interrelated sections, providing
Requirements: General
3.18 In all matters relating to the GAGAS engagement, auditors and audit
organizations must be independent from an audited entity.
3.19 Auditors and audit organizations should avoid situations that could
lead reasonable and informed third parties to conclude that the auditors
and audit organizations are not independent and thus are not capable of
exercising objective and impartial judgment on all issues associated with
conducting the engagement and reporting on the work.
a. any period of time that falls within the period covered by the
financial statements or subject matter of the engagement and
Application Guidance: General
3.21 Independence comprises the following:
GAGAS Conceptual Framework Approach to
Independence
3.26 Many different circumstances, or combinations of circumstances, are
relevant in evaluating threats to independence. Therefore, GAGAS
establishes a conceptual framework that auditors use to identify,
evaluate, and apply safeguards to address threats to independence. The
conceptual framework assists auditors in maintaining both independence
of mind and independence in appearance. It can be applied to many
variations in circumstances that create threats to independence and
allows auditors to address threats to independence that result from
activities that are not specifically prohibited by GAGAS.
21See fig. 1 at the end of ch. 3 for a flowchart on applying the conceptual framework in
accordance with GAGAS.
engagements, and other known users, so that they do not continue to rely
on findings or conclusions that were affected by the threat to
independence. If auditors previously posted the report to their publicly
accessible website, they should remove the report and post a public
notification that the report was removed. The auditors should then
determine whether to perform the additional engagement work necessary
to reissue the report, including any revised findings or conclusions, or to
repost the original report if the additional engagement work does not
result in a change in findings or conclusions.
Identifying Threats
Evaluating Threats
Applying Safeguards
3.51 The lists of safeguards in 3.50 and 3.69 cannot provide safeguards
for all circumstances. They may, however, provide a starting point for
auditors who have identified threats to independence and are considering
what safeguards could eliminate those threats or reduce them to an
acceptable level. In some cases, multiple safeguards may be necessary
to address a threat.
d. appointed by, accountable to, reports to, and can only be removed
by a statutorily created governing body, the majority of whose
members are independently elected or appointed and are outside
the organization being audited.
c. protections that prevent the audited entity from interfering with the
initiation, scope, timing, and completion of any engagement;
f. protections that give the audit organization sole authority over the
selection, retention, advancement, and dismissal of its personnel;
and
3.56 Government internal auditors who work under the direction of the
audited entity’s management are considered structurally independent for
the purposes of reporting internally, if the head of the audit organization
meets all of the following criteria:
Internal Auditors
Provision of Nonaudit Services to Audited Entities
Requirement: Nonaudit Services
Routine Activities
b. services to be provided,
3.83 Auditors who previously provided nonaudit services for an entity that
is a prospective subject of an engagement should evaluate the effect of
those nonaudit services on independence before agreeing to conduct a
GAGAS engagement. If auditors provided a nonaudit service in the period
Consideration of Specific Nonaudit Services
3.85 By their nature, certain nonaudit services directly support an entity’s
operations and, if provided to an audited entity, create a threat to the
auditors’ ability to maintain independence in mind and appearance. Some
aspects of these services will impair auditors’ ability to conduct GAGAS
engagements for the entities to which the services are provided.
3.86 Auditors may be able to provide nonaudit services in the broad areas
indicated in paragraphs 3.87 through 3.106 without impairing
independence if (1) the nonaudit services are not expressly prohibited by
GAGAS requirements, (2) the auditors have determined that the
requirements for providing nonaudit services in paragraphs 3.73 through
3.78 and paragraph 3.83 have been met, and (3) any significant threats to
independence have been eliminated or reduced to an acceptable level
through the application of safeguards. The conceptual framework enables
auditors to evaluate independence given the facts and circumstances of
individual services that are not specifically prohibited.
22See fig. 2 at the end of ch. 3 for a flowchart on independence considerations for
preparing accounting records and financial statements.
3.94 Factors that are relevant in evaluating the significance of any threats
created by providing services as discussed in paragraph 3.89 include
23See para. 3.33 for additional requirements related to documenting threats identified and
safeguards applied to eliminate or reduce threats to an acceptable level.
b. the scope or extent of the controls (in relation to the scope of the
engagement conducted) being evaluated.
a. Advisory service
Documentation
Requirement: Documentation
Professional Judgment
Requirement: Professional Judgment
25See para. 5.04 for additional discussion of documenting compliance with quality control
policies and procedures and paras. 5.08 through 5.11 for additional discussion of policies
and procedures on independence, legal, and ethical requirements.
Application Guidance: Professional Judgment
3.110 Professional judgment includes exercising reasonable care and
professional skepticism. Reasonable care includes acting diligently in
accordance with applicable professional standards and ethical principles.
Attributes of professional skepticism include a questioning mind,
awareness of conditions that may indicate possible misstatement owing
to error or fraud, and a critical assessment of evidence. Professional
skepticism includes being alert to, for example, evidence that contradicts
other evidence obtained or information that brings into question the
reliability of documents or responses to inquiries to be used as evidence.
Further, it includes a mindset in which auditors assume that management
is neither dishonest nor of unquestioned honesty. Auditors may accept
records and documents as genuine unless they have reason to believe
the contrary. Auditors may consider documenting procedures undertaken
to support their application of professional skepticism in highly judgmental
or subjective areas under audit.
Figure 1: Generally Accepted Government Auditing Standards Conceptual Framework for Independence
b) Yes – Go to step 2.
b) Yes – Go to step 3.
5) Proceed.
Chapter 4: Competence and Continuing
Professional Education
4.01 This chapter establishes the generally accepted government auditing
standards (GAGAS) requirements for competence and continuing
professional education (CPE). Competence includes being
knowledgeable about the specific GAGAS requirements and having the
skills and abilities to proficiently apply that knowledge on GAGAS
engagements. CPE contributes to auditors’ competence. The
requirements of this chapter are intended to be followed in conjunction
with all other applicable GAGAS requirements.
Competence
Requirements: General
4.04 The audit organization should have a process for recruitment, hiring,
continuous development, assignment, and evaluation of personnel so that
the workforce has the essential knowledge, skills, and abilities necessary
to conduct the engagement. The nature, extent, and formality of the
process will depend on various factors, such as the size of the audit
organization, its structure, and its work.
a. GAGAS;
4.09 The audit organization and engagement teams may consider the
levels of proficiency needed for each role on the engagement when
assigning auditors to the engagement.
Requirement: Specialists
Continuing Professional Education
Requirements: General
CPE hours
24 hours
56 hours
4.20 CPE used to fulfill the 24-hour requirement may be taken at any time
during the 2-year measurement period.
4.22 The subject matter categories for the 24-hour requirement may be
used to satisfy the 56-hour CPE requirement. If CPE in any of the subject
matter and topics that would satisfy the 56-hour requirement, as
discussed in paragraph 4.24, is tailored specifically to the government
environment, such CPE may qualify toward satisfying the 24-hour
requirement. Examples of CPE subjects that may qualify for each of the
categories are listed below.
29See para. 6.01 for a discussion of the AICPA standards incorporated into GAGAS for
financial audits.
30See para. 7.01 for a discussion of the AICPA standards incorporated into GAGAS for
attestation engagements and reviews of financial statements.
34See chs. 8 and 9 for performance audit topics that may be included.
f. leadership;
4.26 Nonsupervisory auditors who charge less than 40 hours of their time
annually to engagements conducted in accordance with GAGAS may be
exempted by the organization from all CPE requirements in paragraph
4.16.
4.27 The audit organization may exempt from the CPE requirements
college and university students employed on a temporary basis for a
limited period of time (for example, an internship of limited duration) or
enrolled in a formal program sponsored by the college or university for a
specific period of employment, such as a term or semester.
4.29 The audit organization, at its discretion, may grant exemptions from
a portion of the CPE requirement in the event of extended absences or
other extenuating circumstances if situations such as the following
prevent auditors from fulfilling those requirements and conducting
engagements:
a. ill health,
d. sabbaticals,
f. foreign residency,
h. disasters.
The audit organization may not grant exceptions for reasons such as
workload, budget, or travel constraints.
4.30 External specialists are not auditors subject to the GAGAS CPE
requirements. Also, internal specialists assisting on a GAGAS
engagement who are not involved in planning, directing, performing
engagement procedures, or reporting on a GAGAS engagement are not
auditors subject to the GAGAS CPE requirements.
e. audio conferences;
4.35 Examples of training topics that may qualify as CPE for state
licensing bodies or professional organizations but would not generally
qualify as CPE for purposes of satisfying requirements under GAGAS
include certain training in taxation, personal financial planning and
investment, taxation strategies, estate planning, retirement planning, and
practice management, unless such training directly enhances the
auditors’ professional proficiency to perform engagements or relate to the
subject matter of an engagement. However, if certain taxation or other
topics relate to an objective or the subject matter of an engagement,
training in those related topics could qualify as CPE under GAGAS.
4.36 Examples of programs and activities that do not qualify for CPE
hours under GAGAS include, but are not limited to, the following:
a. on-the-job training;
4.38 For university or college credit courses, each unit of college credit
under a semester system equals 15 CPE hours, and each unit of college
credit under a quarter system equals 10 CPE hours. For university or
college noncredit courses, CPE hours may be granted only for the actual
classroom time.
evaluating whether and to what extent any CPE already taken in that
period would satisfy GAGAS CPE requirements.
4.43 For newly assigned auditors who are subject to the 24-hour
requirement, the number of prorated hours may be calculated in a similar
manner: 3/4 x 24 hours = 18 hours, in this example. The prorated amount
of hours would be the total requirement over the partial period. The 20-
hour minimum for each CPE year would not apply when the prorated
number of hours is being used to cover a partial 2-year CPE period.
4.44 At their discretion, audit organizations may give auditors who have
not completed the 80-hour CPE requirement for any 2-year period up to 2
months immediately following the 2-year period to make up the
deficiency. Audit organizations may also give auditors who have not
completed the 20 hours of CPE in a 1-year period up to 2 months
immediately following the 1-year period to make up the deficiency. Any
CPE hours completed toward a deficiency in one period may be
documented in the CPE records and may not be counted toward the
requirements for the next period. Audit organizations that grant the 2-
month grace period may not allow auditors who have not satisfied the
CPE requirements after the grace period to participate in GAGAS
engagements until those requirements are satisfied.
4.45 Auditors may not carry over CPE hours earned in excess of the 80-
hour and 24-hour requirements from one 2-year CPE measurement
period to the next.
4.49 An audit organization may use a measurement date other than the
date it started its first GAGAS engagement, or the audit organization may
choose to change its measurement date to coincide with a fiscal year or
another reporting requirement, such as one established by a state
licensing body or professional organization. For example, if an audit
organization changes the end date of the measurement period from
December 31 to June 30, during the audit organization’s transition period
(January 1 to June 30), its auditors may complete at least a prorated
number of CPE hours for the 6-month transition period. The number of
prorated hours required may be calculated using the method illustrated in
paragraphs 4.42 and 4.43.
4.50 The audit organization’s policies and procedures for CPE may
address the following:
d. the number of CPE hours earned toward the 56-hour and 24-hour
requirements;
4.52 The audit organization may monitor CPE compliance through its
internal inspections or other quality assurance monitoring activities.
Chapter 5: Quality Control and Peer Review
5.01 This chapter establishes the generally accepted government auditing
standards (GAGAS) requirements and guidance for quality control and
assurance, and for administering, planning, performing, and reporting on
peer reviews of audit organizations that conduct engagements in
accordance with GAGAS. The requirements of this chapter are intended
to be followed in conjunction with those of all other applicable GAGAS
requirements.
Quality Control and Assurance
Requirement: Quality Control and Assurance
System of Quality Control
Requirement: System of Quality Control
extent to which the audit organization complies with its quality control
policies and procedures.
Leadership Responsibilities for Quality within the Audit
Organization
Requirements: Leadership Responsibilities for Quality within the
Audit Organization
Independence, Legal, and Ethical Requirements
Requirements: Independence, Legal, and Ethical Requirements
35See paras. 3.02 through 3.16 for a discussion of ethical principles and paras. 3.18
through 3.108 for independence requirements and guidance.
Initiation, Acceptance, and Continuance of Engagements
Requirement: Initiation, Acceptance, and Continuance of
Engagements
5.12 The audit organization should establish policies and procedures for
the initiation, acceptance, and continuance of engagements that are
designed to provide reasonable assurance that the organization will
undertake engagements only if it
Human Resources
Requirements: Human Resources
5.15 The audit organization should establish policies and procedures for
human resources that are designed to provide the organization with
reasonable assurance that it has personnel with the competence to
5.18 The audit organization may use a suitably qualified external person
to conduct engagement work when internal resources, for example,
personnel with particular areas of technical expertise, are unavailable.
36Refer to paras. 4.02 through 4.15 for requirements and guidance on competence.
5.20 The size and circumstances of the audit organization are important
considerations in determining the structure of the audit organization’s
performance evaluation process. A smaller audit organization, in
particular, may employ less formal methods of evaluating the
performance of its personnel.
Engagement Performance
Requirements: General
5.22 The audit organization should establish policies and procedures for
engagement performance, documentation, and reporting that are
designed to provide the audit organization with reasonable assurance that
engagements are conducted and reports are issued in accordance with
professional standards and applicable legal and regulatory requirements.
a. those consulted are given all the relevant facts that will enable
them to provide informed advice;
Requirements: Supervision
5.36 The audit organization should establish policies and procedures that
require engagement team members with appropriate levels of skill and
proficiency in auditing to supervise engagements and review work
performed by other engagement team members.
5.41 In the case of a sole proprietor, the requirement for a second auditor
to review work performed and related documentation may be achieved
through alternative procedures.
Monitoring of Quality
Requirements: Monitoring of Quality
5.42 The audit organization should establish policies and procedures for
monitoring its system of quality control.
5.44 The audit organization should analyze and summarize the results of
its monitoring process at least annually, with identification of any systemic
or repetitive issues needing improvement, along with recommendations
for corrective action. The audit organization should communicate to the
relevant engagement partner or director, and other appropriate personnel,
any deficiencies noted during the monitoring process and recommend
appropriate remedial action. This communication should be sufficient to
enable the audit organization and appropriate personnel to take prompt
corrective action related to deficiencies, when necessary, in accordance
with their defined roles and responsibilities. Information communicated
should include the following:
5.46 The audit organization should establish policies and procedures that
require retention of engagement documentation for a period of time
sufficient to permit those performing monitoring procedures and peer
review of the organization to evaluate its compliance with its system of
quality control or for a longer period if required by law or regulation.
5.53 Reviews of the work by engagement team members prior to the date
of the report are not monitoring procedures.
External Peer Review
Requirements: General
5.63 Each audit organization has discretion in selecting and accepting its
peer review teams. Auditors in governments or jurisdictions without
access to established peer review programs may engage other auditors,
including public accounting firms, to conduct their peer reviews. If access
to an established peer review program is not available, auditors may
organize regional programs with other auditors.
5.66 The peer review team should perform an assessment of peer review
risk to help determine the number and types of engagements to select for
review.
5.67 Based on the risk assessment, the peer review team should select
engagements that provide a reasonable cross section of all types of work
subject to the reviewed audit organization’s quality control system,
including one or more engagements conducted in accordance with
GAGAS.
5.68 Peer review risk is the risk that the review team
e. initial engagements;
5.72 The peer review team should use professional judgment in deciding
on the type of peer review rating to issue; the ratings are as follows:
5.73 The peer review team should determine the type of peer review
rating to issue based on the observed matters’ importance to the audit
organization’s system of quality control as a whole and the nature,
causes, patterns, and pervasiveness of those matters. The matters
should be assessed both alone and in aggregate.
5.74 The peer review team should aggregate and systematically evaluate
any observed matters (circumstances that warrant further consideration
by the peer review team) and document its evaluation.37 The peer review
team should perform its evaluation and issue report ratings as follows:
5.76 Significant deficiencies are one or more deficiencies that the peer
review team concludes result from a condition in the audit organization’s
system of quality control or compliance with that system such that the
system taken as a whole does not provide reasonable assurance of
performing, reporting, or both in conformity with professional standards
and applicable legal and regulatory requirements.
37See fig. 3 for a flowchart on developing peer review communications for observed
matters in accordance with GAGAS.
5.77 An external audit organization should make its most recent peer
review report publicly available. If a separate communication detailing
findings, conclusions, and recommendations is issued, the external audit
organization is not required to make that communication publicly
available. An internal audit organization that reports internally to
management and those charged with governance should provide a copy
of its peer review report to those charged with governance.
5.80 Auditors who are using another audit organization’s work should
request a copy of that organization’s most recent peer review report, and
the organization should provide this document when it is requested.
5.81 To help the public understand the peer review reports, an audit
organization may include a description of the peer review process and
how it applies to its organization. Examples of additional information that
audit organizations may include to help users understand the meaning of
the peer review report follow:
Additional Requirements for Audit Organizations Not
Affiliated with Recognized Organizations
Requirement: Peer Review Scope
5.82 The peer review team should include the following elements in the
scope of the peer review:
5.85 The period under review in a peer review generally covers 1 year.
5.86 The peer review team and the reviewed audit organization should
incorporate their basic agreement on the peer review into a written
agreement. The written agreement should be drafted by the peer review
team, reviewed by the reviewed audit organization to ensure that it
accurately describes the agreement between the parties, and signed by
the authorized representatives of both the peer review team and the
reviewed audit organization prior to the initiation of work under the
agreement. The written agreement should state that the peer review will
be conducted in accordance with GAGAS peer review requirements.
e. reporting results;
5.88 The peer review team is responsible for ensuring that the peer
review is conducted in accordance with GAGAS peer review
requirements.
5.89 The peer review team should meet the following criteria:
5.91 The peer review team should prepare one or more written reports
communicating the results of the peer review, which collectively include
the following elements:
5.92 When the scope of the peer review is limited by conditions that
preclude the application of one or more peer review procedures
considered necessary in the circumstances and the peer review team
cannot accomplish the objectives of those procedures through alternative
procedures, the report can be modified by including a statement in the
report’s scope paragraph, body, and opinion paragraph. The statement
describes the relationship of the excluded engagement(s) or functional
area(s) to the reviewed audit organization’s full scope of practice as a
whole and system of quality control and the effects of the exclusion on the
scope and results of the review.
the corrective actions already taken, target dates for planned corrective
actions, or both.
Figure 3: Developing Peer Review Communications for Observed Matters in Accordance with Generally Accepted
Government Auditing Standards
Chapter 6: Standards for Financial Audits
6.01 This chapter contains requirements and guidance for conducting and
reporting on financial audits conducted in accordance with generally
accepted government auditing standards (GAGAS). GAGAS incorporates
by reference the American Institute of Certified Public Accountants’
(AICPA) Statements on Auditing Standards (SAS).39 All sections of the
SAS are incorporated, including the introduction, objectives, definitions,
requirements, and application material. GAGAS does not incorporate the
AICPA Code of Professional Conduct by reference but recognizes that
certain certified public accountants (CPA) may use or may be required to
use the code in conjunction with GAGAS.40 For financial audits conducted
in accordance with GAGAS, the requirements and guidance in the
incorporated SAS and this chapter apply. The requirements and guidance
contained in chapters 1 through 5 also apply.
Additional GAGAS Requirements for
Conducting Financial Audits
Compliance with Standards
Requirement: Compliance with Standards
39See para. 2.13 and the AICPA Codification of Statements on Auditing Standards (AU-C)
for additional discussion of the relationship between GAGAS and other professional
standards.
40See para. 2.14 for a discussion of the AICPA Code of Professional Conduct.
Licensing and Certification
Requirements: Licensing and Certification
Auditor Communication
Requirements: Auditor Communication
41See AU-C section 320, Materiality in Planning and Performing an Audit (AICPA,
Professional Standards).
6.08 One example of a law or regulation requiring an audit that does not
specifically identify the entities to be audited is the Single Audit Act
Amendments of 1996.
Results of Previous Engagements
Requirement: Results of Previous Engagements
6.11 When planning the audit, auditors should ask management of the
audited entity to identify previous audits, attestation engagements, and
other studies that directly relate to the objectives of the audit, including
whether related recommendations have been implemented. Auditors
42See AU-C section 265, Communicating Internal Control Related Matters Identified in an
Audit (AICPA, Professional Standards).
Investigations or Legal Proceedings
Requirement: Investigations or Legal Proceedings
Noncompliance with Provisions of Laws, Regulations,
Contracts, and Grant Agreements
Requirement: Noncompliance with Provisions of Laws, Regulations,
Contracts, and Grant Agreements
Findings
Requirements: Findings
6.17 When auditors identify findings, they should plan and perform
procedures to develop the criteria, condition, cause, and effect of the
findings to the extent that these elements are relevant and necessary to
achieve the audit objectives.
43See AU-C section 250, Consideration of Laws and Regulations in an Audit of Financial
Statements (AICPA, Professional Standards).
Application Guidance: Findings
6.19 Findings may involve deficiencies in internal control; noncompliance
with provisions of laws, regulations, contracts, and grant agreements; or
instances of fraud.
6.20 Given the concept of accountability for use of public resources and
government authority, evaluating internal control in a government
environment may also include considering internal control deficiencies
that result in waste or abuse. Because the determination of waste and
abuse is subjective, auditors are not required to perform specific
procedures to detect waste or abuse in financial audits. However,
auditors may consider whether and how to communicate such matters if
they become aware of them. Auditors may also discover that waste or
abuse are indicative of fraud or noncompliance with provisions of laws,
regulations, contracts, and grant agreements.
6.22 The following are examples of waste, depending on the facts and
circumstances:
6.24 The following are examples of abuse, depending on the facts and
circumstances:
6.25 Criteria: For inclusion in findings, criteria may include the laws,
regulations, contracts, grant agreements, standards, measures, expected
performance, defined business practices, and benchmarks against which
performance is compared or evaluated. Criteria identify the required or
desired state or expectation with respect to the program or operation.
Criteria provide a context for evaluating evidence and understanding the
findings, conclusions, and recommendations in the report. In a financial
audit, the applicable financial reporting framework, such as generally
accepted accounting principles, represents one set of criteria.
6.27 Cause: The cause is the factor or factors responsible for the
difference between the condition and the criteria, and may also serve as a
basis for recommendations for corrective actions. Common factors
include poorly designed policies, procedures, or criteria; inconsistent,
incomplete, or incorrect implementation; or factors beyond the control of
program management. Auditors may assess whether the evidence
provides a reasonable and convincing argument for why the stated cause
is the key factor contributing to the difference between the condition and
the criteria.
6.28 Effect or potential effect: The effect or potential effect is the outcome
or consequence resulting from the difference between the condition and
the criteria. When the audit objectives include identifying the actual or
potential consequences of a condition that varies (either positively or
negatively) from the criteria identified in the audit, effect is a measure of
those consequences. Effect or potential effect may be used to
Audit Documentation
Requirements: Audit Documentation
44See AU-C section 265, Communicating Internal Control Related Matters Identified in an
Audit (AICPA, Professional Standards).
45Para. .A16 of AU-C section 940, An Audit of Internal Control Over Financial Reporting
That Is Integrated With an Audit of Financial Statements (AICPA, Professional Standards)
indicates that the Committee of Sponsoring Organizations of the Treadway Commission’s
Internal Control—Integrated Framework and Standards for Internal Control in the Federal
Government (GAO-14-704G) provide suitable and available criteria against which
management may evaluate and report on the effectiveness of the entity’s internal control
over financial reporting. Standards for Internal Control in the Federal Government may be
adopted by entities beyond those federal entities for which it is legally required, such as
state, local, and quasi-governmental entities, as well as other federal entities and not-for-
profit organizations, as a framework for an internal control system.
Availability of Individuals and Documentation
Requirement: Availability of Individuals and Documentation
Additional GAGAS Requirements for Reporting
on Financial Audits
Reporting the Auditors’ Compliance with GAGAS
Requirement: Reporting the Auditors’ Compliance with GAGAS
6.36 When auditors comply with all applicable GAGAS requirements, they
should include a statement in the audit report that they conducted the
audit in accordance with GAGAS.46
46See paras. 2.16 through 2.19 for information on the GAGAS compliance statement.
Reporting on Internal Control; Compliance with Provisions
of Laws, Regulations, Contracts, and Grant Agreements;
and Instances of Fraud
Requirements: Reporting on Internal Control; Compliance with
Provisions of Laws, Regulations, Contracts, and Grant Agreements;
and Instances of Fraud
less than material but warrants the attention of those charged with
governance or
6.47 The audit report on internal control and compliance with provisions
of laws, regulations, contracts, and grant agreements relates only to the
most recent reporting period included, when comparative financial
statements are presented.
Presenting Findings in the Audit Report
Requirements: Presenting Findings in the Audit Report
Reporting Findings Directly to Parties outside the Audited
Entity
Requirements: Reporting Findings Directly to Parties outside the
Audited Entity
Obtaining and Reporting the Views of Responsible
Officials
Requirements: Obtaining and Reporting the Views of Responsible
Officials
6.57 Auditors should obtain and report the views of responsible officials of
the audited entity concerning the findings, conclusions, and
recommendations in the audit report, as well as any planned corrective
actions.
6.61 Providing a draft report with findings for review and comment by
responsible officials of the audited entity and others helps the auditors
develop a report that is fair, complete, and objective. Including the views
of responsible officials results in a report that presents not only the
auditors’ findings, conclusions, and recommendations but also the
perspectives of the audited entity’s responsible officials and the corrective
actions they plan to take. Obtaining the comments in writing is preferred,
but oral comments are acceptable. In cases in which the audited entity
provides technical comments in addition to its written or oral comments
on the report, auditors may disclose in the report that such comments
were received. Technical comments address points of fact or are editorial
in nature and do not address substantive issues, such as methodology,
findings, conclusions, or recommendations.
Reporting Confidential or Sensitive Information
Requirements: Reporting Confidential or Sensitive Information
6.64 When circumstances call for omission of certain information from the
report, auditors should evaluate whether this omission could distort the
audit results or conceal improper or illegal practices and revise the report
language as necessary to avoid report users drawing inappropriate
conclusions from the information presented.
6.66 If the report refers to the omitted information, the reference may be
general and not specific. If the omitted information is not necessary to
meet the audit objectives, the report need not refer to its omission.
Distributing Reports
Requirement: Distributing Reports
Chapter 7: Standards for Attestation
Engagements and Reviews of Financial
Statements
7.01 This chapter contains requirements and guidance for conducting and
reporting on attestation engagements and reviews of financial statements
conducted in accordance with generally accepted government auditing
standards (GAGAS). For attestation engagements, GAGAS incorporates
by reference the American Institute of Certified Public Accountants’
(AICPA) Statements on Standards for Attestation Engagements (SSAE).
For reviews of financial statements, GAGAS incorporates by reference
AICPA’s AR-C section 90, Review of Financial Statements.49 All sections
of the cited standards are incorporated, including the introduction,
objectives, definitions, requirements, and application and other
explanatory material. GAGAS does not incorporate the AICPA Code of
Professional Conduct by reference but recognizes that certain certified
public accountants (CPA) may use or may be required to use the code in
conjunction with GAGAS.50 For attestation engagements and reviews of
financial statements conducted in accordance with GAGAS, the
requirements and guidance in the respective incorporated standards and
this chapter apply. The requirements and guidance contained in chapters
1 through 5 also apply.
Examination Engagements
Compliance with Standards
Requirement: Compliance with Standards
51See para. .08 of AT-C section 205, para. .09 of AT-C section 210, and para. .14 of AT-C
section 215; and para. .11 of AR-C section 90 (AICPA, Professional Standards).
Licensing and Certification
Requirements: Licensing and Certification
Auditor Communication
Requirements: Auditor Communication
Results of Previous Engagements
Requirement: Results of Previous Engagements
Investigations or Legal Proceedings
Requirement: Investigations or Legal Proceedings
Noncompliance with Provisions of Laws, Regulations,
Contracts, and Grant Agreements
Requirement: Noncompliance with Provisions of Laws, Regulations,
Contracts, and Grant Agreements
52See paras. .32 and .33 of AT-C section 205 (AICPA, Professional Standards).
Findings
Requirements: Findings
7.19 When auditors identify findings, they should plan and perform
procedures to develop the criteria, condition, cause, and effect of the
findings to the extent that these elements are relevant and necessary to
achieve the examination objectives.
7.22 Given the concept of accountability for use of public resources and
government authority, evaluating internal control in a government
environment may also include considering internal control deficiencies
that result in waste or abuse. Because the determination of waste and
abuse is subjective, auditors are not required to perform specific
7.24 The following are examples of waste, depending on the facts and
circumstances:
7.26 The following are examples of abuse, depending on the facts and
circumstances:
7.27 Criteria: For inclusion in findings, criteria may include the laws,
regulations, contracts, grant agreements, standards, measures, expected
performance, defined business practices, and benchmarks against which
performance is compared or evaluated. Criteria identify the required or
desired state or expectation with respect to the program or operation.
Criteria provide a context for evaluating evidence and understanding the
findings, conclusions, and recommendations in the report.
7.29 Cause: The cause is the factor or factors responsible for the
difference between the condition and the criteria, and may also serve as a
basis for recommendations for corrective actions. Common factors
include poorly designed policies, procedures, or criteria; inconsistent,
incomplete, or incorrect implementation; or factors beyond the control of
program management. Auditors may assess whether the evidence
provides a reasonable and convincing argument for why the stated cause
is the key factor contributing to the difference between the condition and
the criteria.
7.30 Effect or potential effect: The effect or potential effect is the outcome
or consequence resulting from the difference between the condition and
the criteria. When the engagement objectives include identifying the
actual or potential consequences of a condition that varies (either
positively or negatively) from the criteria identified in the engagement,
effect is a measure of those consequences. Effect or potential effect may
be used to demonstrate the need for corrective action in response to
identified problems or relevant risks.
Examination Engagement Documentation
Requirements: Examination Engagement Documentation
Availability of Individuals and Documentation
Requirement: Availability of Individuals and Documentation
Reporting the Auditors’ Compliance with GAGAS
Requirements: Reporting the Auditors’ Compliance with GAGAS
7.39 When auditors comply with all applicable GAGAS requirements, they
should include a statement in the report that they conducted the
examination in accordance with GAGAS.54
Reporting Deficiencies in Internal Control
Requirement: Reporting Deficiencies in Internal Control
7.42 Auditors should include in the examination report all internal control
deficiencies, even those communicated early, that are considered to be
significant deficiencies or material weaknesses that the auditors identified
based on the engagement work performed.55
54See paras. 2.16 through 2.19 for information on the GAGAS compliance statement.
55GAGAS’s use of internal control terminology is consistent with the definitions contained
in AU-C section 265 (AICPA, Professional Standards).
Reporting on Noncompliance with Provisions of Laws,
Regulations, Contracts, and Grant Agreements or
Instances of Fraud
Requirements: Reporting on Noncompliance with Provisions of
Laws, Regulations, Contracts, and Grant Agreements or Instances
of Fraud
would not compromise those proceedings and, for example, report only
on information that is already a part of the public record.
Presenting Findings in the Report
Requirements: Presenting Findings in the Report
Reporting Findings Directly to Parties outside the Audited
Entity
Requirements: Reporting Findings Directly to Parties outside the
Audited Entity
Obtaining and Reporting the Views of Responsible
Officials
Requirements: Obtaining and Reporting the Views of Responsible
Officials
7.55 Auditors should obtain and report the views of responsible officials of
the audited entity concerning the findings, conclusions, and
recommendations in the examination report, as well as any planned
corrective actions.
7.59 Providing a draft report with findings for review and comment by
responsible officials of the audited entity and others helps the auditors
develop a report that is fair, complete, and objective. Including the views
of responsible officials results in a report that presents not only the
auditors’ findings, conclusions, and recommendations but also the
perspectives of the audited entity’s responsible officials and the corrective
actions they plan to take. Obtaining the comments in writing is preferred,
but oral comments are acceptable. When the audited entity provides
technical comments in addition to its written or oral comments on the
report, auditors may disclose in the report that such comments were
received. Technical comments address points of fact or are editorial in
nature and do not address substantive issues, such as methodology,
findings, conclusions, or recommendations.
Reporting Confidential or Sensitive Information
Requirements: Reporting Confidential or Sensitive Information
7.64 If the report refers to the omitted information, the reference may be
general and not specific. If the omitted information is not necessary to
meet the engagement objectives, the report need not refer to its omission.
7.67 Considering the broad public interest in the program or activity under
examination assists auditors when deciding whether to exclude certain
information from publicly available reports.
Distributing Reports
Requirement: Distributing Reports
Review Engagements
Compliance with Standards
Requirement: Compliance with Standards
Licensing and Certification
Requirements: Licensing and Certification
Noncompliance with Provisions of Laws, Regulations,
Contracts, and Grant Agreements
Requirement: Noncompliance with Provisions of Laws, Regulations,
Contracts, and Grant Agreements
Reporting Auditors’ Compliance with GAGAS
Requirement: Reporting Auditors’ Compliance with GAGAS
7.74 When auditors comply with all applicable requirements for a review
engagement conducted in accordance with GAGAS, they should include
a statement in the review report that they conducted the engagement in
accordance with GAGAS.57
Distributing Reports
Requirement: Distributing Reports
Agreed-Upon Procedures Engagements
Compliance with Standards
Requirement: Compliance with Standards
Licensing and Certification
Requirements: Licensing and Certification
Noncompliance with Provisions of Laws, Regulations,
Contracts, and Grant Agreements
Requirement: Noncompliance with Provisions of Laws, Regulations,
Contracts, and Grant Agreements
Reporting Auditors’ Compliance with GAGAS
Requirement: Reporting Auditors’ Compliance with GAGAS
7.82 When auditors comply with all applicable GAGAS requirements for
agreed-upon procedures engagements, they should include a statement
in the agreed-upon procedures engagement report that they conducted
the engagement in accordance with GAGAS.60
Distributing Reports
Requirement: Distributing Reports
60See paras. 2.16 through 2.19 for information on the GAGAS compliance statement.
61See para. .35(j) of AT-C section 215 (AICPA, Professional Standards).
62See para. .35(g) of AT-C section 215 (AICPA, Professional Standards).
Reviews of Financial Statements
Compliance with Standards
Requirement: Compliance with Standards
Licensing and Certification
Requirements: Licensing and Certification
Noncompliance with Provisions of Laws, Regulations,
Contracts, and Grant Agreements
Requirement: Noncompliance with Provisions of Laws, Regulations,
Contracts, and Grant Agreements
Reporting Auditors’ Compliance with GAGAS
Requirement: Reporting Auditors’ Compliance with GAGAS
7.90 When auditors comply with all applicable requirements for a review
of financial statements conducted in accordance with GAGAS, they
should include a statement in the report that they conducted the
engagement in accordance with GAGAS.65
Distributing Reports
Requirement: Distributing Reports
Chapter 8: Fieldwork Standards for
Performance Audits
8.01 This chapter contains fieldwork requirements and guidance for
performance audits conducted in accordance with generally accepted
government auditing standards (GAGAS). Fieldwork requirements
establish an overall approach for auditors to apply in planning and
performing an audit to obtain sufficient, appropriate evidence that
provides a reasonable basis for findings and conclusions based on the
audit objectives. For performance audits conducted in accordance with
GAGAS, the requirements and guidance in chapters 1 through 5 and
chapter 9 also apply.
Planning
Requirements: General
8.03 Auditors must adequately plan the work necessary to address the
audit objectives. Auditors must document the audit plan.
8.04 Auditors must plan the audit to reduce audit risk to an acceptably low
level.
8.05 In planning the audit, auditors should assess significance and audit
risk. Auditors should apply these assessments to establish the scope and
methodology for addressing the audit objectives. Planning is a continuous
process throughout the audit.
8.07 Auditors should identify and use suitable criteria based on the audit
objectives.
8.08 The audit objectives are what the audit is intended to accomplish.
They identify the audit subject matter and performance aspects to be
included. Audit objectives can be thought of as questions about the
program that the auditors seek to answer based on evidence obtained
and assessed against criteria. Audit objectives may also pertain to the
current status or condition of a program. The term program as used in
GAGAS includes processes, projects, studies, policies, operations,
activities, entities, and functions.
8.09 Auditors may need to refine or adjust the audit objectives, scope,
and methodology as work is performed. However, in situations where the
audit objectives are established by statute or legislative oversight,
auditors may not have latitude to define or adjust the audit objectives or
scope.
8.10 Scope is the boundary of the audit and is directly tied to the audit
objectives. The scope defines the subject matter that the auditors will
assess and report on, such as a particular program or aspect of a
program, the necessary documents or records, the period of time
reviewed, and the locations that will be included.
8.16 Audit risk is the possibility that the auditors’ findings, conclusions,
recommendations, or assurance may be improper or incomplete as a
result of factors such as evidence that is not sufficient or appropriate, an
inadequate audit process, or intentional omissions or misleading
information because of misrepresentation or fraud. The assessment of
audit risk involves both qualitative and quantitative considerations.
Factors affecting audit risk include the time frames, complexity, or
sensitivity of the work; size of the program in terms of dollar amounts and
number of citizens served; adequacy of the audited entity’s systems and
processes for preventing and detecting inconsistencies, significant errors,
or fraud; and auditors’ access to records. Audit risk includes the risk that
auditors will not detect a mistake, inconsistency, significant error, or fraud
in the evidence supporting the audit. Audit risk can be reduced by taking
actions such as increasing the scope of work; adding specialists,
additional reviewers, and other resources to conduct the audit; changing
the methodology to obtain additional evidence, higher-quality evidence, or
d. expert opinions;
8.19 For audit objectives that pertain to the current status or condition of a
program, sufficient, appropriate evidence is gathered to provide
reasonable assurance that the description of the current status or
condition of a program is accurate and reliable and does not omit
significant information relevant to the audit objectives. Information
addressing the audit objectives is to be provided in an objective,
understandable manner. The relative importance of each of the
Auditor Communication
Requirements: Auditor Communication
Investigations or Legal Proceedings
Requirement: Investigations or Legal Proceedings
Results of Previous Engagements
Requirement: Results of Previous Engagements
8.30 Auditors should evaluate whether the audited entity has taken
appropriate corrective action to address findings and recommendations
from previous engagements that are significant within the context of the
audit objectives. When planning the audit, auditors should ask
management of the audited entity to identify previous engagements or
other studies that directly relate to the objectives of the audit, including
whether related recommendations have been implemented. Auditors
should use this information in assessing risk and determining the nature,
timing, and extent of current audit work, including determining the extent
to which testing the implementation of the corrective actions is applicable
to the current audit objectives.
Assigning Auditors
Requirements: Assigning Auditors
Preparing a Written Audit Plan
Requirement: Preparing a Written Audit Plan
8.33 Auditors must prepare a written audit plan for each audit. Auditors
should update the plan, as necessary, to reflect any significant changes
to the plan made during the audit.
8.34 The form and content of the written audit plan may vary among
audits and may include an audit strategy, audit program, project plan,
audit planning paper, or other appropriate documentation of key decisions
about the audit objectives, scope, and methodology and the auditors’
basis for those decisions.
Conducting the Engagement
Nature and Profile of the Program and User Needs
Requirement: Nature and Profile of the Program and User Needs
d. Inputs: Inputs are the amount of resources (in terms of, for
example, money, material, or personnel) that is put into a
program. These resources may come from within or outside the
entity operating the program. Measures of inputs can have a
number of dimensions, such as cost, timing, and quality.
Examples of measures of inputs are dollars spent, employee
hours expended, and square feet of building space used.
Determining Significance and Obtaining an
Understanding of Internal Control
Requirements: Determining Significance and Obtaining an
Understanding of Internal Control
69See
fig.4 at the end of ch. 8 for a flowchart on consideration of internal control in a
GAGAS performance audit.
70The terminology used in this section is consistent with the definitions and concepts in
the Committee of Sponsoring Organizations of the Treadway Commission’s Internal
Control—Integrated Framework (COSO Framework) and Standards for Internal Control in
the Federal Government (GAO-14-704G) (Green Book).
Assessing Internal Control
Requirement: Assessing Internal Control
Internal Control Deficiencies Considerations
Requirement: Internal Control Deficiencies Considerations
8.55 Internal control deficiencies are evaluated for significance within the
context of the audit objectives. Deficiencies are evaluated both on an
individual basis and in the aggregate. Consideration is given to the
correlation among deficiencies. This evaluation and the audit work
performed form the basis of the auditors’ determination whether,
individually or in combination, the deficiencies are significant within the
context of the audit objectives.72
72See paras. 9.29 through 9.34 for a discussion of reporting on internal control.
Information Systems Controls Considerations
Requirements: Information Systems Controls Considerations
limited or extensive. In addition, the nature and extent of audit risk related
to information systems controls are affected by the hardware and
software used, the configuration of the entity’s systems and networks,
and the entity’s information systems strategy.
Provisions of Laws, Regulations, Contracts, and Grant
Agreements
Requirement: Provisions of Laws, Regulations, Contracts, and Grant
Agreements
Fraud
Requirements: Fraud
8.71 Auditors should assess the risk of fraud occurring that is significant
within the context of the audit objectives. Audit team members should
discuss among the team fraud risks, including factors such as individuals’
incentives or pressures to commit fraud, the opportunity for fraud to
occur, and rationalizations or attitudes that could increase the risk of
fraud. Auditors should gather and assess information to identify the risk of
fraud that is significant within the scope of the audit objectives or that
could affect the findings and conclusions.
8.76 If fraud that may have occurred is not significant within the context of
the audit objectives, the auditors may perform additional audit work as a
separate engagement or refer the matter to other parties with oversight
responsibility or jurisdiction.
Identifying Sources of Evidence and the Amount and Type
of Evidence Required
Requirements: Identifying Sources of Evidence and the Amount and
Type of Evidence Required
Using the Work of Others
Requirements: Using the Work of Others
8.81 If auditors use the work of other auditors, they should perform
procedures that provide a sufficient basis for using that work. Auditors
should obtain evidence concerning the other auditors’ qualifications and
independence and should determine whether the scope, quality, and
timing of the audit work performed by the other auditors can be relied on
in the context of the current audit objectives.73
73See para. 5.80 for additional discussion on using the work of other auditors and peer
review reports.
74See para. 1.27p for the definition of specialist.
8.85 If other auditors have completed audit work related to the objectives
of the current audit, the current auditors may be able to use the work of
the other auditors to support findings or conclusions for the current audit
and thereby avoid duplication of effort. Procedures that auditors may
perform in making this determination include reviewing the other audit
report, audit plan, or audit documentation, or performing tests of the other
auditors’ work. The nature and extent of evidence needed will depend on
the significance of the other auditors’ work to the current audit objectives
and the extent to which the auditors will use that work.
Supervision
Requirement: Supervision
8.89 The nature and extent of the auditors’ supervision and the review of
audit work may vary depending on a number of factors, such as the size
75See paras. 3.18 through 3.108 for requirements and guidance related to independence.
of the audit organization, the significance of the work, and the experience
of the auditors.
Evidence
Requirements: Evidence
8.95 Audit objectives may vary widely, as may the level of work
necessary to assess the sufficiency and appropriateness of evidence to
address the objectives. The concepts of audit risk and significance assist
auditors in evaluating the audit evidence. Professional judgment assists
auditors in determining the sufficiency and appropriateness of evidence
taken as a whole. Interpreting, summarizing, or analyzing evidence is
typically used in determining the sufficiency and appropriateness of
evidence and in reporting the results of the audit work.
8.96 When auditors use information that audited entity officials provided
as part of their evidence, auditors may find it necessary to test
management’s procedures to obtain assurance, perform direct testing of
Sufficiency
a. The greater the audit risk, the greater the quantity and quality of
evidence required.
Appropriateness
Overall Assessment of Evidence
Requirements: Overall Assessment of Evidence
8.113 The steps to assess evidence may depend on the nature of the
evidence, how the evidence is used in the audit or report, and the audit
objectives.
Findings
Requirements: Findings
8.119 Given the concept of accountability for use of public resources and
government authority, evaluating internal control in a government
environment may also include considering internal control deficiencies
8.121 The following are examples of waste, depending on the facts and
circumstances:
8.123 The following are examples of abuse, depending on the facts and
circumstances:
8.126 Cause: The cause is the factor or factors responsible for the
difference between the condition and the criteria, and may also serve as a
basis for recommendations for corrective actions. Common factors
include poorly designed policies, procedures, or criteria; inconsistent,
incomplete, or incorrect implementation; or factors beyond the control of
program management. Auditors may assess whether the evidence
provides a reasonable and convincing argument for why the stated cause
is the key factor contributing to the difference between the condition and
the criteria.
8.128 The elements needed for a finding are related to the objectives of
the audit. Thus, a finding or set of findings is complete to the extent that
the audit objectives are addressed and the report clearly relates those
objectives to the elements of a finding. For example, an audit objective
may be to determine the current status or condition of program operations
or progress in implementing legislative requirements, and not the related
8.131 When the audit objectives include estimating the extent to which a
program has caused changes in physical, social, or economic conditions,
“effect” is a measure of the program’s impact. In this case, effect is the
extent to which positive or negative changes in actual physical, social, or
economic conditions can be identified and attributed to the program.
78The COSO Framework and the Green Book provide suitable and available criteria
against which management may evaluate and report on the effectiveness of the entity’s
internal control. The Green Book may be adopted by entities beyond those federal entities
for which it is legally required, such as state, local, and quasi-governmental entities, as
well as other federal entities and not-for-profit organizations, as a framework for an
internal control system.
Audit Documentation
Requirements: Audit Documentation
Availability of Individuals and Documentation
Requirement: Availability of Individuals and Documentation
a) No – Document.
Chapter 9: Reporting Standards for
Performance Audits
9.01 This chapter contains reporting requirements and guidance for
performance audits conducted in accordance with generally accepted
government auditing standards (GAGAS). Reporting requirements
establish the auditors’ overall approach for communicating the results of a
performance audit. For performance audits conducted in accordance with
GAGAS, the requirements and guidance in chapters 1 through 5 and
chapter 8 also apply.
Reporting Auditors’ Compliance with GAGAS
Requirements: Reporting Auditors’ Compliance with GAGAS
9.03 When auditors comply with all applicable GAGAS requirements, they
should use the following language, which represents an unmodified
GAGAS compliance statement, in the audit report to indicate that they
conducted the audit in accordance with GAGAS:
Report Format
Requirements: Report Format
9.07 Auditors should issue the audit report in a form that is appropriate for
its intended use, either in writing or in some other retrievable form.79
Application Guidance: Report Format
9.08 The purposes of audit reports are to (1) clearly communicate the
results of audits to those charged with governance, the appropriate
officials of the audited entity, and the appropriate oversight officials and
(2) facilitate follow-up to determine whether appropriate corrective actions
have been taken.
9.09 Auditors may present audit reports using electronic media through
which report users and the audit organization can retrieve them. The
users’ needs will influence the form of the audit report. Different forms of
audit reports include written reports, letters, briefing slides, or other
presentation materials.
Report Content
Requirements: Report Content, Including Objectives, Scope, and
Methodology
79See paras. 9.56 through 9.67 for a discussion of report distribution and reporting
confidential or sensitive information.
9.10 Auditors should prepare audit reports that contain (1) the objectives,
scope, and methodology of the audit; (2) the audit results, including
findings, conclusions, and recommendations, as appropriate; (3) a
summary of the views of responsible officials; and (4) if applicable, the
nature of any confidential or sensitive information omitted.
9.12 Auditors should describe the scope of the work performed and any
limitations, including issues that would be relevant to likely users, so that
report users can reasonably interpret the findings, conclusions, and
recommendations in the report without being misled. Auditors should also
report any significant constraints imposed on the audit approach by
information limitations or scope impairments, including denials of, or
excessive delays in, access to certain records or individuals.
9.13 In describing the work performed to address the audit objectives and
support the reported findings and conclusions, auditors should, as
applicable, explain the relationship between the population and the items
tested; identify entities, geographic locations, and the period covered;
report the kinds and sources of evidence; and explain any significant
limitations or uncertainties based on the auditors’ overall assessment of
the sufficiency and appropriateness of the evidence in the aggregate.
Application Guidance: Report Content, Including
Objectives, Scope, and Methodology
9.15 Report users need information regarding the audit objectives, scope,
and methodology to understand the purpose of the audit; the nature and
extent of the audit work performed; the context and perspective regarding
what is reported; and any significant limitations in the audit objectives,
scope, or methodology.
9.17 The auditor may use the report quality elements of accurate,
objective, complete, convincing, clear, concise, and timely when
developing and writing the audit report as the subject permits.
e. Clear: Clarity means the report is easy for the intended user to
read and understand. Preparing the report in language as clear
and simple as the subject permits assists auditors in achieving this
goal. Use of straightforward, nontechnical language is helpful to
simplify presentation. Defining technical terms, abbreviations, and
acronyms that are used in the report is also helpful. Auditors may
Reporting Findings, Conclusions, and Recommendations
Requirements: Reporting Findings, Conclusions, and
Recommendations
9.19 Auditors should report conclusions based on the audit objectives and
the audit findings.
9.22 When reporting on the results of their work, auditors should disclose
significant facts relevant to the objectives of their work and known to them
that if not disclosed could mislead knowledgeable users, misrepresent the
results, or conceal significant improper or illegal practices.
9.24 The extent to which the elements for a finding are developed
depends on the audit objectives. Clearly developed findings assist
management and oversight officials of the audited entity in understanding
the need for taking corrective action.
9.27 Report conclusions are logical inferences about the program based
on the auditors’ findings, not merely a summary of the findings. The
strength of the auditors’ conclusions depends on the persuasiveness of
the evidence supporting the findings and the soundness of the logic used
to formulate the conclusions. Conclusions are more compelling if they
lead to recommendations and convince a knowledgeable user of the
report that action is necessary.
Reporting on Internal Control
Requirements: Reporting on Internal Control
9.29 When internal control is significant within the context of the audit
objectives, auditors should include in the audit report (1) the scope of
their work on internal control and (2) any deficiencies in internal control
that are significant within the context of the audit objectives and based
upon the audit work performed.
9.30 If some but not all internal control components are significant to the
audit objectives, the auditors should identify as part of the scope those
9.31 When auditors detect deficiencies in internal control that are not
significant to the objectives of the audit but warrant the attention of those
charged with governance, they should include those deficiencies either in
the report or communicate those deficiencies in writing to audited entity
officials. If the written communication is separate from the audit report,
auditors should refer to that written communication in the audit report.
Reporting on Noncompliance with Provisions of Laws,
Regulations, Contracts, and Grant Agreements
Requirements: Reporting on Noncompliance with Provisions of
Laws, Regulations, Contracts, and Grant Agreements
Reporting on Instances of Fraud
Requirements: Reporting on Instances of Fraud
80See paras. 8.27 through 8.29 for a discussion of investigations or legal proceedings.
9.42 Whether a particular act is, in fact, fraud may have to await final
determination by a court of law or other adjudicative body.81
9.43 When auditors detect instances of fraud that do not warrant the
attention of those charged with governance, the auditors’ determination of
whether and how to communicate such instances to audited entity
officials is a matter of professional judgment.
Reporting Findings Directly to Parties outside the Audited
Entity
Requirements: Reporting Findings Directly to Parties outside the
Audited Entity
81See paras. 8.27 through 8.29 for a discussion of investigations or legal proceedings.
9.49 Internal audit organizations do not have a duty to report outside the
audited entity unless required by law, regulation, or policy.
Obtaining the Views of Responsible Officials
Requirements: Obtaining the Views of Responsible Officials
9.50 Auditors should obtain and report the views of responsible officials of
the audited entity concerning the findings, conclusions, and
recommendations in the audit report, as well as any planned corrective
actions.
Application Guidance: Obtaining the Views of
Responsible Officials
9.54 Providing a draft report with findings for review and comment by
responsible officials of the audited entity and others helps the auditors
develop a report that is fair, complete, and objective. Including the views
of responsible officials results in a report that presents not only the
auditors’ findings, conclusions, and recommendations, but also the
perspectives of the audited entity’s responsible officials and the corrective
actions they plan to take. Obtaining the comments in writing is preferred,
but oral comments are acceptable. In cases in which the audited entity
provides technical comments in addition to its written or oral comments
on the report, auditors may disclose in the report that such comments
were received. Technical comments address points of fact or are editorial
in nature and do not address substantive issues, such as methodology,
findings, conclusions, or recommendations.
Report Distribution
Requirements: Report Distribution
Application Guidance: Report Distribution for External
Auditors
9.60 Making an audit report available to the public can involve auditors
posting the audit report to their publicly accessible websites or verifying
that the audited entity has posted the audit report to its publicly accessible
website.
Reporting Confidential or Sensitive Information
Requirements: Reporting Confidential or Sensitive Information
Application Guidance: Reporting Confidential or Sensitive
Information
9.64 If the report refers to the omitted information, the reference may be
general and not specific. If the omitted information is not necessary to
meet the audit objectives, the report need not refer to its omission.
Discovery of Insufficient Evidence after Report
Release
Requirement: Discovery of Insufficient Evidence after Report
Release
9.68 If, after the report is issued, the auditors discover that they did not
have sufficient, appropriate evidence to support the reported findings or
conclusions, they should communicate in the same manner as that used
to originally distribute the report to those charged with governance, the
appropriate officials of the audited entity, the appropriate officials of the
entities requiring or arranging for the audits, and other known users, so
that they do not continue to rely on the findings or conclusions that were
not supported. If the report was previously posted to the auditors’ publicly
accessible website, the auditors should remove the report and post a
public notification that the report was removed. The auditors should then
determine whether to perform the additional audit work necessary to
either reissue the report, including any revised findings or conclusions, or
repost the original report if the additional audit work does not result in a
change in findings or conclusions.
Glossary
The following terms are provided to assist in clarifying the Government
Auditing Standards. The most relevant paragraph numbers are provided
for reference. When terminology differs from that used at an organization
subject to generally accepted government auditing standards (GAGAS),
auditors use professional judgment to determine if there is an equivalent
term.
Cause: The factor or factors responsible for the difference between the
condition and the criteria, which may also serve as a basis for
recommendations for corrective actions. (paragraphs 6.27, 7.29, and
8.126)
Inputs: The amount of resources (in terms of, for example, money,
material, or personnel) that is put into a program. These resources may
come from within or outside the entity operating the program. Measures
of inputs can have a number of dimensions, such as cost, timing, and
quality. (paragraph 8.38d)
Peer review risk: the risk that the review team (1) fails to identify
significant weaknesses in the reviewed audit organization’s system of
quality control for its auditing practice, its lack of compliance with that
system, or a combination thereof; (2) issues an inappropriate opinion on
the reviewed audit organization’s system of quality control for its auditing
practice, its compliance with that system, or a combination thereof; or
(3) makes an inappropriate decision about the matters to be included in,
or excluded from, the peer review report. (paragraph 5.68)
Scope: The boundary of the audit and is directly tied to the audit
objectives. The scope defines the subject matter that the auditors will
assess and report on, such as a particular program or aspect of a
program, the necessary documents or records, the period of time
reviewed, and the locations that will be included. (paragraph 8.10)
Acknowledgments
Comptroller General’s Advisory Council on
Government Auditing Standards (2016-2020)
Drummond Kahn, Chair
International Institute and Government Audit Training Institute
Graduate School USA
Corey Arvizu
Heinfeld, Meech & Co., P.C.
Jon Hatfield
U.S. Federal Maritime Commission, Office of the Inspector General
Philip M. Heneghan
U.S. International Trade Commission, Office of the Inspector General
Mary L. Kendall
U.S. Department of the Interior, Office of the Inspector General
Deborah V. Loveless
Tennessee Comptroller of the Treasury, Division of State Audit
Martha S. Mavredes
Auditor of Public Accounts of the Commonwealth of Virginia
Kimberly K. McCormick
Grant Thornton LLP
Amanda Nelson
KPMG LLP
Dianne Ray
Colorado Office of the State Auditor
Harriet Richardson
City of Palo Alto
Randy C. Roberts
Arizona Office of the Auditor General
Brian A. Schebler
RSM US LLP
Ronald Smith
RHR Smith & Company CPAs
GAO Project Team
James R. Dalkin, Director
Kristen A. Kociolek, Assistant Director
Christie A. Pugnetti, Auditor in Charge
Michael F. Bingham, Senior Auditor
Mary Ann Hardy, Senior Auditor
Rebecca A. Riklin, Senior Auditor
Staff Acknowledgments
In addition to the project team named above, also contributing were Mark
Cheung, Clayton T. Clark, Oliver A. Culley, Francine M. DelVecchio,
Vincent Gomes, John R. Grobarek, Sean P. Joyce, Jason M. Kelly,
Delores J. Lee, Aaron M. Livernois, Quang D. Nguyen, Grant L.
Simmons, Adrienne N. Walker, Kimberly Y. Young, and Matthew P. Zaun.
(101971)
Page 224 GAO-18-568G Government Auditing Standards
Acknowledgments
GAO’s Mission
The Government Accountability Office, the audit, evaluation, and investigative
arm of Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of the
federal government for the American people. GAO examines the use of public
funds; evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make informed
oversight, policy, and funding decisions. GAO’s commitment to good government
is reflected in its core values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony
The fastest and easiest way to obtain copies of GAO documents at no cost is
through GAO’s website (https://www.gao.gov). Each weekday afternoon, GAO
posts on its website newly released reports, testimony, and correspondence. To
have GAO e-mail you a list of newly posted products, go to https://www.gao.gov
and select “E-mail Updates.”
Order Printed Copies
The printed version of the Government Auditing Standards 2018 Revision can be
ordered through the Government Printing Office (GPO) online
http://bookstore.gpo.gov/ or by calling 202-512-1800 or 1-866-512-1800 toll free.
Connect with GAO
Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.
To Report Fraud, Waste, and Abuse in Federal
Programs
Contact:
Website: https://www.gao.gov/fraudnet/fraudnet.htm
Automated answering system: (800) 424-5454 or (202) 512-7470
Congressional Relations
Orice Williams Brown, Managing Director, [email protected], (202) 512-4400,
U.S. Government Accountability Office, 441 G Street NW, Room 7125,
Washington, DC 20548
Public Affairs
Chuck Young, Managing Director, [email protected], (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, DC 20548
Strategic Planning and External Liaison
James-Christian Blockwood, Managing Director, [email protected], (202) 512-4707
U.S. Government Accountability Office, 441 G Street NW, Room 7814,
Washington, DC 20548