Blog Archives - Page 32 of 62 - Yellowbook-CPE.com

When I review audit documentation, I don’t care about grammar, spelling, color, or hyperlinks. I ignore all of that petty detail because it keeps me focused on the minutia instead of the big picture.

What I am looking for is how the key elements of the audit fit together and whether the audit documentation tells an interesting story about how you got from your vague audit assignment to your findings and conclusions.

Key pieces of the audit documentation should link to each other

Audits tend to double back on themselves and can feel quite chaotic as you work through them. No audit is perfectly linear.

However, chaos is NOT the feeling you want to convey to the reviewer of your audit documentation! Instead, lead the reviewer through a logical, organized story.

First explain to the reviewer what your initial audit assignment was and why it was deemed worthy of your team’s time.

Then describe in your audit documentation:

The research performed to understand the audit subject
The filters you applied to remove boring or irrelevant subject matter so that the team could focus on the good stuff
The revised, finite objectives(s) the team is seeking to answer
The audit methodologies you used to answer the objective(s)
The findings that result from performing the methodologies
The conclusion(s) that answer the finite objective(s)

All of the items on that list should connect and flow. Some auditors actually have a formal title for this relationship: linkage.

Audit documentation is very idiosyncratic and therefore I can’t recommend exactly what linkage should look like. I just know that I need to find it somewhere. Maybe it is in a few key memos or audit programs. Maybe it is in a lead sheet.

Just, please, don’t make your reviewer hunt for it! Make the location of all of these pieces – and how they link to each other – obvious.

Consider these two quotes from the GAO’s Yellow Book

GAGAS tells us which pieces of our audit documentation should support each other in these two paragraphs:

8.35 A written audit plan provides an opportunity for audit organization management to supervise audit planning and to determine whether

a. the proposed audit objectives are likely to result in a useful report;

b. the audit plan adequately addresses relevant risks;

c. the proposed audit scope and methodology are adequate to address the audit objectives;

d. available evidence is likely to be sufficient and appropriate for purposes of the audit; and

e. sufficient staff, supervisors, and specialists with adequate collective professional competence and other resources are available to conduct the audit and to meet expected time frames for completing the work.

AND

8.06 Auditors should design the methodology to obtain sufficient, appropriate evidence that provides a reasonable basis for findings and conclusions based on the audit objectives and to reduce audit risk to an acceptably low level.

A GAGAS audit puts you on the front line of the never-ending fight for good government. Government auditors are powerful and knowledgable, but not everyone knows that.

I imagine that you, like me, have listened patiently while your brother-in-law spouts off about how stupid government is. Half of what he says is off-base, and he clearly doesn’t understand how government works and what government is about.

The next time he has a few drinks at a family get-together and starts his rant, you could interrupt him and give him some schooling. Of course, it may not be worth it to poke a drunk bear, but just in case you decide to take him on one day, I want to arm you with some conceptual ammunition that might shut him up for a while.

Our work is noble

First of all, our work is pretty cool. Noble, in fact.

One wise city auditor told me that his life’s mission was to make sure that citizens who do not have a voice or power are taken care of. Can your brother-in-law say that about his job?

Here is what Gene Dedaro, the head of the GAO, says in his introductory letter to GAGAS:

Audits provide essential accountability and transparency over government programs. Given the current challenges facing governments and their programs, the oversight provided through auditing is more critical than ever. Government auditing provides the objective analysis and information needed to make the decisions necessary to help create a better future. The professional standards presented in this 2018 revision of Government Auditing Standards (known as the Yellow Book) provide a framework for performing high-quality audit work with competence, integrity, objectivity, and independence to provide accountability and to help improve government operations and services. These standards, commonly referred to as generally accepted government auditing standards (GAGAS), provide the foundation for government auditors to lead by example in the areas of independence, transparency, accountability, and quality through the audit process.

I love knowing that my job, as tedious as it can be sometimes, has a higher purpose and meaning.

Government should NOT run like a corporation

I get especially irritated when I hear people say that government should run like a corporation. Uh, NO…brother-in-law, you really don’t want that because corporations hide information and are in it to make a profit.

If you work for Apple, it makes sense to keep your actions and progress secret so that you beat your competitors to the market.

But we don’t want our government officials to be secretive. Both government officials and auditors should be open about what they are doing and why they are doing it.

For instance, the City of Austin discloses budgets and transactions of all City departments online in real time. I can, with a few clicks of the mouse, see that the Police Department bought a van, how much the van was, who they bought it from, why they need it, and what color of funds (general revenue, special revenue, enterprise revenues) paid for it.

“Why bother with all that?” your brother-in-law may say. Because that is our money – the taxpayer’s money – and we all have a right to know what it is being used for!

And then you can point out that he would not like it if his government treated him like a corporation treats its customers. A corporation only courts customers when they want more moola (maybe so the executives can renovate their mansions in the Hamptons!).

Instead, the customer of a government program may be a child who has no money at all. In government, it isn’t all about the money; it’s about service!

GAGAS audits help the children.

On a GAGAS audit, auditors are checking to see whether tax dollars are being used for their intended purpose and whether the public is being served by the auditee’s efforts.

Consider this quote from the 2018 Yellow Book: GAGAS 3.08 A distinguishing mark of an auditor is acceptance of responsibility to serve the public interest. This responsibility is critical when auditing in the government environment. GAGAS embodies the concept of accountability for public resources, which is fundamental to serving the public interest.

Good government isn’t self concerned

Recently on TV news, I saw a high school coach (who I consider to be a government official) whining about the death of one of his teenage football players. The coach was responsible for the death because he made the teenager run laps in 100 degree heat and refused him water. Instead of being contrite, the coach said something like, “Everyone is forgetting that I suffered a loss, too, and that I will hold on to this for the rest of my life.”

That is not exactly what the parents of that boy wanted to hear. He deflected accountability for the accident and tried to engender empathy for himself. YUCK.

The GAO does everything they can to fight this self-centered approach to governing. Accountability is the anecdote for selfishness. And GAGAS repeatedly reminds us that government officials are accountable to the taxpaying public for their actions and that we, as auditors, have a crucial role in holding government leaders accountable.

1.02 The concept of accountability for use of public resources and government authority is key to our nation’s governing processes.

1.05 Government auditing is essential in providing accountability to legislators, oversight bodies, those charged with governance, and the public.

But just to be clear, GAGAS audit standards are not written for government officials (although government officials are mentioned a few times); they are written for auditors.

So, while we auditors hold public officials and employees accountable for their actions, we are held accountable for our actions, too. We have to model the behavior that we expect from our auditees. Otherwise, we lose credibility and influence. For example, GAGAS auditors are required to disclose whether they followed every ‘must’ and ‘should’ audit requirement and list the requirements that they did not follow in the audit report.

Be proud of what you do for all of us

So, next time your brother-in-law starts popping off, you can inform him that you are a proud member of a profession that is trying to take care of the issues that he lectures about every time he has a few beers in him. This will open the door for you to go on a little rant of your own about government accountability, transparency, and service. Then you can drop the mic and leave him stunned with his mouth gaping open.

It could happen.

Auditors apply multiple types of reasoning as they seek the truth. But some auditees don’t agree with our version of the truth!

Maybe some of the conflict occurs because we are using a different type of reasoning than the auditee.

I don’t really see it that way!

We all have a preferred reasoning style – a way that we get to the truth – and what passes for truth has evolved over time.

Let’s cover how the definition of truth has evolved over time and define five common types of reasoning. Then I’ll give you an example of how each of these five most common types of reasoning (or truth-seeking techniques) can be applied to an audit.

Five types of reasoning

The first formally recognized method of uncovering the truth was called “rationalism.” In rationalism, if you can imagine it, it can exist. For example, clothes on any given group of people will range in color and a good number of people will be wearing red. You can rationalize that because there are so many variations on red, there has to be a “master” or “perfect” red in existence. You can see the limits of this way of thinking. Just because you can guess that something should be there does not mean it is there.
Then came empirical reasoning. In empirical reasoning, you begin with a hypothesis and then you gather evidence or experiment to support your hypothesis. This is the most common method used by scientists in their work. There is a limit to this kind of thinking also, as your hypothesis might be flawed or your experimentation method might be limited. For instance, cancer researchers are working to prove a handful of hypotheses — some of them being that cancer is a virus and some of them being that cancer is genetic. Both hypotheses have supporting evidence.
Then you have existential reasoning. This type of reasoning says that my version of the truth will be different than your version of the truth because we see reality through different lenses or experiences. Therefore, all truth is relative. In essence, existential reasoning says, “My version of the truth is as good as yours.”
Ethical reasoning asks that you determine what you value most and then weigh decisions based on what you value. If you value human life above justice, then the death penalty is wrong. If you value justice above human life, then the death penalty is acceptable.
And then the last form of reasoning is revealed reasoning, or reasoning based on trust and faith. Because you trust or believe in the source of the information, you believe in what the source says. This is the kind of reasoning necessary to believe religious truths. This is also the sort of reasoning we rely upon when we listen to the opinions of a political pundit on cable news. If Rachel Maddow or Rush Limbaugh speak it, it must be true… we trust them, right?

What type of thinking do auditors use?

I’ve seen auditors use all of these types of reasoning. If auditors are crafty they will use several types in their audit reports! The more types of reasoning we use, the more likely we are to sway the auditee.

Let’s look at an example that centers around one of an auditor’s favorite internal controls: cash reconciliations.

Empirical Reasoning

Auditors lean on this type of reasoning quite a bit.

For instance, if we want to prove that the cash reconciliations are not being done, we start with the hypothesis that cash reconciliations are not performed monthly. Then we gather evidence by testing to see if reconciliations were performed every month. If we find that for 6 out of 12 months tested that reconciliations were not performed, we have proved, empirically, that our hypothesis was correct.

Rational Reasoning

In order to make sure that reconciliations are performed in the future (which is our true goal), we could recommend that the supervisor reviews the reconciliations each month. The supervisor’s review isn’t the key control, but it is a related control that will help ensure that the key control (reconciliations) are in place. That’s just common sense, right? Perfectly rational.

Revealed Reasoning

Revealed reasoning is based on the credibility of the source of the truth. One of the most persuasive tools we auditors have at our disposal is the audit finding. And our audit findings should include a criteria established by an authority that the client also sees as an authority, like an oversight body or the federal government. That way, the auditee can’t shrug off our recommendation that they reconcile cash because someone higher up the food chain requires them to.

But let’s say that there isn’t a third-party authority that requires our auditee to perform cash reconciliations. Then it will be important for us to maintain our professional credibility so that we auditors are seen as a relevant and reliable source of the truth. The Yellow Book says:

GAGAS 2018 3.03 Auditors and audit organizations must maintain independence so that their opinions, findings, conclusions, judgments, and recommendations will be impartial and viewed as impartial by objective third parties with knowledge of the relevant information. Auditors should avoid situations that could lead objective third parties with knowledge of the relevant information to conclude that the auditors are not able to maintain independence and thus are not capable of exercising objective and impartial judgment on all issues associated with conducting the audit and reporting on the work.

Ethical Reasoning

Yes, the accounting manager might be right. This finding you are proposing on reconciliations could hurt his career, and he values his job.

However, our job as auditors is to let those in charge of governance know when key controls are not working. Auditors usually value accuracy and the preservation of the organization’s financial resources above any one person’s career.

So, we use ethical reasoning to justify our choice to report in spite of the audit manager’s protests.

Existential Reasoning

Although from the accounting manager’s point of view, reconciling an account that only has 45 transactions a month is not worth his staff’s time, you identified it as a material weakness in your risk assessment because your audit objective was focused on this particular cash account.

From the audit manager’s viewpoint this issue isn’t worth the attention of those charged with governance. But you chose this account to audit because it is connected with a brand new federal grant.

Your version of the truth is different than the auditee’s version of the truth and you may never agree. How existential!

Throw them all out there to see which one sticks

So if you do encounter resistance to your ideas, try these types of reasoning one by one until you see what sticks. In theory (rational reasoning, yet again!) you should get less resistance from the auditee if you use several types of reasoning to make your key points.

Living the dream! Low effort, high yield! There is gold in them there hills!

I get calls from CPAs in public practice every so often. They heard a rumor that auditing government programs is lucrative and they see gold in them there hills!

But an audit of government grants is pretty darn involved and I feel like I should warn them of a few things before they start cultivating a new client base.

If you are still reading, that means that I am warning YOU. So here goes:

Warning! You have to follow the Yellow Book to audit government grants

I regularly teach full day seminars on Yellow Book standards (which by the way, you are going to have to follow!) and at about 1 o’clock, the attendees start grousing about getting out of government auditing.

I even had one woman in San Francisco stand up and offer her only government client to anyone who was interested – because she was D.O.N.E.! It was like a live e-bay auction. Another CPA took her card and agreed to take over for her. She was thrilled.

What is the Yellow Book anyway? It is also known as Generally Accepted Government Auditing Standards or GAGAS. (How is that for an attractive acronym?!?) The Yellow Book is written by the Government Accountability Office, the legislative auditor for the federal government.

Three layers of standards

Here is how the standards stack up: The Uniform Guidance requires that Single Audits be conducted in accordance with GAGAS. Inside GAGAS, the Single Audit is classified as a financial audit. Financial auditors must follow Yellow Book as well as the AICPA SASs.

So, did you catch that? In order to do the Single Audit, you follow three layers of standards and audit requirements:

1. The Single Audit requirements

2. GAGAS

3. The AICPA’s SASs

Whew, I am tired just thinking about it!

This wasn’t that big a deal when I started conducting Single Audits in the late ’80s. All three standard-setting bodies were slow-moving and quiet before the Enron debacle at the turn of the century. Since then, the AICPA and GAO standards have been in a constant state of flux. The Uniform Guidance even got updated! While all that change is great for my business as an instructor, it isn’t so great for practitioners.

What is so tough about the Yellow Book?

Here are a few things that trigger a “You’ve got to be kidding!?!” response from the participants in my Yellow Book seminars:

1. Specific training: GAGAS requires auditors to get 80 hours of training that enhances their ability to conduct audits every two years. Out of this 80 hours, 24 of it must be in government topics or topics relevant to your audit environment. This means that your tax update or estate planning courses won’t count!

2. Extra nagging regarding independence: While the GAO doesn’t specifically prohibit auditors from creating financial statements for their audit clients, they definitely don’t like it. The GAO puts up as many barriers as they can to prevent auditors from both creating and auditing financial statements.

This causes lots of angst during my seminars because auditors believe three things:

1. Their tiny client can’t create the financials or won’t pay for a third party to prepare them.
2. The client expects the auditor to do it.
3. The auditor’s life is easier if they create the financials they end up auditing.

Unfortunately, the GAO isn’t exactly sympathetic to any of those views. But just like a nagging but ineffective parent of teenagers, they are always talking but never putting their foot down or taking the keys to the car. This is something to keep your eye on when each revision comes out.

3. The GAO isn’t happy just hearing about symptoms; they want a diagnosis of the root cause. In order to enhance transparency and accountability in government, GAGAS asks that auditors don’t stop at simply pointing out flaws in the client’s operations or in compliance. The GAO wants to know why the flaw occurred, whether it is a big deal, and what should be done about it.

The GAO asks auditors to describe the elements of a finding (condition, effect, cause, criteria, recommendation) in their audit report. This causes extra work for the auditor, because the effect and root cause don’t usually present themselves to the auditor on a silver platter.

If all that sounds OK to you, great. Maybe you could make some money if you audit government grants.

But I don’t recommend playing the middle and just dabbling in government auditing. You are really going to have to know your stuff because the grantees (being governments that are tasked with preserving public resources) have to go out for bid each time they choose an auditor. That means that in order to make a profit, you are going to have to run lean and mean to beat out your competitors while simultaneously meeting all the regulatory expectations.

Most practitioners decide to either make government auditing a significant part of their practice or walk away from it all together.

Just don’t ever say I didn’t tell you.

If you don’t actively work at avoiding scope creep in project management, scope creep can get the better of you and your audit team. Let me tell you a little story about that.

Once upon a time… an audit manager asked me to help her figure out why her team of five auditors was getting such inconsistent results.

One of the auditors could really crank out the projects. She, single-handedly, completed half of the team’s audit plan each year and created the resulting reports. Another of the auditors completed only two projects each year and the resulting reports were painful for the audit manager to edit. The other three members of the team were somewhere in the middle of these two extremes.

The audit manager’s main question for me was, “What do I do to get my slower auditors to crank out their projects faster?” In her question, I could hear her frustration and knew that she was blaming the senior auditor for being so slow.

After working with the team for a few hours, it was evident what was happening. The faster auditor was able to focus on very specific issues as a result of doing a risk assessment up front. Her audit objectives were very tight and limited. She did not look at everything in an area; she looked at one or two things. She turned in multiple deliverables along the way and sought approval for her audit plan from the audit manager before she began her work and kept the audit manager informed as the work progressed.

The slower auditor, although a more senior auditor, was very slow to wrap up projects. Once he would delve into an area, he seemed to get lost in the vastness of the topic and see a myriad of options for getting the work done. Because he was a senior auditor and a little introverted, he did not like to check in with the audit manager for feedback. He worked completely independently and was hesitant to show the working papers and the report to the audit manager until he was sure both were perfect.

This usually meant that the audit manager didn’t have a clue what was going on with the project until the very end of the project, when it was much too late to redirect the auditor. At the end of the year, this senior auditor was super stressed out because the audit manager was pressuring him to get the projects done so that the audit director could report a completed project to the audit committee.

Maybe you are thinking to yourself, like the audit manager, that the slower auditor is at fault in this story. But I didn’t see it that way. Although the audit manager was not purposely setting her auditors up for failure, her inaction was allowing it.

By applying these five tips for avoiding scope creep in project management, the audit manager eventually succeeded in creating the interesting reports that her boss wanted without wasting the resources her audit shop was given.

Tip 1 – Set a limit

The manager didn’t want to set deadlines because it put pressure on her team and that didn’t feel good to anyone. Setting deadlines wasn’t nice and she wanted to be nice.

But, she had to admit that it also wouldn’t be nice if her boss found out that she was wasting audit resources on bloated projects.

The manager realized after a few months that setting tighter deadlines helped her team be more creative and selective about the issued they pursued, which also made the audit reports more interesting.

Tip 2 – Bite off only what you can chew

How do you eat an elephant? One bite at a time? OK – hold on… that is a terrible question. Auditors do not have time to eat an elephant!

There are too many animals in the jungle that need our attention and audit teams cannot spend their precious, limited time on just one elephant.

Too big to eat – even one bite at a time!

Instead, the manager started requiring her team members to pick out just a few things that concerned them on the assigned elephant and then she set a clear expectation that the team member only focus on those few things. This then allowed them to quickly move on to their next assignment. (You know, the lions, the tigers, the bears! Oh my!)

Tip 3 – Focus on the bones

Stephen Covey advises us to begin with the end in mind. So the audit manager started writing down the bones of the the audit as soon as the team finished the risk assessment.

What are the bones? The bones are the:

Master objectives and subjectives
Outlines of the related findings
Evidence gathering techniques for the condition, effect, and cause of the finding outlines as well as the overall conclusion

She kept the bones visible to her team at all times and every time someone wanted to go off on a tangent, she asked them how that would impact the bones and thus the final audit report.

Tip 4 – Just say no

Once the bones were developed, the project manager got tough. When the client and staff came up with requests and ideas that would expand the scope of the project, she said no.

And if the client or the team member kept insisting, she explained the extra cost to them and asked them if they thought the extra cost was truly worth it. If they still insisted, she asked them to sacrifice something that was important to them so the audit could be expanded – like some funding or another audit project. Once she went as far as to suggest that the auditor forgo the vacation they were planning so the team could get the audit out on time. Usually, they acquiesced.

Tip 5 – Require deliverables

The propensity of all humans (not just auditors) to wander off on a tangent trying to satisfy their curiosity is just too real to ignore. You can’t just set an auditor on a path and expect them to stay on it.

The audit manager did not want to micromanage or hover over her auditors. So, she simply asked them to turn in deliverables – like audit programs, risk assessments, individual working papers – by certain dates. That way she didn’t get as many nasty surprises at the end of the audit and then have to send the auditor back to the planning phase, thereby doubling the size of the elephant!

Once the director used these basic principles for avoiding scope creep in project management – setting time and scope limits, requiring her team to develop and focus on the bones, and making unpleasant (but necessary) decisions to keep the project on track – she was able to turn an auditor that she viewed as a problem into a true asset to the team. And on top of that, she was able to create a higher number of interesting audit reports each year.

Audit documentation should LINK!

Key pieces of the audit documentation should link to each other

Consider these two quotes from the GAO’s Yellow Book

Follow us!

Blog

Key pieces of the audit documentation should link to each other

Consider these two quotes from the GAO’s Yellow Book

This picture may help

Our work is noble

Government should NOT run like a corporation

Good government isn’t self concerned

Be proud of what you do for all of us

Five types of reasoning

What type of thinking do auditors use?

Empirical Reasoning

Rational Reasoning

Revealed Reasoning

Ethical Reasoning

Existential Reasoning

Throw them all out there to see which one sticks

Warning! You have to follow the Yellow Book to audit government grants

Three layers of standards

What is so tough about the Yellow Book?

Tip 1 – Set a limit

Tip 2 – Bite off only what you can chew

Tip 3 – Focus on the bones

Tip 4 – Just say no

Tip 5 – Require deliverables

Subscribe to Updates

Footer

Follow us!