Government Auditing Standards System Administration Internal Audit Committee March 1, 2007

Auditing Standards Auditors’ report states standards followed: Public issuers – PCAOB Generally accepted (Nonpublic) – AICPA Government (Yellow Book) – GAO Internal Audit (Red Book) – IIA

Yellow Book Application The Yellow Book is applicable to: Audits of federal entities Where required by federal agency or regulation (OMB A-133) Where required by law (Texas Internal Auditing Act) Where voluntarily adopted

Red vs. Yellow What is the difference between the Red Book and the Yellow Book? About 200 pages!

Red vs. Yellow Purpose of the Red Book (emphasis on audit’s role in helping the organization improve): Sets forth basic principles of internal auditing and elements of an audit function Provides framework for performance of a wide range of auditing and consulting activities Establishes basis for evaluation of internal audit activities through peer reviews Focuses on improved organizational processes and operations

Red vs. Yellow Purpose of the Yellow Book (emphasis on serving the public): Provides a framework for conducting high quality audits with “competence, integrity, objectivity, and independence” Emphasizes auditor ethics, independence, performance of fieldwork, and reporting language Standards are specific and “mandatory”

Red vs. Yellow Yellow Book is more prescriptive: Peer reviews Training Independence: allowable and unallowable activities Documentation and audit policies Report language

Yellow Book Sections Ethical principles General standards Independence Audit quality control (peer reviews) Professional judgment Competence of staff; training Specific standards Financial audit fieldwork and reporting Attestation engagement fieldwork and reporting Performance audit fieldwork and reporting

Ethics New section for 2008 Provides guidance for audit’s responsibility relating to: Serving the public Maintaining integrity, objectivity and independence Using government information, resources, and position Acting in a professional manner

Independence Standard “In all matters relating to the audit work, the audit organization and the individual auditor, whether government or public, should be free both in fact and appearance from personal, external, and organizational impairments to independence.”

Overarching Principles Independence requirement is principles-based with two overarching principles: Auditors should not perform management functions or make management decisions; and Auditors should not audit their own work or provide non-audit services in situations where the amounts or services involved are significant/material to the subject matter of the audit.

Personal Impairments Audit organizations must be alert to personal impairments that might: Limit the extent of the inquiry Limit disclosure Weaken or slant audit findings

Personal Impairments Internal quality control system is required to determine if auditors have any personal impairments to independence. Auditor is responsible for notifying appropriate officials within audit organization if they have any personal impairments.

Personal Impairments Principles for consideration of nonaudit services: Audit organizations should not provide nonaudit services that involve performing management functions or making management decisions. Audit organizations should not audit their own work or provide nonaudit services in situations where the nonaudit services are significant/material to the subject matter of audits.

External Impairments External impairments occur when an auditor is deterred from acting objectively and exercising professional skepticism by pressures from management and employees of audited entity.

Organizational Impairments Auditor organization should be free of impairments. The auditor organization is the placement of the auditor within the government.

Other General Standards Audit quality control – requires peer reviews: Every three years Knowledge of Yellow Book by team Professional judgment Requires exercise of care and skepticism Ensures quality audit methodology Competence of staff 80 CPE hours required every two years Knowledge of audit required before start of fieldwork

Specific Standards Fieldwork and reporting standards for different audit-services: Financial audits in accordance with GAAP Attestation engagements (e.g., NCAA agreed-upon procedures) Performance audits (most internal audits) Exploring potential to opt out of applying fieldwork and reporting standards as long as general standards are not violated.

Application to UT System Requirements for following Yellow Book have been discussed with internal audit directors. Audit directors have begun the process of becoming fully-compliant. Peer reviews should begin to assess compliance. Lack of compliance should be disclosed. More changes to Yellow Book are expected as changes to AICPA and PCAOB standards are enacted – making it more difficult for internal auditors to serve their organizations in ways they have done in the past.