1. The 2007 Yellow Book: What a Beginner Needs to Understand
A Governmental Audit Quality Center Web Event
February 9, 2011

2. Administrative Notes
If you encounter any technical difficulties (e.g., audio issues) during this event please take the following steps:
Press the F5 key on your computer to refresh
Close and re-start your browser
Check your speakers, ensure they are not on mute
Turn off your pop-up blocker
Re-start you computer
Call InterCall/Genesys Tech support , Conf ID#
If none of the above work, submit a request for help on the “Ask a Question Box” located on the left hand side of your screen.
If are unable to get assistance from InterCall/Genesys for some reason, or call

3. Administrative Notes
We encourage you to submit your technical questions – please limit your questions to the content of today’s program
To submit a question, type it into the “Ask a Question” box on left side of your screen; we will answer as many as possible
You can also submit questions to the GAQC member forum for consideration by other members
This event is being recorded and will be posted in an archive format to the GAQC Web site

4. Continuing Professional Education
Must have registered for CPE credit prior to this event; a link to the CPE Credit Approval Form was ed to you
Listen for announcement of 4 CPE codes (7 digit codes: ALL_ _ _ _ ) and 4 polling questions during the event
Record CPE Codes on CPE Credit Approval Form and return completed form (by fax or mail) to AICPA Service Center for record of attendance; keep a copy for your records
If you are not receiving CPE for this call, ignore the CPE codes that we announce, but please answer the polling questions

5. Presenters Flo Ostrum, CPA Grant Thornton LLP Brian Schebler, CPA McGladrey & Pullen, LLP   Moderating: Mary Foelster, CPA AICPA - GAQC

6. Background Why are we hosting this event?
Proliferation of federal agencies beginning to require that for-profits undergo financial audits under Government Auditing Standards and compliance audits
Several federal agencies involved and differing types of for-profit entities
Many of the requirements are effective now for the first time

7. Examples of New Federal Requirements
Housing and Urban Development (HUD) - Supervised Mortgagees (Depository Institutions)
Financial statement audit under Government Auditing Standards and compliance audit using the Consolidated Audit Guide for Audits of HUD Programs (HUD Guide)
Effective now!
See GAQC Alert #159 (available at
Commerce and Agriculture – Telecommunications Companies and Broadband Providers
Awards relate to expansion of broadband technology
Program-specific audit of federal awards and related compliance audit using program-specific guidance (currently under development)

8. Examples of New Federal Requirements
Energy – Electric Utilities, Automotive Companies, Manufacturing Companies
Financial audit of schedule of Energy awards and related compliance audit using Energy program-specific guidance
Effective now – Energy guidance to be issued any day
FAQ document at:

9. What Will We Cover?
Basic overview of the requirements of the 2007 Yellow Book
Key differences between the Yellow Book and GAAS
Access to references, guidance and tools
Expected revision of the Yellow Book later in 2011

10. What Changes will a Yellow Book Engagement Require?
CPE requirements for the entire engagement team
Reporting on internal control over financial reporting and compliance
Additional independence considerations around nonaudit services
Provision of peer review report to contracting parties
There are a number of changes that will result if you have to do your audit under Government Auditing Standards. This slide just highlights a few of the more common ones you hear about. We will highlight others through the course of this presentation.

11. Basic Overview of the 2007 Yellow Book
Proper name: Government Auditing Standards, July 2007 Revision;
Commonly referred to as the Yellow Book or Generally Accepted Government Auditing Standards (GAGAS)
Issued by the Comptroller General of the United States of the U.S. Government Accountability Office (GAO)
Revised periodically

12. Content of the Yellow Book
Chapter 1: Use and Application of GAGAS
Chapter 2: Ethical Principles in Government Auditing
Chapter 3: General Standards
Chapter 4: Field Work Standards for Financial Audits
Chapter 5: Reporting Standards for Financial Audits
Chapter 6: General, Field Work, and Reporting Standards for Attestation Engagements
Chapter 7: Field Work Standards for Performance Audits
Chapter 8: Reporting Standards for Performance Audits
Appendix I: Supplemental Guidance
Appendix II: Comptroller General's Advisory Council on Government Auditing Standards
Index
*Bolded items will be covered in today’s presentation

13. Types of Audits and Attestation Engagements Covered by the Yellow Book
Financial
Financial statement audits
Other (e.g., special reports, auditing compliance, etc.)
Covered by first 5 chapters of Yellow Book
Attestation (will not be covering in today’s session)
Examination, Review, and AUP
Some federal agencies require attestation engagements for for-profits (e.g., Department of Education audit guides)
Performance (will not be covering in today’s session)
Program evaluations/program effectiveness and results audits
Economy and efficiency audits
Operational audits
The 2007 version really does not specifically address non-examination level attestation engagements (e.g., review and AUP), although it does not prohibit them to be done under the Yellow Book.

14. When Does the Yellow Book Apply?
When required (for example, by law, regulation, or contract)
Usually participation in federal programs (such as grants or loan programs) over a certain dollar threshold triggers a Yellow Book (and related compliance audit) requirement
Client may decide to voluntarily apply the Yellow Book in which case they would engage the auditor to perform the audit using those standards

15. Relationship of Yellow Book with Other Standards
AICPA field work and reporting standards are incorporated by reference for financial audits and then Yellow Book requires additional standards
Public Company Accounting Oversight Board (PCAOB) and International Auditing and Assurance Standards Board (IAASB) standards can be used in conjunction with GAGAS for financial statement audits
GAO guidance document provides guidance on using the Yellow Book with PCAOB standards (
If the auditor is citing compliance with GAGAS and inconsistencies exist between GAGAS and other standards cited, the auditor should use GAGAS as the prevailing standard for conducting the audit and reporting the results.

16. Two Categories of Professional Requirements in the Yellow Book
Use of “must” or “is required” refer to unconditional requirements for which auditors are required to comply with
Use of “should” equates to a presumptively mandatory requirement
Departure from these requirements rare
Need to provide documentation supporting justification for the departure and how an alternative procedure achieved the objective
Tool available on GAO Web site which identifies all unconditional and presumptively mandatory requirements (

17. Ethical Principles
The ethical principles guiding the work of auditors under GAGAS are:
The public interest
Integrity
Objectivity
Proper use of government information, resources, and position
Professional behavior

18. General Standards
The Yellow Book does not adopt the AICPA general standards; instead, it establishes its own
The four general standards are:
Independence
Professional judgment
Competence
Quality Control and Assurance

19. Yellow Book Independence Versus AICPA
GAAS audit = AICPA’s Code of Professional Conduct Rule 101, Independence
GAGAS audit = Yellow Book independence requirements
Some Yellow Book independence rules very similar to AICPA rules
Other Yellow Book independence rules are more stringent
AICPA has made available a comparison between the two sets of standards at:

20. Yellow Book Independence
GAGAS states that the audit organization and the individual auditor must:
Be free from personal, external, and organizational impairments to independence
Avoid the appearance of such impairments of independence.
Comprehensive independence Q&A issued by GAO and available at: (currently effective)
The Yellow Book defines certain steps an audit organization should take if an impairment to independence is identified after the audit report is issued.
The term “audit organization” refers to organizations such as CPA firms and state audit organizations.

21. Yellow Book Independence
Chapter 3 of the Yellow Book addresses when auditors their organizations are independent from the following impairments:
Personal
External
Organizational
If one or more of these impairments affects or can be perceived to affect independence, the audit organization (or auditor) should decline to perform the work
Yellow Book adopts an engagement-team-focused approach similar to AICPA Code for matters such as financial interests of an individual auditor
Personal: Relationships or beliefs that might cause auditors to limit the extent of the inquiry, limit disclosure, or weaken or slant audit findings in any way.
External: When auditors are deterred from acting objectively and exercising professional skepticism by pressures, actual or perceived, from management and employees of the audited entity or oversight organizations.
Organization: When the audit function is organizationally located within the reporting line of the areas under audit or when the auditor is assigned or takes on responsibilities that affect operations of the area under audit. This mainly applies to government auditors

22. Yellow Book Independence and Specialists
Assess the specialist's ability to perform the work and report results impartially as it relates to their relationship with the program or entity under audit
If the specialist's independence is impaired, auditors should not use the work of that specialist

23. Nonaudit Services
Need to consider the effects of any nonaudit services performed on independence for current, future, and planned audit services.
Two Overarching Principles apply to the auditor assessing the impact of performing a nonaudit service:
Should not provide nonaudit services that involve performing management functions or making management decisions; and
Should not audit own work or provide nonaudit services in situations where the nonaudit services are material to the subject matter of audit

24. Nonaudit services generally fall into one of the following categories:
Nonaudit services that do not impair the audit organization's independence
Nonaudit services that would not impair the audit organization's independence with respect to the entities it audits as long as the audit organization complies with identified supplemental safeguards
Nonaudit services that do impair the audit organization's independence

25. Nonaudit Services Supplemental Safeguards
Document consideration of nonaudit services, including impact on independence
Establish in writing an understanding with audited entity about the nonaudit service and management responsibilities
Exclude personnel who provided the nonaudit services from planning, conducting, or reviewing audit work in the subject matter of the nonaudit services
Do not reduce the scope and extent of audit work below what would have been done if nonaudit service done by an unrelated party
The understanding with the client should include management’s responsibility for:
the subject matter;
the substantive outcomes of the work; and
making any decisions that involve management functions and accepting full responsibility
GAS / A-133 Guide Chapter 2, Footnote 13. As stated in question 30 of the GAO publication Answers to Independence Standard Questions, in applying the safeguards and for reasons of efficiency and practicality, if the nonaudit service involves a total of 40 hours or fewer as it relates to a specific audit engagement, the safeguard associated with precluding personnel who provided the nonaudit service from performing related audit work would not be required. However, the other safeguards described in this paragraph would apply. Auditors and audit organizations need to consider related services that may have been performed under separate contracts or separate engagements in applying this de minimis criteria.

26. Nonaudit Services
Examples of nonaudit services provided in connection with a financial statement audit
Assistance with:
Drafting of financial statements and footnotes
Maintenance of fixed asset records
Implementation of an accounting standard
Preparation of tax return(s)

27. Common Yellow Book Independence Deficiencies
Failure to identify and address potential or the appearance of impairments such as:
Nonaudit services provided
Making management decisions
Failure to consider the GAO standards and related Q&A
Failure to comply or document compliance with supplemental safeguards
Key to compliance with Yellow Book independence is document, document, document!

28. Professional Judgment
Requires that auditors must use professional judgment in planning and performing audits and in reporting the results
Includes exercising reasonable care and professional skepticism
Similar to AICPA standard on due professional care
However, GAGAS expands the discussion of professional judgment as it relates to its importance in audit engagements (chapter 3 of the Yellow Book provides further guidance and description)
Examples of guidance provided in Yellow Book for professional judgment include:
Reasonable care concerns acting diligently in accordance with applicable professional standards and ethical principles.
Professional judgment and competence are interrelated because judgments made are dependent upon the auditors' competence.
In addition to personnel directly involved in the audit, professional judgment may involve collaboration with other stakeholders, outside experts, and management in the audit organization.
Using professional judgment in all aspects of carrying out their professional responsibilities is essential to performing and reporting on an audit.
Using professional judgment is important in determining the required level of understanding of the audit subject matter and related circumstances. This includes consideration about whether the audit team's collective experience, training, knowledge, skills, abilities, and overall understanding are sufficient to assess the risks that the subject matter under audit may contain a significant inaccuracy or could be misinterpreted.
Auditors should document significant decisions affecting the audit objectives, scope, and methodology; findings; conclusions; and recommendations resulting from professional judgment.

29. Competence
Competence is derived from a blending of education and experience
The staff assigned must collectively possess adequate professional competence for the tasks required and include:
knowledge of GAGAS applicable to the type of work being performed
general knowledge of the environment in which the audited entity operates
skills to communicate clearly and effectively, both orally and in writing
skills appropriate for the work being performed
If using GAGAS with other standards, auditors need to be knowledgeable and competent in applying those standards.

30. CPE Requirement
Should complete every 2 years, at least 24 hours of Continuing Professional Education (CPE) that directly relates to government auditing, the government environment, or the specific or unique environment in which the audited entity operates

31. CPE Requirement
An additional 56 hours of CPE (for a total of 80 hours of CPE in every 2-year period) is needed that enhances the auditor's professional proficiency to perform audits or attestation engagements
Applicable to:
Auditors involved in any amount of planning, directing, or reporting on GAGAS assignments; AND
Auditors who are not involved in those activities but charge 20 percent or more of their time annually to GAGAS assignments
Auditors required to take the total 80 hours of CPE should complete at least 20 hours of CPE in each year of the 2-year periods

32. CPE Requirement For Specialists:
Internal specialists who are part of the audit organization and perform as a member of the audit team must comply with GAGAS, including the CPE requirements
External specialists are not required to meet the CPE requirements but have to be qualified and maintain professional competence
Auditors using the work of external specialists should assess the professional qualifications and document their findings and conclusions
Examples of where internal specialists used that should be considered: FIN 48, Tax Accruals, Actuaries, etc.

33. CPE Requirements
GAO has issued a guidance document on the GAGAS CPE requirements that can be found at:
Matters Covered:
Who is subject to the requirements?
How should compliance with CPE requirements be measured?
What qualifies as acceptable CPE?
Measuring CPE hours
How are CPE requirements to be administered?

34. Quality Control and Assurance
Paragraph 3.50 – 3.54 of Yellow Book discuss QC Requirements
Each organization performing GAGAS audits must:
Establish a system of quality control that is designed to provide reasonable assurance that the organization and its personnel comply with professional standards and applicable legal and regulatory requirements; and
Have an external peer review at least once every 3 years

35. Quality Control and Assurance
Keep in mind that you will also have to apply the AICPA Statements on Quality Control Standards (SQCS)
Yellow Book requirements for system of quality control are generally consistent with the SQCS
SQCS can be found at:

36. Quality Control and Assurance
Additional GAGAS Requirements
Audit organizations must make their most recent peer review report publicly available
Those audit organizations seeking to enter into a contract to perform a GAGAS audit or attestation engagement should provide the following to the party contracting for such services:
The audit organization’s most recent peer review report and any letter of comment
Any subsequent peer review reports and letters of comment received during the period of the contract
Auditors who are using another audit organization’s work should request:
The audit organization’s latest peer review report
Any letter of comment

37. Quality Control and Assurance
Documentation
Must document & communicate
Policies must address:
Leadership Responsibilities
Independence, Legal & Ethical Requirements
Initiation, Acceptance and Continuance of Engagements
Human Resources
Engagement performance, documentation and reporting
Monitoring
Leadership responsibilities: Designate responsibility for quality of GAGAS audits and communication of policies and procedures related to quality
Independence, legal, and ethical requirements: Policies and procedures designed to provide reasonable assurance that the audit organization, and its personnel maintained independence, and comply with applicable legal and ethical requirements
Initiation, acceptance, and continuance: Policies and procedures designed to provide reasonable assurance that the audit organization will undertake audit engagements only if it can comply with professional standards and ethical principles and is acting within the legal mandate or authority of the audit organization
Human resources: Policies and procedures designed to provide reasonable assurance that it has personnel with capabilities and competence to perform its audits in accordance with professional standards and legal and regulatory requirements
Engagement performance, documentation and reporting: Policies and procedures designed to provide reasonable assurance that engagements are performed and reports are issued in accordance with professional standards and legal and regulatory requirements
Monitoring of quality: an ongoing, periodic assessment of work completed designed to provide reasonable assurance that the policies and procedures related to the system of quality control are suitably designed and operating effectively in practice

38. Quality Control and Assurance
Monitoring
Monitoring is another difference between AICPA and GAGAS
GAGAS requirements state that reviews of the work and the report that are normally part of supervision are not monitoring controls when used alone
Purpose:
Ensure adherence to requirements
Ensure QC is appropriately designed
Ensure QC policies & procedures are operating effectively

39. Quality Control and Assurance
Monitoring
Engagement Supervision Alone is not Monitoring
Audit organizations to analyze and summarize the results of monitoring procedures at least annually
Include identification of any systemic issues needing improvement
Include recommendations for corrective action
Should be performed by individuals that collectively have sufficient expertise and authority

40. Documentation
AICPA and GAGAS requirements for documentation very similar
Experienced auditor concept should be met
GAGAS provides additional considerations relating to:
Auditors should document evidence of supervisory review prior to report issuance
Departures from GAGAS requirements due to law, regulation, scope limitations, or other issues impacting audit should be documented along with the impact on audit
Policies and procedures should be established for safe custody and retention
Auditors should make appropriate individuals and audit documentation available upon request
Experienced auditor concept: Documentation should be such that an experienced auditor having no connection to audit should be able to have a clear understanding of the work performed, the audit evidence obtained and its source, and the conclusions reached.

41. GAGAS Field Work – Internal Control Over Financial Reporting
Generally, GAGAS identical to that of AICPA requirements
Additional GAGAS requirements
Communicate information (during planning) about the nature of the planned work and level of assurance to be provided on internal control
Any potential restrictions on the scope of the audit should be communicated
Evaluate whether the entity has taken appropriate corrective action to address findings and recommendations from previous engagements
Communication must be made to management, those charged with governance, and the individuals contracting for or requesting the audit.

42. GAGAS Field Work – Compliance
GAGAS and AICPA requirements very similar for consideration of compliance with laws, regulations, as well as fraud and errors
Additional GAGAS requirements
Communicate information (during planning) about the nature of the planned work and level of assurance to be provided on compliance
Design audit to detect material misstatements due to noncompliance with provisions of contracts or grants
If evidence that possible illegal acts exist that could have a material indirect effect on the financial statements, apply procedures to ascertain whether illegal act occurred
Evaluate whether appropriate corrective action to address findings and recommendations from previous engagements

43. GAGAS Field Work – Abuse
Additional requirement of GAGAS
Abuse involves behavior that is deficient or improper when compared with behavior that a prudent person would consider reasonable and necessary
May be the result of internal control deficiency
Examples provided in GAGAS:
Unneeded overtime
Staff performing personal errands
Misusing position for personal gain
Extravagant or expensive travel choices
Procurement or vendor selections that are contrary to policies

44. GAGAS Field Work – Abuse
Not required to design audit to detect
We are not providing reasonable assurance of detecting abuse
Must follow-up when auditor becomes aware of abuse that could be material to the financial statements
Quantitative considerations
Qualitative considerations

45. GAGAS – Management Representations
Additional representations from management:
Responsibility for compliance and internal control over financial reporting
Identification of all direct and material laws, regulations, and provisions of contracts and grants
Has process for tracking status of audit findings and recommendations
Has identified previous audits and other studies related to audit objective and whether recommendations implemented
Has provided views on auditor’s reported findings, conclusions, and recommendations as well as corrective actions

46. GAGAS Reporting Requirements
In addition to providing opinion on financial statements the auditor must:
Report on internal control over financial reporting
Report on compliance with laws, regulations, and provisions of contracts or grant agreements
Report on certain fraud and abuse

47. GAGAS Reporting Requirements
Additional Yellow Book requirements:
Auditors’ compliance with GAGAS
Internal control and compliance with laws, regulations, and provisions of contracts or grant agreements
Deficiencies in internal control, fraud, illegal acts, violations of provisions of contracts grant agreements, and abuse
Communicating additional significant matters in the auditors’ report (always have the option)

48. GAGAS Reporting Requirements
Additional Yellow Book requirements:
Restatement of previously-issued financial statements (goes beyond what AICPA requires)
Views of responsible officials (should be included in findings write-ups)
Confidential or sensitive information (if prohibited from public disclosure auditor should disclose in report that omitted and reason)
Distributing reports (should clarify report distribution responsibilities with auditee)

49. GAGAS Reporting Requirements
When auditors comply with all applicable GAGAS requirements, they should include a statement in the auditors’ report that they performed the audit in accordance with GAGAS
GAGAS do not prohibit auditors from issuing a separate report conforming only to AICPA or other standards

50. GAGAS Reporting – The Yellow Book Report
Proper report title:
Report on Internal Control Over Financial Reporting and on Compliance and Other Matters Based on an Audit of Financial Statements Performed in Accordance With Government Auditing Standards
Include description of scope of the auditor’s testing of internal control over financial reporting and compliance
State whether tests performed provided sufficient, appropriate evidence
When reporting separate from the financial statement opinion (which is common practice) must add linkage paragraph to the financial statement opinion
That issued GAGAS report
That GAGAS report is integral to the audit

51. GAGAS Reporting – The Yellow Book Report
Include significant deficiencies and material weaknesses
Schedule of Findings and Responses
Schedule of Findings and Questioned Costs
Include all instances of fraud and illegal acts unless inconsequential
Include violations of provisions of contracts or grants and abuse that could have a material effect on the financial statements
Direct the reader to a management letter, when issued, if it addresses control deficiencies and/or noncompliance, fraud, or abuse that is other than inconsequential.

52. GAGAS Reporting – The Management Letter
Auditors should communicate in writing:
Violations of provisions of contracts or grant agreements or abuse that have an effect that is less than material but more than inconsequential
Determining whether and how to communicate the following is a matter of professional judgment:
Illegal acts, violations of provisions of contracts or grant agreements or abuse that is inconsequential
Internal control deficiencies that have an inconsequential effect on the financial statements

53. Other Reporting Matters
Restricted Use Reports versus general use reports
Transition from GAAS only to Yellow Book (i.e., comparative financial statements)

54. Development of Findings
Findings include control deficiencies, fraud, illegal acts, violations of provisions of contracts or agreements, and abuse
Elements of a finding:
Criteria
Condition
Cause
Effect or potential effect (prevalence)
Recommendation(s) for improvement
Management’s corrective action plan(s)

55. Development of Findings
When reporting view of responsible officials, auditors should:
Obtain and report views of responsible officials concerning findings, conclusions, recommendations, and planned corrective actions,
Include in report an evaluation of the comments, as appropriate
If the audited entity does not provide comments, auditors may issue the report and indicate that the audited entity did not provide comments

56. References, Guidance and Tools
GAO Web Site for Yellow Book:
Government Auditing Standards, July 2007 Revision (GAO G)
Government Auditing Standards: Guidance on GAGAS Requirements for Continuing Professional Education (GAO G, April 2005)
Government Auditing Standards: Answers to Independence Standard Questions (GAO G, July 2002)

57. References, Guidance and Tools
Guidance on Complying with Government Auditing Standards Reporting Requirements for the Report on Internal Control for Audits of Certain Entities Subject to the Requirements of the Sarbanes-Oxley Act of 2002 and Government Auditing Standards  (December 2007)
AICPA has made available a comparison between AICPA and GAGAS independence standards at:

58. References, Guidance and Tools
Tool available on GAO Web site which identifies all unconditional and presumptively mandatory requirements (
For technical or practice questions directly related to Government Auditing Standards, our address is:

59. References, Guidance and Tools
GAQC Web site:
AICPA Government Auditing Standards and Circular A-133 Audits and related Risk Alert available at
Chapters 1-4 relevant to GAGAS
Report illustrations

60. Future Revision of the Yellow Book
Final issuance of 2011 revision of Yellow Book expected later this year
Government Auditing Standards, 2010 Exposure Draft (GAO G, August 2010) and available at:
Primary area of change is independence requirements (to align the Yellow Book more closely with AICPA rules
Effective date
GAQC Archived Web event, What You Need to Know About the 2010 Yellow Book Exposure Draft, provides you with summary of major changes proposed

61. Questions ???