CCH ProSystem fx KnowledgeCoach's Antidote to Common Audit Documentation Deficiencies

12 Pages·2017·0.46 MB·English

When you have to be right
Tax & Accounting
CCH ProSystem fx Knowledge
® ®
Coach’s Antidote to Common
Audit Documentation Deficiencies
By George Georgiades, CPA, APC
2 CCH® ProSystem fx® Knowledge Coach’s Antidote to Common Audit Documentation Deficiencies
Audit documentation is not only important because it is
required by professional standards, but also because it may
“The skill of an
serve as the auditor’s first line of defense in litigation. Over
accountant can
the years, legal and disciplinary proceedings against auditors
have identified multiple and repeated violations of audit
always be ascertained
documentation standards, including failure to prepare and
by an inspection of
maintain adequate and sufficient working papers. Similarly,
peer reviews continue to identify common deficiencies related
his working papers.”
to audit documentation, including failures by auditors to
— Robert H. Montgomery, appropriately document audit procedures, audit evidence, and
Montgomery’s Auditing, 1912 conclusions reached with respect to management’s assertions
and the auditor’s opinion on the financial statements.
Given the persistent and significant audit AU‑C Section 230 is the authoritative literature
documentation deficiencies that auditors that provides guidance for documentation
continue to face, it would seem imprudent requirements for audits conducted in
for auditors to carry on as if their work accordance with standards promulgated
will not be second guessed. That type of by the AICPA. However, other AICPA AU‑C
mindset or behavior is virtually impossible Sections also contain specific documentation
to counterbalance or defend when an requirements and guidance that are in
independent third party (let alone an addition to the requirements of AU‑C Section
adversary) asserts the common notion that 230. Accordingly, the auditor should address
“work not documented is work not done.” the specific documentation requirements
of other AU‑C Sections as well. In addition,
AICPA AU‑C Section 230, Audit Documentation, to the extent that law, regulation, or other
addresses the auditor’s responsibility in standards establish additional documentation
an audit of financial statements to prepare requirements, the auditor should also comply
audit documentation that provides (1) an with those requirements. KBA‑904 (Audit
adequate record of the basis for the auditor’s Documentation Checklist), a Knowledge‑Based
report and the achievement of the overall Audit resource offered by Wolters Kluwer,
objectives of the auditor, and (2) evidence is an audit documentation checklist that
that the audit was planned and performed in is designed to help the auditor assess the
accordance with generally accepted auditing completeness of the audit documentation. It
standards (GAAS) and, if applicable, legal and summarizes the various audit documentation
regulatory requirements. AU‑C Section 230 requirements under GAAS and outlines steps
defines audit documentation as “The record that are either required or recommended to
of audit procedures performed, relevant finalize the audit file.
audit evidence obtained, and conclusions
the auditor reached (terms such as working This white paper addresses common audit
papers or workpapers are also sometimes documentation deficiencies identified in peer
used).” Relevant audit evidence involves reviews and recognized in valuable lessons
the quantity and quality of evidence which, from litigation, and is predominately based on
ultimately, helps the auditor determine the AICPA audit documentation requirements.
whether sufficient appropriate audit evidence Useful analogies can be easily made for audit
is obtained. documentation requirements established by
other standard‑setting bodies (e.g., the Public
Company Accounting Oversight Board), laws
or regulations. More importantly, this white
CCH® ProSystem fx® Knowledge Coach’s Antidote to Common Audit Documentation Deficiencies 3
paper is intended to help auditors avoid these to make risk assessments in connection with
documentation deficiencies by identifying a financial statement audit of that entity.
the primary practice aids in CCH ProSystem fx This allows the auditor to more appropriately
Knowledge Coach that address the various focus audit efforts on those areas which,
authoritative audit documentation in the auditor’s judgment, are the most
requirements and by providing relevant significant and pose the most risk of material
practice points. misstatement to the financial statements.
• Deficiency #1: Fraud CCH ProSystem fx Knowledge Coach
• Deficiency #2: Risk Assessment Procedures functionality allows auditors to use the
• Deficiency #3: Audit Sampling Knowledge‑Based Audit Methodology more
• Deficiency #4: Communication with Those efficiently by eliminating the need for
Charged with Governance duplicate entry of the same information,
• Deficiency #5: Audit Strategy and Audit Plan tailoring audit documentation to each
• Deficiency #6: Analytical Procedures particular engagement, and documenting the
• Deficiency #7: Materiality link between risks identified and procedures
• Deficiency #8: Accounting Estimates performed. There are over a dozen separate
Knowledge‑Based Audit industry titles, and
CCH ProSystem fx Knowledge Coach is part of each title features hundreds of programs,
the Wolters Kluwer Integrated Audit Approach, checklists, practice aids, example reports
and features a robust decision‑support and and example correspondence letters, as well
coaching system for auditors and accountants as resource documents and links to further
built upon the Knowledge‑Based Audit research material in the form of original
Methodology. The Knowledge‑Based Audit pronouncements and interpretive guidance on
Methodology is a risk‑based methodology CCH® Accounting Research Manager®.
that emphasizes using knowledge of the entity
Deficiency #2: Risk Assessment
Deficiency #8: Accounting Deficiency #1: Fraud
Procedures
Estimates KBA‑302 and 302N, KBA‑303,
KBA‑302 and 302N, KBA‑400,
KBA‑105, KBA‑502 KBA‑501, KBA‑502
KBA‑403 through 411, KBA‑502
Deficiency #3: Audit Sampling
Deficiency #7: Materiality Audit Documentation
AID‑701, AID‑702, AID‑801,
KBA‑301, KBA‑104, RES‑018 KBA‑904
RES‑004 through 006
Deficiency #4: Communication with
Deficiency #6: Analytical Deficiency #5: Audit Strategy
Those Charged with Governance
Procedures and Audit Plan
KBA‑103, COR‑216,
AID‑301, AUD‑801 through 813 KBA‑101, AUD‑101 through 908
COR‑903 through 906
Exhibit 1. The Knowledge Coach Antidotes to Common Audit Documentation Deficiencies
This illustrates the common audit documentation deficiencies discussed below and the primary Knowledge Coach
practice aids and programs that auditors can use to antidote their pitfalls.
4 CCH® ProSystem fx® Knowledge Coach’s Antidote to Common Audit Documentation Deficiencies
DEFICIENCY #1: Failure to appropriately • KBA‑501 (Team Discussion and Consideration
address fraud considerations, including lack of the Risks of Material Misstatement) is
of adequate documentation of procedures designed to document the engagement
applied regarding risks of material team discussion of the susceptibility of the
misstatement due to fraud. entity’s financial statements to material
misstatement due to fraud, including risks
Key AU‑C Section of material misstatement identified in the
Among other matters, AU‑C Section 240, discussion, and the overall response to
Consideration of Fraud in a Financial fraud risks.
Statement Audit, requires the audit
documentation to include: (1) the significant • KBA‑502 (Summary of Risk Assessments)
decisions reached during the engagement is designed to document the auditor’s
team discussion about the susceptibility consideration of (1) whether identified fraud
of the financial statements to material risks relate to specific assertions or to the
misstatement due to fraud; (2) the identified financial statements as a whole; (2) the risk
and assessed risks of material misstatement of management override of controls; and (3)
due to fraud at the financial statement and the presumption that risks of fraud exist in
assertion levels; (3) the overall responses to revenue recognition. KBA‑502 is also used to
the assessed risks of material misstatement document the planned audit procedures and
due to fraud at the financial statement level; the linkage of those audit procedures to the
(4) the nature, timing and extent of audit assessed risks of material misstatement due
procedures and the linkage of those audit to fraud at the assertion level.
procedures to the assessed risks of material
misstatement due to fraud at the assertion • RES‑003 (Consideration of Fraud in the
level; (5) the results of the audit procedures, Knowledge‑Based Audit) contains a list
including those intended to address the of KBA forms that address the auditor’s
risk of management override of controls; responsibilities relating to fraud and how
and (6) the reasons for the conclusion each KBA form addresses key requirements
that the presumption of a risk of material in AU‑C Section 240.
misstatement due to fraud related to revenue
recognition is overcome in the circumstances
of the engagement, if the auditor has reached
such a conclusion.
Practice Point
The documentation of the exchange of
Knowledge Coach’s Antidote
ideas/brainstorming discussion among
Key practice aids that help the auditor
the engagement team members about
address this documentation deficiency related
the risks of fraud should include at a
to fraud include:
minimum:
• KBA‑302 and 302N (Understanding the
1. the significant decisions reached
Entity and Its Environment: Complex Entities
during the engagement team
& Noncomplex Entities) are designed to
discussion about the susceptibility
document the auditor’s evaluation of
of the financial statements to
whether information obtained from risk
material misstatement due to
assessment procedures indicates the
fraud;
presence of fraud risk factors.
2. how and when the engagement
• KBA‑303 (Inquiries of Management and
team discussion took place; and
Others Within the Entity About the Risks of
Fraud and Noncompliance With Laws and
3. the audit team members who
Regulations) is designed to document the
participated in the discussion.
auditor’s inquiries of management and others
within the entity about the risks of fraud.
CCH® ProSystem fx® Knowledge Coach’s Antidote to Common Audit Documentation Deficiencies 5
DEFICIENCY #2: Lack of documentation • KBA‑400 (Scoping and Mapping of Significant
around risk assessment procedures, including Account Balances, Classes of Transactions,
failure to properly and adequately document and Disclosures) is intended to help the
planning procedures relating to risk auditor determine and document which audit
assessment and the linkage of risks to the areas have significant account balances,
procedures performed. classes of transactions, and disclosures, or
contain specific risks (i.e. significant risks,
Key AU‑C Sections fraud risks and risks for which substantive
Among other matters, AU‑C Section 315, procedures alone are not sufficient to reduce
Understanding the Entity and Its Environment audit risk to an appropriately low level).
and Assessing the Risks of Material
Misstatement, requires documentation of (1) the • KBA‑403 through KBA‑411 (Understanding
auditor’s understanding of the entity and its Activity‑Level Controls) are designed to
environment, including its internal control; (2) help the auditor perform and document the
the risk assessment procedures performed to auditor’s risk assessment procedures to gain
obtain such understanding; (3) the assessment an understanding of relevant activity‑level
of the risks of material misstatement both controls for all significant account balances,
at the financial statement level and at the classes of transactions, and disclosures,
relevant assertion level and the basis for including documentation of the procedures
the assessment; and (4) the risks identified performed, evidence obtained and
and related controls evaluated for significant conclusions reached.
risks that require special audit considerations
and risks for which substantive procedures • KBA‑502 (Summary of Risk Assessments) is
alone do not provide sufficient appropriate designed to help the auditor summarize,
audit evidence. In addition, AU‑C Section 330, assess and respond to risks of material
Performing Audit Procedures in Response misstatement identified in the audit, to
to Assessed Risks and Evaluating the Audit document the basis for the risk assessments
Evidence Obtained, requires documentation and to provide clear linkage between the
of (1) the overall responses to address the assessed risk of material misstatement and
assessed risks of material misstatement at the audit procedures performed.
the financial statement level; (2) the nature,
timing, and extent of further audit procedures
performed; (3) the linkage of those procedures
Practice Point
to the assessed risks at the relevant assertion
When completing the KBA forms, it is important to recognize
level; and (4) the results of the audit procedures
that the auditor is not required to consider, understand or
performed and conclusions reached.
document all controls that exist within an entity. Generally,
controls that are relevant to an audit pertain to the entity’s
Knowledge Coach’s Antidote
objective of preparing its financial statements that are
One of the fundamental building blocks in the
fairly presented in conformity with the applicable financial
Knowledge‑Based Audit (KBA) methodology is
reporting framework. Entities typically have additional
its key design feature to clearly and directly
controls that are not necessarily relevant to an audit and,
link specific audit procedures to specified
therefore, need not be considered or documented. Examples
risks identified in connection with the
include controls relating to the effectiveness, economy and
auditor’s risk assessment. Notably:
efficiency of certain management decision‑making processes,
such as whether to make expenditures for certain research
• KBA‑302 and 302N (Understanding the Entity
and development or advertising activities.
and Its Environment: Complex Entities &
Noncomplex Entities) are designed to assist
In addition, although internal control is relevant to the entire
the auditor in identifying and documenting
entity or to any of its operating units or business functions,
pertinent facts about the entity and its
an understanding or documentation of internal control
environment to be used in further risk
relevant to each of the entity’s operating units and business
assessment procedures, and to document
functions may not be necessary.
potential risks of material misstatement.
6 CCH® ProSystem fx® Knowledge Coach’s Antidote to Common Audit Documentation Deficiencies
DEFICIENCY #3: Failure to adequately Knowledge Coach’s Antidote
document audit sampling methodology. AID‑701 (Audit Sampling Worksheet for Tests
of Controls) and AID‑702 (Results of Tests of
Key AU‑C Sections Controls) are designed to document audit
AU‑C Section 530, Audit Sampling, provides sampling applications for tests of controls.
guidance regarding the performance of audit AID‑801 (Audit Sampling Worksheet for
sampling in an audit engagement. Although Substantive Tests of Details) is designed to
AU‑C Section 530 does not require specific document audit sampling applications for
documentation of audit sampling applications, substantive tests of details. RES‑004 (Audit
the documentation requirements set forth Sampling Guidance for Tests of Controls)
in other standards (e.g., AU‑C Section 230, and RES‑005 (Audit Sampling Guidance for
Audit Documentation) apply to audit sampling Substantive Tests of Details) provide audit
applications just as they apply to other sampling guidance for tests of controls and
auditing procedures. Accordingly, if the substantive tests of details, respectively.
sampling methodology is not documented, RES‑006 (Sample Process Narrative) is
then the reviewer may not be able to evaluate designed to aid the auditor in preparing
whether the procedures performed provided process narratives for the various transaction
sufficient appropriate audit evidence. processes management has implemented and
in understanding how to identify key controls
in the transaction process.
Practice Point
For tests of controls and substantive
tests of details, audit documentation
for audit sampling applications would
include: (1) the definition of the
population and the sampling unit,
including how the auditor determined
the completeness of the population;
(2) what constitutes a deviation
condition or misstatement; (3) the
method of sample selection; (4) a
description of the performance of
the sampling procedures and a list of
deviations or misstatements identified
in the sample; and (5) the evaluation
of the sample and a summary of the
overall conclusion with respect to
the population.
CCH® ProSystem fx® Knowledge Coach’s Antidote to Common Audit Documentation Deficiencies 7
DEFICIENCY #4: Failure to communicate or
document required communications with
those charged with governance.
Key AU‑C Sections
AU‑C Section 260, The Auditor’s
Communication With Those Charged With
Governance, addresses the auditor’s
responsibility to communicate with those
charged with governance in connection with
an audit of financial statements. Specifically,
under AU‑C Section 260, the auditor should:
(1) document all matters that are required to
be communicated with those charged with
governance, when such matters have been
communicated orally, including when and to
whom such matters were communicated; and
(2) retain as part of the audit documentation
a copy of the communication when matters
that are required to be communicated with
those charged with governance have been
communicated in writing.
AU‑C Section 265, Communicating Internal
Control Related Matters Identified in an
Audit, requires the auditor to communicate
to management: (1) in writing, significant
deficiencies and material weaknesses that Knowledge Coach’s Antidote
the auditor has communicated or intends KBA‑103 (Evaluating and Communicating
to communicate to those charged with Internal Control Deficiencies) can be used
governance, unless it would be inappropriate to document internal control deficiencies
to communicate directly to management in identified in the audit, including whether each
the circumstances; and (2) in writing or orally, deficiency is a material weakness, a significant
other deficiencies in internal control that deficiency or a deficiency in internal control.
have not been communicated to management
by other parties and that, in the auditor’s COR‑216 (Communication with Those
professional judgment, are of sufficient Charged with Governance During Planning)
importance to merit management’s attention. and COR‑903 through COR‑906 (Letters
If other deficiencies in internal control are Communicating Internal Control Deficiencies)
communicated orally, the auditor should can be used to communicate or document
document the communication. required communications with those charged
with governance and management.
Practice Point
Documentation of oral communication
may include a copy of minutes
prepared by the entity as part of the
audit documentation if those minutes
are an appropriate record of the
communication.
8 CCH® ProSystem fx® Knowledge Coach’s Antidote to Common Audit Documentation Deficiencies
DEFICIENCY #5: Failure to document the
Practice Point
overall audit strategy, the audit plan, or any
The documentation of the overall audit
significant changes made thereto during the
strategy includes the key decisions
audit engagement.
considered necessary to plan the audit

and communicate significant issues to
Key AU‑C Section
the audit team (e.g., a memorandum
AU‑C Section 300, Planning an Audit,
summarizing key decisions about the
requires the auditor to include in the audit
scope, timing and conduct of the audit
documentation: (1) the overall audit strategy;
may be sufficient).
(2) the audit plan; and (3) any significant
changes the auditor made to the overall audit
The documentation of the audit
strategy or audit plan during the course of
plan includes the planned nature,
the engagement, and the reasons for those
timing and extent of risk assessment
changes.
procedures and further audit
procedures at the relevant assertion
Knowledge Coach’s Antidote
level. Standardized audit programs
KBA‑101 (Overall Audit Strategy) is designed
and checklists may be used, provided
to help the auditor (1) document the initial
they are tailored to the circumstances
overall audit strategy; (2) capture the initial
of the engagement. This includes
information (e.g., risk assessment procedures)
tailoring them to the risk assessment
that will be useful in the development of a
for the engagement.
more detailed audit plan; and (3) document
changes to the overall audit strategy as
The documentation of any significant
changes in circumstances arise throughout
changes to the overall audit strategy
the audit.
or audit plan, and the reasons for
those changes, includes changes to
AUD‑101 (Overall Audit Program) is designed
the planned nature, timing and extent
to help guide the auditor through the
of audit procedures and why the
development of the audit plan. This overall
overall strategy and audit plan were
audit program is supplemented by other
finally adopted for the audit.
forms and practice aids, including audit
programs AUD‑201 through AUD‑908 (Audit
AU‑C Section 300, Planning an Audit,
Programs) to help the auditor perform various
acknowledges the widespread use of
audit procedures. Audit Program documents
what it calls “standard audit programs
typically contain steps and procedures that
or audit completion checklists.”
are required by auditing standards in many
However, it reminds auditors of the
areas of the audit and are designed to guide
need to tailor such programs and
the auditor through the execution of related
checklists to each particular audit.
steps and procedures. The auditor develops
and documents the “audit plan,” including
any changes thereto, as he or she customizes
these documents.
CCH® ProSystem fx® Knowledge Coach’s Antidote to Common Audit Documentation Deficiencies 9
DEFICIENCY #6: Lack of documentation of
Practice Point
expectations for analytical procedures and
When documenting the results of
related actions when substantive analytical
the comparison of the recorded
procedures have been performed.
amounts, or ratios developed from
recorded amounts, with the auditor’s
Key AU‑C Section
expectations, it is essential for
AU‑C Section 520, Analytical Procedures,
the auditor to decide whether a
requires the auditor to document the
fluctuation in an analytical procedure
following matters when substantive analytical
is material. When planning analytical
procedures have been performed:
procedures, the auditor typically sets
the materiality thresholds for accepted
• The expectation of recorded amounts or
deviations from expected amounts and
ratios that the auditor developed, including
results. Professional literature does
whether the expectation is sufficiently
not provide much guidance in this
precise to identify a misstatement that
area. However, it is observed that in
may cause the financial statements to be
practice, auditors use one or both of
materially misstated.
the following approaches:
• The factors the auditor considered in
• Deviation exceeds a preestablished
developing the foregoing expectation when
dollar amount threshold. For
that expectation or those factors are not
example, the auditor may decide
otherwise readily determinable from the
that a $10,000 misstatement is
audit documentation.
unacceptable in the audit of payroll
taxes expense. If a difference
• Results of the comparison of the recorded
exceeding that amount is uncovered,
amounts, or ratios developed from recorded
the auditor would perform
amounts, with the expectations.
additional detail testing; otherwise,
payroll taxes expense would not be
• Any additional auditing procedures
considered fairly stated.
the auditor performed relating to the
investigation of fluctuations or relationships
• Deviation exceeds a preestablished
that are inconsistent with other relevant
percentage threshold. Under this
information or that differ from expected
approach, the auditor compares,
values by a significant amount, and the
for example, the current year’s
results of such additional procedures.
general and administrative expense
accounts with the prior year’s and
Knowledge Coach’s Antidote
computes the percentage change.
AID‑301 (Preliminary Analytical Procedures:
If the percentage change exceeds
Fluctuation and Ratio Analysis) and AUD‑801
what the auditor believes is
through AUD‑813 (Audit Programs) have been
appropriate (e.g., 10%), the deviation
designed to help the auditor perform and
would be considered material and
document analytical procedures, including the
would require further investigation.
development of expectations, the comparison
This approach, however, could
of the expectations to actual or recorded
result in more work than necessary
amounts and the investigation of significant
if there are many small dollar
variances from the auditor’s expectations.
account balances.
10 CCH® ProSystem fx® Knowledge Coach’s Antidote to Common Audit Documentation Deficiencies
DEFICIENCY #7: Lack of documentation of
Practice Point
materiality considerations including those
The documentation requirements
relating to uncorrected misstatements.
under AU‑C Section 320, Materiality
in Planning and Performing an
Key AU‑C Sections
Audit, in regard to materiality
AU‑C Section 320, Materiality in Planning and
levels include the phrase “and
Performing an Audit, requires documentation
the factors considered in their
of the following amounts and the factors
determination” in an inconspicuous
considered in their determination: (1)
fashion. They are nonetheless an
materiality for the financial statements as a
important requirement, and one that
whole; (2) materiality level(s) for particular
practitioners may easily miss. The
classes of transactions, account balances or
intent of this requirement seems
disclosures, if applicable; (3) performance
to indicate that materiality, and its
materiality; and (4) any revisions of the
various levels, should not be solely
preceding three items during the progress of
numbers derived from the mechanical
the audit.
application of formulas contained
in practice aids, or numbers chosen
AU‑C Section 450, Evaluation of Misstatements
randomly with no apparent rationale.
Identified During the Audit, requires the
auditor to document: (1) the amount below
The practical implication of this
which misstatements are considered to
requirement is that when auditors
be clearly trivial; (2) all misstatements
are choosing a benchmark for
accumulated during the audit (other than
determining materiality for the
those considered to be clearly trivial) and
financial statements as a whole, for
whether they have been corrected; and
example, they need to state why
(3) a conclusion as to whether uncorrected
that benchmark is applicable or
misstatements are material, either
more appropriate than another likely
individually or in the aggregate, and the
benchmark. The choice of a benchmark
basis for that conclusion.
is in itself a matter of professional
judgment, and the standards place no
Knowledge Coach’s Antidote
limits on the auditor in the process as
KBA‑301 (Worksheet for Determination of
long as the rationale is documented.
Materiality, Performance Materiality, and
For example, pre‑tax profit before
Thresholds for Trivial Amounts) is designed
owners’ remuneration may be
to help the auditor determine and document
appropriate for small, privately‑held
materiality for the financial statements as
entities, as owners typically take out
a whole, performance materiality and the
most of the profits and leave only the
thresholds for trivial amounts. KBA‑104
nominal net income. Similarly, entities
(Summary and Evaluation of Misstatements and
such as non‑profit organizations or
Omitted, Inaccurate, or Incomplete Disclosures)
some types of governmental units
is designed to help the auditor summarize
do not operate for the purpose of
and evaluate all identified misstatements,
generating a profit, thus using a
including uncorrected misstatements and
profit‑based benchmark is usually
those corrected by management.
inappropriate.
RES‑018 (Determination of Materiality,
Performance Materiality and Thresholds
for Trivial Amounts), which can be used in
conjunction with KBA‑301, provides additional
guidance to the auditor for the determination
of an appropriate benchmark, materiality,
performance materiality and the threshold for
“trivial” amounts.