Audit documentation: Tips for getting it right

For many staff auditors, the very mention of working paper review is enough to make their hair stand on end. No matter how thoroughly they perform an audit procedure, they know if their documentation does not reflect what they’ve done, they can expect review comments from their supervisor.

This is a vital lesson that is instilled in auditors from the beginning of their careers: Insufficient documentation represents a failure to comply with generally accepted auditing standards (GAAS). That lesson has never been more relevant than it is today.

Starting in 2014, the AICPA Peer Review Program has performed what are called “enhanced oversights.” Through these oversights, subject-matter experts from public practice review a sample of engagements after they have been subject to peer review. The AICPA then tracks the number of engagements that did not conform to applicable professional standards in all material respects (commonly referred to as “materially nonconforming” engagements).

The experts have found high levels of material nonconformity, and the most common cause has been noncompliance with AU-C Section 230, Audit Documentation. In fact, one out of every four engagements subject to these enhanced oversights by the Peer Review Program was materially nonconforming due to a lack of adequate audit documentation.

WHAT WE’VE LEARNED

By collecting information from the firms subject to enhanced oversights, we’ve learned that three common misconceptions are driving nonconformity. They are:

• Auditors can meet their overall audit objectives without documenting their work;
• A signoff on an audit program is sufficient documentation of a detail test; and
• Oral explanation can substitute for written documentation to meet the requirements of AU-C Section 230.

Let’s examine these one at a time:

Misconception No. 1: Auditors can meet their overall audit objectives without documenting their work

Through enhanced oversights, numerous firms have expressed their belief that sufficient evidence to support the audit opinion can be obtained without meeting the requirements of AU-C Section 230.

For example, on one of the single-audit engagements subject to enhanced oversight, the engagement team had no documentation related to their tests of controls over compliance. When the subject-matter expert concluded that the engagement was materially nonconforming, the engagement partner disagreed. He explained to the expert that because the required tests had been performed, he reasoned, he had done enough to support the audit opinion.

This is not an appropriate reading of the requirements of GAAS.

Under AU-C Section 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance With Generally Accepted Auditing Standards, obtaining sufficient appropriate audit evidence is necessary to reduce audit risk to an acceptably low level and thereby enable the auditor to draw reasonable conclusions on which to base the auditor’s opinion.

Meeting the requirements of AU-C Section 230, and the specific documentation requirements of other relevant AU-C sections, provides evidence of the auditor’s basis for his or her audit opinion as well as evidence that the audit was planned and performed in accordance with GAAS, according to paragraph .02 of AU-C Section 230.

If sufficient appropriate audit evidence necessary to support the audit opinion was not appropriately documented, then the audit was not conducted in accordance with GAAS and the auditor would not have a basis to render an opinion.

In such instances, the auditor should take appropriate action under AU-C Section 585, Consideration of Omitted Procedures After the Report Release Date. This includes assessing the effect of omitted procedures on the auditor’s ability to support the audit opinion and may include performing the omitted procedures or alternative procedures. Omitted procedures may include documenting procedures in accordance with AU-C Section 230 that had been performed but not previously documented along with the evidence obtained from those procedures.

Misconception No. 2: A signoff on an audit program is sufficient documentation of a detail test

The Peer Review team identified numerous instances in which the auditor believed a signoff on an audit program was sufficient documentation of a detail test. For example, on an audit of a defined contribution plan, one auditor believed he had met the requirements for documenting his testing of participant eligibility by signing off on the program step relative to that test even though there was no documentation of the evidence obtained.

Signing off on an audit program is rarely sufficient to meet the requirements of the Audit Documentation standard. In accordance with paragraph .08 of AU-C Section 230, the auditor should document:

• The nature, timing, and extent of the procedures performed;
• The results of the procedures and the evidence obtained; and
• Significant findings or issues arising during the audit, the conclusions reached thereon, and any significant professional judgments made in reaching those conclusions.

These should be documented for any procedure that provides audit evidence that is necessary to support the audit opinion.

In some cases, a signoff on an audit program might address the nature of the procedure, who performed it, who reviewed it, and maybe the timing of the procedure. The other requirements of the standard, however, would ordinarily not be met.

Misconception No. 3: Oral explanation can substitute for written documentation to meet the requirements of AU-C Section 230

Another common finding in the enhanced oversights was the reliance of auditors and peer reviewers on oral explanation as a substitute for written documentation to meet the requirements of AU-C Section 230.

As AU-C Section 230, paragraph .A7 notes, if the auditor meets the requirements of AU-C Section 230 but clarification is needed, oral explanation may be used to provide that clarification.

For example, if the results of an auditor’s procedures and the auditor’s conclusion with respect to those procedures appear inconsistent to a third-party reviewer, the auditor may use oral explanation to supplement his or her documentation.

However, expert oversight uncovered numerous instances in which oral explanation was relied on inappropriately.

For example, when reviewing a single audit, one peer reviewer noted that a firm failed to document its consideration of direct and material compliance requirements. The reviewer discussed the matter with the firm, and he concluded that the engagement team had complied with applicable professional standards based on oral explanation. However, there was no documented evidence that the engagement team had performed this required procedure.

If an auditor performs a procedure that provides audit evidence that is necessary to support the audit opinion, and the auditor’s documentation of that evidence does not meet the requirements of AU-C Section 230, the auditor has not complied with GAAS, and no amount of oral explanation can serve as a substitute.

HOW TO RAISE QUALITY IN YOUR PRACTICE

Auditors seeking to identify and address potential documentation deficiencies in their practice should review AU-C Section 230 and use the free resources available on the AICPA Peer Review team’s Audit Documentation Resources page at aicpa.org/documentation. Using these resources, the firm can:

• Train its personnel on the Audit Documentation standard using a PowerPoint presentation with speaker notes;
• Facilitate proper consideration of documentation matters during the firm’s internal inspection;
• Provide personnel with sample working papers from the AICPA; and
• Use practice aids from the Governmental and Employee Benefit Plan Audit Quality Centers, which address the most common documentation issues detected in enhanced oversights.

About the authors

Ahava Z. Goldman (Ahava.Goldman@aicpa-cima.com) is an AICPA senior manager; Charles E. Landes (Chuck.Landes@aicpa-cima.com) is vice president—Professional Standards & Services at the AICPA; Carl R. Mayes Jr. (Carl.Mayes@aicpa-cima.com) is an AICPA senior manager.

To comment on this article or to suggest an idea for another article, contact Ken Tysiac, editorial director, at Kenneth.Tysiac@aicpa-cima.com or 919-402-2112.

AICPA resources

Articles

• “AICPA Issues New Going Concern Auditing Standard,” JofA, Feb. 22, 2017
• “Professional Liability Spotlight: Professional Liability Risk Resolutions for 2017,” JofA, Jan. 2017
• “Maintaining Independence With Nonattest Services,” JofA, Nov. 2016
• “11 Tips for Success With Single Audits,” JofA, Nov. 2016

CPE self-study

• Audit Workpapers: Documenting Field Work (#163222, online access; #GT-CL4DFW, group training)
• Audit Workpapers: Reviewing Field Work Documentation (#163232, online access; #GT-CL4FWD, group training)
• New Staff: Core Concepts—Workpapers and Workpaper Documentation (#161060, online access; #GT-JEH, group training)

For more information or to make a purchase, go to aicpastore.com or call the Institute at 888-777-7077.

Online resources

• Employee Benefit Plan Audit Quality Center, aicpa.org/ebpaqc
• Governmental Audit Quality Center, aicpa.org/gaqc
• Audit Documentation Resources, aicpa.org/documentation