Not-for-profit auditors face new challenges amid pandemic

By Ken Tysiac

An audit that Ksenia Popke, CPA, J.D., performs for a large sporting event that draws participants from all over the world shows just how different audits will be for not-for-profit financial statements because of the pandemic.

The event was canceled in 2020 because of restrictions on large gatherings, and the client had to consider whether to record a goodwill impairment. On one hand, the cancellation negatively affected the not-for-profit. On the other hand, there is no reason to believe the event won’t maintain its popularity when it’s held after the pandemic ends. Ultimately, the client didn’t record a goodwill impairment, and the audit firm concurred with that decision.

“It’s almost as if everything is just being placed on hold and there’s a waiting game,” said Popke, a partner with Eide Bailly. “And the question is how well do you weather that waiting game for a year or so?”

The pandemic has brought about many unusual situations for not-for-profits that their financial statement auditors will have to scrutinize. For example, a ballet company that held no in-person performances in 2020 might seem to be a going concern because of lack of revenue, but what if the ballet company is in a big city whose government and arts-supporting community have stepped up and are determined not to let it fail?

Meanwhile, auditors may have to scrutinize two sets of internal controls (pre-pandemic in-office as well as during-pandemic remote) for not-for-profits whose operations shifted to work-from-home arrangements during the pandemic. And the elevated potential for fraud in the current environment needs to be considered carefully in risk assessments.

“We went into this remote environment with little to no notice, so I find it hard to think that most of our clients didn’t have some change and disruption,” said Jennifer Hoffman, CPA, Grant Thornton’s national higher education and not-for-profit audit leader. “Particularly some of the smaller organizations, if you had smaller finance functions, they probably had a pretty well-run process of approving and reviewing, and then all of a sudden they got sent home.”

Here are some things that practitioners need to keep in mind as they audit not-for-profit financial statements that cover periods coinciding with the pandemic.

Communication is essential

More than ever, practitioners need to communicate with audit committees, boards, and management throughout the audit and create a shared understanding of expectations at the beginning of the engagement.

“It is important that in these communications we include the audit committee because they are the ones charged with the governance and oversight of the audit, to lay out the nature, extent, and timing of the work and how that is going to be different this year, especially because of the crisis and especially because of most audits happening almost fully remotely,” said Sibi Thomas, CPA, CGMA, a partner with the Nonprofit, Government & Healthcare Group at Marks Paneth LLP.

Communication is a two-way street, and auditors need to be careful to listen as well as they talk. Popke suggested that carefully reviewing board minutes is a first step in understanding the challenges not-for-profits are facing.

In many cases, boards have met more than usual during the pandemic to provide extra oversight during difficult times.

“Really dive into [the board minutes],” Popke said. “And if you don’t understand or you want to follow up on something, that’s a great way to start the conversation. There is so much information that’s being disseminated now that they might not be aware of additional funding.”

Remote auditing best practices

Many firms are conducting at least some of their audit procedures remotely, which introduces new risks to engagements.

The remote environment makes communication in particular a challenge. When auditors are on-site, they can easily visit the office of the CFO or other personnel if they need a question answered. In a remote audit, practitioners need to commit to pursuing the same information even if it slows the process.

“That’s something I’ve been drilling with my team,” Thomas said. “Just because you’re not there doesn’t mean you can’t talk to them.”

Sharing information and documents can be another challenge practitioners face with remote audits. Hoffman said that at times her staff has conducted audit procedures by sharing screens with clients through Zoom calls or Microsoft Teams. Other times, cloud-based secure portals are used for sharing documents. Completing audits may not be easy for firms and audit clients that do not possess this technology.

Seeing documents during a videoconference or in a portal can help auditors gain comfort. But extra effort still is needed to verify documents as legitimate. To make sure documents are unaltered, practitioners may choose to use video transmission technology to watch clients scan documents to be sent to the auditor.

“You still need to make sure the evidence you’re getting from them is reliable and not being tampered with,” Thomas said.

Risk assessment will change

The risks of material misstatement are bound to shift as not-for-profits change operations, revenue streams, and perhaps the services they provide as a result of the pandemic.

Some foundations, for example, may have rules that prevent them from distributing funds to not-for-profits that have negative assets. Although some foundations may be temporarily suspending those guidelines in response to the pandemic, the guidelines nonetheless may tempt not-for-profit personnel to alter the balance sheet on purpose.

“There is a risk of revenue recognition that exists for the organization to try to manipulate the numbers to show that positive change, even if it’s just by a few dollars, to be able to receive additional funding,” Popke said. “There’s still that stigma in place that, ‘Well, we can’t have losses; otherwise, we might lose additional revenue.’”

It’s also important to consider the impact of the crisis on each account balance.

“Accounts receivables, are they still fully collectible?” Thomas asked. “Because of COVID-19, did anything change? COVID-19 has to be factored into the risk assessment process in general.”

Auditors also are deploying new technology to help them better pinpoint risks, even as the risks change. Many firms have “whole ledger analytics” that analyze a client’s activity for an entire year to identify risks that practitioners need to investigate more closely. The technology can be programmed to flag anomalies such as:

  • Transactions occurring outside normal working hours.
  • Transactions that are just below a threshold that requires management approval.
  • Periods during a transition of key personnel, such as a new employee replacing a departing controller.
  • Round numbers appearing in transactions or journal entries.

“This technology platform or tool can help you identify any anomalies that might pop out, whether that’s the approval processes, or the individual that was working through that particular time frame, maybe somebody both entered and approved the transaction, whatever the case may be,” Hoffman said. “I think it would be prudent, in a time like this, to put a little bit of extra scrutiny around that.”

Scrutinize internal controls

Many not-for-profits’ controls may have changed profusely because of the pandemic.

Approvals that once were performed in person in the office now are being done through document management systems or through email. If controls were different before the pandemic and since the pandemic started, both sets should be examined and verified.

Clients should be asked to walk auditors step-by-step through their processes for cash disbursements, cash receipts, payroll, and journal entries. Auditors need to observe these controls at work, perhaps through a videoconference review.

“Maybe they are getting approvals through the accounting system,” Thomas said. “So show me how you approve it in the system? How do you log in to the system? Who can log in to the system? How do you click the approval? How do I see the approval? So it may be a Zoom walk-through of those controls, and the procedure is an observation by the auditor.”

Controls to prevent cybersecurity breaches also are especially important at this time. Hoffman attended a client audit committee meeting recently during which a large amount of discussion centered on a phishing scam to which the client had fallen victim.

“It’s a conversation that’s not ‘if’ but ‘when’; it will happen at most organizations,” Hoffman said. “That has become an increased focus since everybody is remote.”

Fraud risks

With many organizations and individuals facing economic challenges, the pandemic presents heightened risks of fraud.

Reporting of net assets on financial statements is one area that requires alertness on the part of auditors in this environment. Not-for-profits may be tempted to recognize restricted funds before meeting the conditions specified by the donors.

“I think foundations might not be ready to just write checks that are completely without limitations,” Popke said. “So they’re creating certain conditions on performance, and not-for-profits may be recognizing that revenue early, when the conditions haven’t been met. We’re reviewing more grant agreements, and we’re diving into revenue recognition a bit more than we would in general circumstances.”

Other areas to watch for fraud amid the pandemic include wire transfers, which may have increased dramatically during the pandemic, and inventory, which may require video observation or may not be able to be verified, in which case a scope exception may be necessary.

“It’s something auditors should consider,” Thomas said. “Can the auditor obtain sufficient reliable audit evidence through a remote audit? If they’re not able to obtain sufficient audit evidence, then there may be an issue of scope limitations or things they need to tackle before issuing the audit opinion.”

Economic relief payments

A new duty for auditors will be verifying that funds from the Coronavirus Aid, Relief, and Economic Security (CARES) Act, P.L. 116-136, and other economic relief payments have been accounted for properly.

If the Paycheck Protection Program’s (PPP’s) eligibility and loan forgiveness criteria are expected to be met, a nongovernmental not-for-profit should account for a PPP loan as a conditional contribution in accordance with FASB ASC Subtopic 958-605, according to AICPA Technical Questions and Answers issued in June. Otherwise, a nongovernmental not-for-profit may account for a PPP loan as a financial liability in accordance with FASB ASC Topic 470, Debt.

Practitioners say most of their clients are accounting for PPP loans as a conditional contribution. Popke said the extension of the covered period from eight weeks to 24 weeks resulted in almost all PPP funds being used to cover payroll for many of her clients, making loan forgiveness appear likely.

Auditors also will be inspecting the accounting for Provider Relief Fund money received by health care organizations, as well as the accounting for any federal relief funds provided to state and local governments.

For clients that have elected to defer payroll taxes under the CARES Act, auditors should verify that those taxes are accrued as a liability, even though they’re not being paid this year, Thomas said.

Any practitioner’s review of disclosures also would include verification that these funds and actions are disclosed properly.

Going concern and subsequent events

The dire economic circumstances resulting from the pandemic have placed an added emphasis on going concern for auditors as well as preparers.

“It always is important, but at a time like this, I think it gets a lot more attention and becomes a much more important audit exercise,” Hoffman said. “I think it comes to the top of the list in times like this and particularly when we think about the added liquidity and availability disclosure that got layered in for not-for-profits [in 2019].”

Subsequent events also are analyzed in each audit to ensure discovery and disclosure of important changes that occur between the end of the reporting period and the issuance of the financial statements. The pandemic’s volatile environment requires closer scrutiny for significant losses or impairment of assets.

“Did any of their big receivables become uncollectible because one of their big donors had a significant financial decline due to COVID-19 and is not able to pay?” Thomas said. “It’s important that the auditors consider the risk of the financial market and the crisis we’re in when conducting the subsequent event procedures. They have to factor in the impact of COVID-19 on those procedures.”

Ken Tysiac (Kenneth.Tysiac@aicpa-cima.com) is the JofA’s editorial director.

SPONSORED REPORT

Get your clients ready for tax season

Upon its enactment in March, the American Rescue Plan Act (ARPA) introduced many new tax changes, some of which retroactively affected 2020 returns. Making the right moves now can help you mitigate any surprises heading into 2022.

100th ANNIVERSARY

Black CPA Centennial, 1921–2021

With 2021 marking the 100th anniversary of the first Black licensed CPA in the United States, a yearlong campaign kicked off to recognize the nation’s Black CPAs and encourage greater progress in diversity, inclusion, and equity in the CPA profession.