This is the accessible text file for GAO report number GAO-07-162G 
entitled 'Government Auditing Standards: January 2007 Revision' which 
was released on February 1, 2007. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

By the Comptroller General of the United States: 

January 2007: 

Government Auditing Standards: January 2007 Revision: 

GAO-07-162G: 

Letter: 

Chapter 1: Use and Application of GAGAS: 

Introduction: 

Purpose and Applicability of GAGAS: 

Use of Terminology to Define Professional Requirements in GAGAS: 

Stating Compliance with GAGAS in the Auditors' Report: 

Relationship between GAGAS and Other Professional Standards: 

Types of GAGAS Audits and Attestation Engagements: 

Chapter 2: Ethical Principles in Government Auditing: 

Introduction: 

Ethical Principles: 

Chapter 3: General Standards: 

Introduction: 

Independence: 

Professional Judgment: 

Competence: 

Chapter 4: Field Work Standards for Financial Audits: 

Introduction: 

AICPA Field Work Standards: 

Additional Government Auditing Standards: 

Additional Considerations for GAGAS Financial Audits: 

Chapter 5: Reporting Standards for Financial Audits: 

Introduction: 

AICPA Reporting Standards: 

Additional Government Auditing Standards: 

Chapter 6: General, Field Work, and Reporting Standards for Attestation 
Engagements: 

Introduction: 

AICPA General and Field Work Standards for Attestation Engagements: 

Additional Government Auditing Standards: 

Additional Considerations for GAGAS Attestation Engagements: 

AICPA Reporting Standards for Attestation Engagements: 

Additional Government Auditing Standards: 

Chapter 7: Field Work Standards for Performance Audits: 

Introduction: 

Reasonable Assurance: 

Significance in a Performance Audit: 

Audit Risk: 

Planning: 

Supervision: 

Obtaining Sufficient, Appropriate Evidence: 

Audit Documentation: 

Chapter 8: Reporting Standards for Performance Audits: 

Introduction: 

Reporting: 

Report Contents: 

Distributing Reports: 

Appendixes: 

Appendix I: Supplemental Guidance: 

Introduction: 

Overall Supplemental Guidance: 

Information to Accompany Chapter 1: 

Information to Accompany Chapter 3: 

Information to Accompany Chapter 7: 

Information to Accompany Chapter 8: 

Appendix II: Comptroller General's Advisory Council on Government 
Auditing Standards: 

Advisory Council Members: 

GAO Project Team: 

Index: 

The principles of transparency and accountability for the use of public 
resources are key to our nation's governing processes. Government 
officials and recipients of federal monies are responsible for carrying 
out public functions efficiently, economically, effectively, ethically, 
and equitably, while achieving desired program objectives. High-quality 
auditing is essential for government accountability to the public and 
transparency regarding linking resources to related program results. 
Auditing of government programs should provide independent, objective, 
fact-based, nonpartisan assessments of the stewardship, performance, 
and cost of government policies, programs, and operations. Government 
audits also provide key information to stakeholders and the public to 
maintain accountability; help improve program performance and 
operations; reduce costs; facilitate decision making; stimulate 
improvements; and identify current and projected crosscutting issues 
and trends that affect government programs and the people those 
programs serve. 

Letter The professional standards presented in this document provide a 
framework for performing high-quality audit work with competence, 
integrity, objectivity, and independence. I firmly believe that 
government auditors should lead by example in the areas of 
transparency, performance, accountability, and quality through the 
audit process. 

Current trends and fiscal challenges make auditor oversight especially 
important to help ensure that public functions are carried out 
efficiently, economically, effectively, ethically, and equitably while 
limiting exposure to fraud, waste, mismanagement, and abuse. Government 
auditing plays a major role in improving government operations and 
services, and in the important dialogue on the future of government 
programs by providing the objective analysis and information needed to 
make the decisions necessary to help create a better future. GAO will 
continue its efforts to lead by example in all of these areas. 

The 2007 revision of Government Auditing Standards supersedes the 2003 
revision. As noted on the cover, the January 2007 version contains the 
final 2007 revisions to the standards, except for the quality control 
and peer review sections in chapter 3. Concurrent with the electronic 
issuance of this revision of Government Auditing Standards, we are 
exposing for comment redrafted sections on quality control and peer 
review in response to the wide range of comments we received on those 
sections. The completed 2007 revision of Government Auditing Standards 
will be available after the quality assurance and peer review sections 
are finalized and incorporated into the standards. Electronic versions 
of the documents can be accessed on the Web at [Hyperlink, 
http://www.gao.gov/govaud/ybk01.htm]. 

This revision contains the following fundamental changes that reinforce 
the principles of transparency and accountability, and provide the 
framework for high quality government audits that add value. 

* Heightened the emphasis on ethical principles as the foundation, 
discipline, and structure behind the implementation of the standards, 
including a description of five key ethical principles that should 
guide the work of those who audit government programs and operations. 

* Clarified and streamlined the discussion of the impact of 
professional services other than audit services (nonaudit services) and 
their impact on auditor independence. 

* Updated the financial auditing standards based on recent developments 
in financial auditing and internal control, increased transparency 
surrounding restatements and significant concerns, uncertainties, or 
other unusual events that could have a significant impact on the 
financial condition or operations of a government entity or program. 

* Enhanced performance auditing standards that elaborate on the overall 
framework for high-quality performance auditing, including the concepts 
of reasonable assurance and its relationship to audit risk and the 
levels of evidence used to support audit findings and conclusions. 

* Clarified the standards through standardized language to define the 
auditor's level of responsibility and distinguish between auditor 
requirements and additional guidance. 

* Reinforced the key role of auditing in maintaining accountability and 
providing information for making improvements in government operations. 

This revision of the standards has gone through an extensive 
deliberative process, including public comments and input from the 
Comptroller General's Advisory Council on Government Auditing 
Standards. The Advisory Council includes 26 experts in financial and 
performance auditing and reporting drawn from federal, state, and local 
government; the private sector; and academia. The views of all parties 
were thoroughly considered in finalizing the standards. 

The complete 2007 revision of Government Auditing Standards will be 
available after the quality assurance and peer review sections are 
finalized and incorporated into the standards and will be effective for 
financial audits and attestation engagements for periods beginning on 
or after January 1, 2008, and for performance audits beginning on or 
after January 1, 2008. Early implementation is permissible and 
encouraged. 

I extend special thanks to the members of the Advisory Council for 
their extensive input and feedback through the entire process of 
developing and finalizing the standards. 

Signed by: 

David M. Walker: 
Comptroller General of the United States: 

January 2007: 

[End of section] 

Chapter 1: Use and Application of GAGAS: 

Introduction: 

1.01 Auditing is essential to government accountability to the public. 
Audits and attestation engagements provide an independent, objective, 
nonpartisan assessment of the stewardship, performance, or cost of 
government policies, programs, or operations, depending upon the type 
and scope of the audit. 

1.02 The concept of accountability for use of public resources and 
government authority is key to our nation's governing processes. 
Government officials entrusted with public resources are responsible 
for carrying out public functions legally, effectively, efficiently, 
economically, ethically, and equitably.[Footnote 1] Government managers 
are responsible for providing reliable, useful, and timely information 
for accountability of government programs and their operations. (See 
appendix I paragraph A1.08 for additional information on management's 
responsibility.) Legislators, government officials, and the public need 
to know whether (a) government manages public resources and uses its 
authority properly and in compliance with laws and regulations; (b) 
government programs are achieving their objectives and desired 
outcomes; (c) government services are provided effectively, 
efficiently, economically, ethically, and equitably; and (d) government 
managers are held accountable for their use of public resources. 

Purpose and Applicability of GAGAS: 

1.03 The professional standards and guidance contained in this 
document, commonly referred to as generally accepted government 
auditing standards (GAGAS), provide a framework for conducting high 
quality government audits and attestation engagements with competence, 
integrity, objectivity, and independence. These standards are for use 
by auditors[Footnote 2] of government entities and entities that 
receive government awards and audit organizations[Footnote 3] 
performing GAGAS audits and attestation engagements. GAGAS contain 
requirements and guidance dealing with ethics, independence, auditors' 
professional competence and judgment, quality control, the performance 
of field work, and reporting. Audits and attestation engagements 
performed under GAGAS provide information used for oversight, 
accountability, and improvements of government programs and operations. 
GAGAS contain requirements and guidance to assist auditors in 
objectively acquiring and evaluating sufficient, appropriate evidence 
and reporting the results. When auditors perform their work in this 
manner and comply with GAGAS in reporting the results, their work can 
lead to improved government management, better decision making and 
oversight, effective and efficient operations, and accountability for 
resources and results. 

1.04 Laws, regulations, contracts, grant agreements, or policies 
frequently require audits in accordance with GAGAS. Many auditors and 
audit organizations also voluntarily choose to perform their work in 
accordance with GAGAS. The requirements and guidance in this document 
apply to audits and attestation engagements of government entities, 
programs, activities, and functions, and of government assistance 
administered by contractors, nonprofit entities, and other 
nongovernmental entities when the use of GAGAS is required or is 
voluntarily followed. 

Use of Terminology to Define Professional Requirements in GAGAS: 

1.05 GAGAS contain professional requirements together with related 
guidance in the form of explanatory material.[Footnote 4] Auditors have 
a responsibility to consider the entire text of GAGAS in carrying out 
their work and in understanding and applying the professional 
requirements in GAGAS. 

1.06 Not every paragraph of GAGAS carries a professional requirement 
that auditors and audit organizations are expected to fulfill. Rather, 
the professional requirements are identified through use of specific 
language. 

1.07 GAGAS use two categories of professional requirements, identified 
by specific terms, to describe the degree of responsibility they impose 
on auditors and audit organizations, as follows: 

a. Unconditional requirements: Auditors and audit organizations are 
required to comply with an unconditional requirement in all cases in 
which the circumstances exist to which the unconditional requirement 
applies. GAGAS use the words must or is required to specify an 
unconditional requirement. 

b. Presumptively mandatory requirements: Auditors and audit 
organizations are also required to comply with a presumptively 
mandatory requirement in all cases in which the circumstances exist to 
which the presumptively mandatory requirement applies; however, in rare 
circumstances, auditors and audit organizations may depart from a 
presumptively mandatory requirement provided they document their 
justification for the departure and how the alternative procedures 
performed in the circumstances were sufficient to achieve the 
objectives of the presumptively mandatory requirement. GAGAS use the 
word should to specify a presumptively mandatory requirement. 

1.08 Explanatory material is defined as the text within GAGAS 
(including appendix I) other than the requirements defined in paragraph 
1.07. Explanatory material uses the words may, might, and could to 
describe explanatory information and is provided to: 

a. provide further explanation and guidance on the professional 
requirements or: 

b. identify and describe other procedures or actions relating to 
auditors' or audit organizations' activities. 

1.09 Explanatory material is intended to be descriptive rather than 
required. This material is intended, for example, to explain the 
objective of a requirement where it would be useful to do so; explain 
why particular procedures may be considered or employed under certain 
circumstances; or provide additional information to consider in 
exercising professional judgment. 

1.10 Explanatory material that identifies and describes other 
procedures or actions does not impose a professional requirement on the 
auditor or audit organization to perform the suggested procedures or 
actions. How and whether to carry out such procedures or actions 
depends on the exercise of professional judgment consistent with the 
objective of the standard. 

Stating Compliance with GAGAS in the Auditors' Report: 

1.11 When auditors are required to follow GAGAS or are representing to 
others that they followed GAGAS, all applicable GAGAS requirements 
should be followed and the auditors' report should refer to compliance 
with GAGAS as set forth in paragraphs 1.12 and 1.13. 

1.12 Auditors should include one of the following types of GAGAS 
compliance statements in reports on GAGAS audits and attestation 
engagements, as appropriate.[Footnote 5] 

a. Unmodified GAGAS compliance statement: Stating that the auditor 
performed the audit or attestation engagement in accordance with GAGAS. 
Auditors should include an unmodified GAGAS compliance statement in the 
audit report when they have (1) followed all applicable unconditional 
and presumptively mandatory GAGAS requirements, or (2) have followed 
all unconditional requirements and documented justification for any 
departures from applicable presumptively mandatory requirements, and 
have achieved the objectives of those requirements through other means. 

b. Modified GAGAS compliance statement: Stating either (1) that the 
auditor performed the audit or attestation engagement in accordance 
with GAGAS, except for specific applicable requirements that were not 
followed or, (2) because of the significance of the departure(s) from 
the requirements, the auditor was unable to and did not perform the 
audit or attestation engagement in accordance with GAGAS. Situations 
when auditors use modified compliance statements include scope 
limitations, such as restrictions on access to records. When auditors 
use a modified GAGAS statement, they should disclose in the report the 
applicable requirement(s) not followed, the reasons for not following 
the requirement(s), and how not following the requirements affected, or 
could have affected, the audit and the assurance provided. 

1.13 When auditors do not comply with any applicable requirements, they 
should assess the significance to the audit objectives, and they should 
document the assessment, along with their reasons for not following the 
requirement. Based on this assessment, auditors should determine the 
type of GAGAS compliance statement. The auditors' determination will 
depend on the significance of the requirements not followed in relation 
to the audit objectives. 

Relationship between GAGAS and Other Professional Standards: 

1.14 Auditors may use GAGAS in conjunction with professional standards 
issued by other authoritative bodies. Auditors may also cite the use of 
other standards in their audit reports, as appropriate. If the auditor 
is citing compliance with GAGAS and inconsistencies exist between GAGAS 
and other standards cited, the auditor should use GAGAS as the 
prevailing standard for conducting the audit and reporting the results. 

1.15 The relationship between GAGAS and other professional standards 
for financial audits and attestation engagements is as follows: 

a. The American Institute of Certified Public Accountants (AICPA) has 
established professional standards that apply to financial audits and 
attestation engagements for nonissuers[Footnote 6] performed by 
certified public accountants (CPA). For financial audits, GAGAS 
incorporate the AICPA's field work and reporting standards and the 
related Statements on Auditing Standards (SAS)[Footnote 7] unless 
specifically excluded or modified by GAGAS. For attestation 
engagements, GAGAS incorporate the AICPA's general standard on 
criteria, and the field work and reporting standards and the related 
Statements on the Standards for Attestation Engagements (SSAE), unless 
specifically excluded or modified by GAGAS. GAGAS describe ethical 
principles, and establish independence and other general standards, and 
additional field work and reporting standards beyond those provided by 
the AICPA for performing financial audits and attestation engagements. 

b. The Public Company Accounting Oversight Board (PCAOB) has 
established professional standards that apply to financial audits and 
attestation engagements for issuers. Auditors may use GAGAS in 
conjunction with the PCAOB standards. 

c. The International Auditing and Assurance Standards Board (IAASB) has 
established professional standards that apply to financial audits and 
attestation engagements. Auditors may use GAGAS in conjunction with the 
IAASB standards and the related statements on International Statements 
on Auditing (ISA). 

1.16 For performance audits, auditors may use other professional 
standards in conjunction with GAGAS, such as the following: 

a. International Standards for the Professional Practice of Internal 
Auditing, The Institute of Internal Auditors, Inc; 

b. Guiding Principles for Evaluators, American Evaluation Association; 

c. The Program Evaluation Standards, Joint Committee on Standards for 
Education Evaluation; and: 

d. Standards for Educational and Psychological Testing, American 
Psychological Association. 

Types of GAGAS Audits and Attestation Engagements: 

1.17 This section describes the types of audits and attestation 
engagements that audit organizations may perform under GAGAS. This 
description is not intended to limit or require the types of audits or 
attestation engagements that may be performed under GAGAS. 

1.18 All audits and attestation engagements begin with objectives, and 
those objectives determine the type of audit to be performed and the 
applicable standards to be followed. The types of audits that are 
covered by GAGAS, as defined by their objectives, are classified in 
this document as financial audits, attestation engagements, and 
performance audits. 

1.19 In some audits and attestation engagements, the standards 
applicable to the specific audit objective will be apparent. For 
example, if the audit objective is to express an opinion on financial 
statements, the standards for financial audits apply. However, some 
engagements may have multiple or overlapping objectives. For example, 
if the objectives are to determine the reliability of performance 
measures, this work can be done in accordance with either the standards 
for attestation engagements or for performance audits. In cases in 
which there is a choice between applicable standards, auditors should 
evaluate users' needs and the auditors' knowledge, skills, and 
experience in deciding which standards to follow. 

1.20 GAGAS requirements apply to the types of audit and attestation 
engagements that may be performed under GAGAS as follows: 

a. Financial audits: chapters 1 through 5 apply. 

b. Attestation engagements: chapters 1 through 3 and 6 apply. 

c. Performance audits: chapters 1 through 3 and 7 and 8 apply. 

1.21 Appendix I includes supplemental guidance for auditors and the 
audited entities to assist in the implementation of GAGAS. Appendix I 
does not establish auditor requirements but instead is intended to 
facilitate auditor implementation of the standards contained in 
chapters 1 through 8. 

Financial Audits: 

1.22 Financial audits provide an independent assessment of and 
reasonable assurance about whether an entity's reported financial 
condition, results, and use of resources are presented fairly in 
accordance with recognized criteria. Reporting on financial audits 
performed in accordance with GAGAS also includes reports on internal 
control, compliance with laws and regulations, and provisions of 
contracts and grant agreements as they relate to financial 
transactions, systems, and processes. Financial audits performed under 
GAGAS include financial statement audits and other related financial 
audits: 

a. Financial statement audits: The primary purpose of a financial 
statement audit is to provide reasonable assurance through an opinion 
(or disclaim an opinion) about whether an entity's financial statements 
are presented fairly in all material respects in conformity with 
generally accepted accounting principles (GAAP),[Footnote 8] or with a 
comprehensive basis of accounting other than GAAP. 

b. Other types of financial audits: Other types of financial audits 
under GAGAS provide for different levels of assurance and entail 
various scopes of work, including: (1) providing special reports, such 
as for specified elements, accounts, or items of a financial 
statement;[Footnote 9](2) reviewing interim financial 
information;[Footnote 10] (3) issuing letters for underwriters and 
certain other requesting parties; (4) reporting on the controls over 
processing of transactions by service organizations;[Footnote 11] and 
(5) auditing compliance with regulations relating to federal award 
expenditures and other governmental financial assistance in conjunction 
with or as a by-product of a financial statement audit. 

Attestation Engagements: 

1.23 Attestation engagements can cover a broad range of financial or 
nonfinancial objectives and may provide different levels of assurance 
about the subject matter or assertion depending on the users' needs. 
Attestation engagements result in an examination, a review, or an 
agreed-upon procedures report on a subject matter or on an assertion 
about a subject matter that is the responsibility of another party. The 
three types of attestation engagements are: 

a. Examination: Consists of obtaining sufficient, appropriate evidence 
to express an opinion on whether the subject matter is based on (or in 
conformity with) the criteria in all material respects or the assertion 
is presented (or fairly stated), in all material respects, based on the 
criteria. 

b. Review: Consists of sufficient testing to express a conclusion about 
whether any information came to the auditors' attention on the basis of 
the work performed that indicates the subject matter is not based on 
(or not in conformity with) the criteria or the assertion is not 
presented (or not fairly stated) in all material respects based on the 
criteria.[Footnote 12] 

c. Agreed-Upon Procedures: Consists of specific procedures performed on 
a subject matter. 

1.24 The subject matter of an attestation engagement may take many 
forms. Possible subjects of attestation engagements include reporting 
on: 

a. prospective financial or performance information; 

b. management's discussion and analysis (MD&A) presentation; 

c. an entity's internal control over financial reporting; 

d. the effectiveness of an entity's internal control over compliance 
with specified requirements, such as those governing the bidding for, 
accounting for, and reporting on grants and contracts; 

e. an entity's compliance with requirements of specified laws, 
regulations, policies, contracts, or grants; 

f. the accuracy and reliability of reported performance measures; 

g. incurred final contract costs are supported with required evidence 
and in compliance with the contract terms; 

h. the allowability and reasonableness of proposed contract amounts 
that are based on detailed costs; 

i. the quantity, condition, or valuation of inventory or assets; and: 

j. specific procedures performed on a subject matter (agreed-upon 
procedures). 

Performance Audits: 

1.25 Performance audits are defined as engagements that provide 
assurance or conclusions based on an evaluation of sufficient, 
appropriate evidence against stated criteria, such as specific 
requirements, measures, or defined business practices. Performance 
audits provide objective analysis so that management and those charged 
with governance and oversight can use the information to improve 
program[Footnote 13] performance and operations, reduce costs, 
facilitate decision making by parties with responsibility to oversee or 
initiate corrective action, and contribute to public accountability. 
Reporting information without following GAGAS is not a performance 
audit but a nonaudit service provided by an audit organization. 

1.26 Performance audits that comply with GAGAS provide reasonable 
assurance that the auditors have obtained sufficient, appropriate 
evidence to support the conclusions reached. Thus, the sufficiency and 
appropriateness of evidence needed and tests of evidence will vary 
based on the audit objectives and conclusions. 

1.27 A performance audit is a dynamic process that includes 
consideration of the applicable standards throughout the course of the 
audit. An ongoing assessment of the objectives, audit risk, audit 
procedures, and evidence during the course of the audit facilitates the 
auditors' determination of what to report and the proper context for 
the audit conclusions, including discussion about the sufficiency and 
appropriateness of evidence being used as a basis for the audit 
conclusions. Performance audit conclusions logically flow from all of 
these elements and provide an assessment of the audit findings and 
their implications. 

1.28 Performance audit objectives may vary widely and include 
assessments of program effectiveness, economy, and efficiency; internal 
control;[Footnote 14] compliance; and prospective analyses. These 
overall objectives are not mutually exclusive. Thus, a performance 
audit may have more than one overall objective. For example, a 
performance audit with an initial objective of program effectiveness 
may also involve an underlying objective of evaluating internal 
controls to determine the reasons for a program's lack of effectiveness 
or how effectiveness can be improved. 

1.29 Program effectiveness and results audit objectives are frequently 
interrelated with economy and efficiency objectives. Audit objectives 
that focus on program effectiveness and results typically measure the 
extent to which a program is achieving its goals and objectives. Audit 
objectives that focus on economy and efficiency address the costs and 
resources used to achieve program results. Examples of audit objectives 
in these categories include: 

a. assessing the extent to which legislative, regulatory, or 
organizational goals and objectives are being achieved; 

b. assessing the relative ability of alternative approaches to yield 
better program performance or eliminate factors that inhibit program 
effectiveness; 

c. analyzing the relative cost-effectiveness of a program or 
activity;[Footnote 15] 

d. determining whether a program produced intended results or produced 
results that were not consistent with the program's objectives; 

e. determining the current status or condition of program operations or 
progress in implementing legislative requirements; 

f. determining whether a program provides equitable access to or 
distribution of public resources within the context of statutory 
parameters; 

g. assessing the extent to which programs duplicate, overlap, or 
conflict with other related programs; 

h. evaluating whether the audited entity is following sound procurement 
practices; 

i. assessing the reliability, validity, or relevance of performance 
measures concerning program effectiveness and results, or economy and 
efficiency; 

j. assessing the reliability, validity, or relevance of financial 
information related to the performance of a program; 

k. determining whether government resources (inputs) are obtained at 
reasonable costs while meeting timeliness and quality considerations; 

l. determining whether appropriate value was obtained based on the cost 
or amount paid or based on the amount of revenue received; 

m. determining whether government services and benefits are accessible 
to those individuals who have a right to access those services and 
benefits; 

n. determining whether fees assessed cover costs; 

o. determining whether and how the program's unit costs can be 
decreased or its productivity increased; and: 

p. assessing the reliability, validity, or relevance of budget 
proposals or budget requests to assist legislatures in the budget 
process. 

1.30 Internal control audit objectives relate to an assessment of the 
component of an organization's system of internal control that is 
designed to provide reasonable assurance of achieving effective and 
efficient operations, reliable financial and performance reporting, or 
compliance with applicable laws and regulations. Internal control 
objectives also may be relevant when determining the cause of 
unsatisfactory program performance. Internal control comprises the 
plans, policies, methods, and procedures used to meet the 
organization's mission, goals, and objectives. Internal control 
includes the processes and procedures for planning, organizing, 
directing, and controlling program operations, and management's system 
for measuring, reporting, and monitoring program performance. Examples 
of audit objectives related to internal control include an assessment 
of the extent to which internal control provides reasonable assurance 
about whether: 

a. organizational missions, goals, and objectives are achieved 
effectively and efficiently; 

b. resources are used in compliance with laws, regulations, or other 
requirements; 

c. resources, including sensitive information accessed or stored 
outside the organization's physical perimeter, are safeguarded against 
unauthorized acquisition, use, or disposition; 

d. management information, such as performance measures, and public 
reports are complete, accurate, and consistent to support performance 
and decision making; 

e. the integrity of information from computerized systems is achieved; 
and: 

f. contingency planning for information systems provides essential back-
up to prevent unwarranted disruption of the activities and functions 
that the systems support. 

1.31 Compliance audit objectives relate to compliance criteria 
established by laws, regulations, contract provisions, grant 
agreements, and other requirements[Footnote 16] that could affect the 
acquisition, protection, use, and disposition of the entity's resources 
and the quantity, quality, timeliness, and cost of services the entity 
produces and delivers. Compliance objectives include determining 
whether: 

a. the purpose of the program, the manner in which it is to be 
conducted, the services delivered, the outcomes, or the population it 
serves is in compliance with laws, regulations, contract provisions, 
grant agreements, and other requirements; 

b. government services and benefits are distributed or delivered to 
citizens based on the individual's eligibility to obtain those services 
and benefits; 

c. incurred or proposed costs are in compliance with applicable laws, 
regulations, and contracts or grant agreements; and: 

d. revenues received are in compliance with applicable laws, 
regulations, and contract or grant agreements. 

1.32 Prospective analysis audit objectives provide analysis or 
conclusions, about information that is based on assumptions about 
events that may occur in the future along with possible actions that 
the audited entity may take in response to the future events. Examples 
of objectives pertaining to this work include providing conclusions 
based on: 

a. current and projected trends and future potential impact on 
government programs and services; 

b. program or policy alternatives, including forecasting program 
outcomes under various assumptions; 

c. policy or legislative proposals, including advantages, 
disadvantages, and analysis of stakeholder views; 

d. prospective information prepared by management; 

e. budgets and forecasts that are based on (1) assumptions about 
expected future events and (2) management's expected reaction to those 
future events; and: 

f. management's assumptions on which prospective information is based. 

Professional Services Other Than Audits (Nonaudit Services) Provided by 
Audit Organizations: 

1.33 GAGAS do not cover professional services other than audits 
(nonaudit services) since such services are not audits or attestation 
engagements. (See paragraphs 3.25 through 3.30 for additional 
discussion of nonaudit services.) Therefore, auditors must not report 
that the nonaudit services were conducted in accordance with GAGAS. 
When performing nonaudit services for an entity for which the audit 
organization performs a GAGAS audit or attestation engagement, audit 
organizations should communicate, as appropriate, with requestors and 
those charged with governance to clarify that the scope of work 
performed does not constitute an audit under GAGAS. 

1.34 Audit organizations that provide nonaudit services must evaluate 
whether providing nonaudit services creates an independence impairment 
either in fact or appearance with respect to the entities they audit. 
(See paragraph 3.02.) 

[End of section] 

Chapter 2: Ethical Principles in Government Auditing: 

Introduction: 

2.01 Because auditing is essential to government accountability to the 
public, the public expects audit organizations and auditors who conduct 
their work in accordance with GAGAS to follow ethical principles. 
Management of the audit organization sets the tone for ethical behavior 
throughout the organization by maintaining an ethical culture, clearly 
communicating acceptable behavior and expectations to each employee, 
and creating an environment that reinforces and encourages ethical 
behavior throughout all levels of the organization. The ethical tone 
maintained and demonstrated by management and staff is an essential 
element of a positive ethical environment for the audit organization. 

2.02 The ethical principles presented in this chapter provide the 
foundation, discipline, and structure as well as the climate which 
influence the application of GAGAS. Because the information presented 
in this chapter deals with fundamental principles rather than specific 
requirements, this chapter does not contain additional requirements. 

2.03 Conducting audit work in accordance with ethical principles is a 
matter of personal and organizational responsibility. Ethical 
principles apply in preserving auditor independence,[Footnote 17] 
taking on only work that the auditor is competent to perform, 
performing high-quality work, and following the applicable standards 
cited in the audit report. Integrity and objectivity are maintained 
when auditors perform their work and make decisions that are consistent 
with the broader interest of those relying on the auditors' report, 
including the public. 

Ethical Principles: 

2.04 The ethical principles contained in the following sections provide 
the overall framework for application of GAGAS, including general 
standards, field work standards, and reporting standards. Each 
principle is described, rather than set forth as a series of 
requirements, so that auditors can consider the facts and circumstances 
of each situation within the framework of these ethical principles. 
Other ethical requirements or codes of professional conduct may also be 
applicable to auditors who conduct audits in accordance with 
GAGAS.[Footnote 18] 

2.05 The ethical principles that guide the work of auditors who conduct 
audits in accordance with GAGAS are: 

a. the public interest; 

b. integrity; 

c. objectivity; 

d. proper use of government information, resources, and position; and: 

e. professional behavior. 

The Public Interest: 

2.06 The public interest is defined as the collective well-being of the 
community of people and entities the auditors serve. Observing 
integrity, objectivity, and independence in discharging their 
professional responsibilities assists auditors in meeting the principle 
of serving the public interest and honoring the public trust. These 
principles are fundamental to the responsibilities of auditors and 
critical in the government environment. 

2.07 A distinguishing mark of an auditor is acceptance of 
responsibility to serve the public interest. This responsibility is 
critical when auditing in the government environment. GAGAS embody the 
concept of accountability for public resources, which is fundamental to 
serving the public interest. 

Integrity: 

2.08 Public confidence in government is maintained and strengthened by 
auditors' performing their professional responsibilities with 
integrity. Integrity includes auditors' conducting their work with an 
attitude that is objective, fact-based, nonpartisan, and nonideological 
with regard to audited entities and users of the auditors' reports. 
Within the constraints of applicable confidentiality laws, rules, or 
policies, communications with the audited entity, those charged with 
governance, and the individuals contracting for or requesting the audit 
are expected to be honest, candid, and constructive. 

2.09 Making decisions consistent with the public interest of the 
program or activity under audit is an important part of the principle 
of integrity. In discharging their professional responsibilities, 
auditors may encounter conflicting pressures from management of the 
audited entity, various levels of government, and other likely users. 
Auditors may also encounter pressures to violate ethical principles to 
inappropriately achieve personal or organizational gain. In resolving 
those conflicts and pressures, acting with integrity means that 
auditors place priority on their responsibilities to the public 
interest. 

Objectivity: 

2.10 The credibility of auditing in the government sector is based on 
auditors' objectivity in discharging their professional 
responsibilities. Objectivity includes being independent in fact and 
appearance when providing audit and attestation services, maintaining 
an attitude of impartiality, having intellectual honesty, and being 
free of conflicts of interest. Avoiding conflicts that may, in fact or 
appearance, impair auditors' objectivity in performing the audit or 
attestation engagement is essential to retaining credibility. 
Maintaining objectivity includes a continuing assessment of 
relationships with audited entities and other stakeholders in the 
context of the auditors' responsibility to the public.[Footnote 19] 

Proper Use of Government Information, Resources, and Position: 

2.11 Government information, resources, or positions are to be used for 
official purposes and not inappropriately for the auditor's personal 
gain or in a manner contrary to law or detrimental to the legitimate 
interests of the audited entity or the audit organization. This concept 
includes the proper handling of sensitive or classified information or 
resources. 

2.12 In the government environment, the public's right to the 
transparency of government information has to be balanced with the 
proper use of that information. In addition, many government programs 
are subject to laws and regulations dealing with the disclosure of 
information. To accomplish this balance, exercising discretion in the 
use of information acquired in the course of auditors' duties is an 
important part in achieving this goal. Improperly disclosing any such 
information to third parties is not an acceptable practice. 

2.13 As accountability professionals, accountability to the public for 
the proper use and prudent management of government resources is an 
essential part of auditors' responsibilities. Protecting and conserving 
government resources and using them appropriately for authorized 
activities is an important element in the public's expectations for 
auditors. 

2.14 Misusing the position of an auditor for personal gain violates an 
auditor's fundamental responsibilities. An auditor's credibility can be 
damaged by actions that could be perceived by an objective third party 
with knowledge of the relevant information as improperly benefiting an 
auditor's personal financial interests or those of an immediate or 
close family member; a general partner; an organization for which the 
auditor serves as an officer, director, trustee, or employee; or an 
organization with which the auditor is negotiating concerning future 
employment. (See paragraphs 3.07 through 3.09 for further discussion of 
personal impairments to independence.) 

Professional Behavior: 

2.15 High expectations for the auditing profession include compliance 
with laws and regulations and avoidance of any conduct that might bring 
discredit to auditors' work, including actions that would cause an 
objective third party with knowledge of the relevant information to 
conclude that the auditors' work was professionally deficient. 
Professional behavior includes auditors' putting forth an honest effort 
in performance of their duties and professional services in accordance 
with the relevant technical and professional standards. 

[End of section] 

Chapter 3: General Standards: 

Introduction: 

3.01 This chapter establishes general standards and provides guidance 
for performing financial audits, attestation engagements, and 
performance audits under GAGAS. (See chapter 6 for an additional 
general standard applicable only to attestation engagements.) These 
general standards, along with the overarching ethical principles 
presented in chapter 2, establish a foundation for credibility of 
auditors' work. These general standards emphasize the independence of 
the audit organization and its individual auditors; the exercise of 
professional judgment in the performance of work and the preparation of 
related reports; the competence of audit staff; audit quality control 
and assurance; and external peer reviews. 

Independence: 

3.02 In all matters relating to the audit work, the audit organization 
and the individual auditor, whether government or public, must be free 
from personal, external, and organizational impairments to 
independence, and must avoid the appearance of such impairments of 
independence. 

3.03 Auditors and audit organizations must maintain independence so 
that their opinions, findings, conclusions, judgments, and 
recommendations will be impartial and viewed as impartial by objective 
third parties with knowledge of the relevant information. Auditors 
should avoid situations that could lead objective third parties with 
knowledge of the relevant information to conclude that the auditors are 
not able to maintain independence and thus are not capable of 
exercising objective and impartial judgment on all issues associated 
with conducting the audit and reporting on the work. 

3.04 When evaluating whether independence impairments exist either in 
fact or appearance with respect to the entities for which audit 
organizations perform audit or attestation services, auditors and audit 
organizations must take into account the three general classes of 
impairments to independence--personal, external, and 
organizational.[Footnote 20] If one or more of these impairments 
affects or can be perceived to affect independence, the audit 
organization (or auditor) should decline to perform the work--except in 
those situations in which an audit organization in a government entity, 
because of a legislative requirement or for other reasons, cannot 
decline to perform the work, in which case the government audit 
organization must disclose the impairment(s) and modify the GAGAS 
compliance statement. (See paragraphs 1.12 and 1.13.) 

3.05 When auditors use the work of a specialist,[Footnote 21] auditors 
should assess the specialist's ability to perform the work and report 
results impartially as it relates to their relationship with the 
program or entity under audit. If the specialist's independence is 
impaired, auditors should not use the work of that specialist. 

3.06 If an impairment to independence is identified after the audit 
report is issued, the audit organization should assess the impact on 
the audit. If the audit organization concludes that it did not comply 
with GAGAS it should determine the impact on the auditors' report and 
notify entity management, those charged with governance, the 
requesters, or regulatory agencies that have jurisdiction over the 
audited entity and persons known to be using the audit report about the 
independence impairment and the impact on the audit. The audit 
organization should make such notifications in writing. 

Personal Impairments: 

3.07 Auditors participating on an audit assignment must be free from 
personal impairments to independence.[Footnote 22] Personal impairments 
of auditors result from relationships or beliefs that might cause 
auditors to limit the extent of the inquiry, limit disclosure, or 
weaken or slant audit findings in any way. Individual auditors should 
notify the appropriate officials within their audit organizations if 
they have any personal impairment to independence. Examples of personal 
impairments of individual auditors include, but are not limited to, the 
following: 

a. immediate family or close family member[Footnote 23] who is a 
director or officer of the audited entity, or, as an employee of the 
audited entity, is in a position to exert direct and significant 
influence over the entity or the program under audit; 

b. financial interest that is direct, or is significant/material though 
indirect, in the audited entity or program;[Footnote 24] 

c. responsibility for managing an entity or making decisions that could 
affect operations of the entity or program being audited; for example 
serving as a director, officer, or other senior position of the entity, 
activity, or program being audited, or as a member of management in any 
decision making, supervisory, or ongoing monitoring function for the 
entity, activity, or program under audit; 

d. concurrent or subsequent performance of an audit by the same 
individual who maintained the official accounting records when such 
services involved preparing source documents or originating data, in 
electronic or other form; posting transactions (whether coded by 
management or not coded); authorizing, executing, or consummating 
transactions (for example, approving invoices, payrolls, claims, or 
other payments of the entity or program being audited); maintaining an 
entity's bank account or otherwise having custody of the audited 
entity's funds; or otherwise exercising authority on behalf of the 
entity, or having authority to do so; 

e. preconceived ideas toward individuals, groups, organizations, or 
objectives of a particular program that could bias the audit; 

f. biases, including those resulting from political, ideological, or 
social convictions that result from membership or employment in, or 
loyalty to, a particular type of policy, group, organization, or level 
of government; and: 

g. seeking employment during the conduct of the audit with an audited 
organization. 

3.08 Audit organizations and auditors may encounter many different 
circumstances or combinations of circumstances that could create a 
personal impairment. Therefore, it is impossible to identify every 
situation that could result in a personal impairment. Accordingly, 
audit organizations should include as part of their quality control 
system procedures to identify personal impairments and help ensure 
compliance with GAGAS independence requirements. At a minimum, audit 
organizations should: 

a. establish policies and procedures to identify, report, and resolve 
personal impairments to independence, 

b. communicate the audit organization's policies and procedures to all 
auditors in the organization and promote understanding of the policies 
and procedures, 

c. establish internal policies and procedures to monitor compliance 
with the audit organization's policies and procedures, 

d. establish a disciplinary mechanism to promote compliance with the 
audit organization's policies and procedures, 

e. stress the importance of independence and the expectation that 
auditors will always act in the public interest, and: 

f. maintain documentation of the steps taken to identify potential 
personal independence impairments. 

3.09 When the audit organization identifies a personal impairment to 
independence prior to or during an audit, the audit organization should 
take action to resolve the impairment in a timely manner. In situations 
in which the personal impairment is applicable only to an individual 
auditor or a specialist on a particular audit, the audit organization 
may be able to eliminate the personal impairment. For example, the 
audit organization could remove that auditor or specialist from any 
work on that audit or require the auditor or specialist to eliminate 
the cause of the personal impairment. If the personal impairment cannot 
be eliminated, the audit organization should withdraw from the audit. 
In situations in which auditors employed by government entities cannot 
withdraw from the audit, they should follow paragraph 3.04. 

External Impairments: 

3.10 Audit organizations must be free from external impairments to 
independence. Factors external to the audit organization may restrict 
the work or interfere with auditors' ability to form independent and 
objective opinions, findings, and conclusions. External impairments to 
independence occur when auditors are deterred from acting objectively 
and exercising professional skepticism by pressures, actual or 
perceived, from management and employees of the audited entity or 
oversight organizations. For example, under the following conditions, 
auditors may not have complete freedom to make an independent and 
objective judgment, thereby adversely affecting the audit: 

a. external interference or influence that could improperly limit or 
modify the scope of an audit or threaten to do so, including exerting 
pressure to inappropriately reduce the extent of work performed in 
order to reduce costs or fees; 

b. external interference with the selection or application of audit 
procedures or in the selection of transactions to be examined; 

c. unreasonable restrictions on the time allowed to complete an audit 
or issue the report; 

d. externally imposed restriction on access to records, government 
officials, or other individuals needed to conduct the audit; 

e. external interference over the assignment, appointment, 
compensation, and promotion of audit personnel; 

f. restrictions on funds or other resources provided to the audit 
organization that adversely affect the audit organization's ability to 
carry out its responsibilities; 

g. authority to overrule or to inappropriately influence the auditors' 
judgment as to the appropriate content of the report; 

h. threat of replacing the auditors over a disagreement with the 
contents of an audit report, the auditors' conclusions, or the 
application of an accounting principle or other criteria; and: 

i. influences that jeopardize the auditors' continued employment for 
reasons other than incompetence, misconduct, or the need for audit 
services. 

3.11 Audit organizations should include policies and procedures for 
identifying and resolving external impairments as part of their quality 
control system for compliance with GAGAS independence requirements. 

Organizational Independence: 

3.12 The ability of audit organizations in government entities to 
perform work and report the results objectively can be affected by 
placement within government, and the structure of the government entity 
being audited. Whether reporting to third parties externally or to top 
management within the audited entity internally, audit organizations 
must be free from organizational impairments to independence with 
respect to the entities they audit. Impairments to organizational 
independence result when the audit function is organizationally located 
within the reporting line of the areas under audit or when the auditor 
is assigned or takes on responsibilities that affect operations of the 
area under audit. 

Organizational Independence for External Audit Organizations: 

3.13 External audit organizations can be presumed to be free from 
organizational impairments to independence when the audit function is 
organizationally placed outside the reporting line of the entity under 
audit and the auditor is not responsible for entity operations. Audit 
organizations in government entities can meet the requirement for 
organizational independence in a number of ways and may be presumed to 
be free from organizational impairments to independence from the 
audited entity if the audit organization is: 

a. at a level of government other than the one to which the audited 
entity is assigned (federal, state, or local); for example, federal 
auditors auditing a state government program or: 

b. in a different branch of government within the same level of 
government as the audited entity; for example, legislative auditors 
auditing an executive branch program. 

3.14 Audit organizations in government entities may also be presumed to 
be free from organizational impairments if the head of the audit 
organization meets any of the following criteria: 

a. directly elected by voters of the jurisdiction being audited; 

b. elected or appointed by a legislative body, subject to removal by a 
legislative body, and reports the results of audits to and is 
accountable to a legislative body; 

c. appointed by someone other than a legislative body, so long as the 
appointment is confirmed by a legislative body and removal from the 
position is subject to oversight or approval by a legislative 
body,[Footnote 25] and reports the results of audits to and is 
accountable to a legislative body; or: 

d. appointed by, accountable to, reports to, and can only be removed by 
a statutorily created governing body, the majority of whose members are 
independently elected or appointed and come from outside the 
organization being audited. 

3.15 In addition to the presumptive criteria in paragraphs 3.13 and 
3.14, GAGAS recognize that there may be other organizational structures 
under which audit organizations in government entities could be 
considered to be free from organizational impairments and thereby be 
considered organizationally independent for reporting externally. These 
structures should provide safeguards to prevent the audited entity from 
interfering with the audit organization's ability to perform the work 
and report the results impartially. For an external audit organization 
to be considered free from organizational impairments under a structure 
different from the ones listed in paragraphs 3.13 and 3.14, the audit 
organization should have all of the following safeguards. In such 
situations, the audit organization should document how each of the 
following safeguards were satisfied and provide the documentation to 
those performing quality control monitoring and to the external peer 
reviewers to determine whether all the necessary safeguards have been 
met. 

a. statutory protections that prevent the audited entity from 
abolishing the audit organization, 

b. statutory protections that require that if the head of the audit 
organization is removed from office, the head of the agency report this 
fact and the reasons for the removal to the legislative body, 

c. statutory protections that prevent the audited entity from 
interfering with the initiation, scope, timing, and completion of any 
audit, 

d. statutory protections that prevent the audited entity from 
interfering with audit reporting, including the findings and 
conclusions or the manner, means, or timing of the audit organization's 
reports, 

e. statutory protections that require the audit organization to report 
to a legislative body or other independent governing body on a 
recurring basis, 

f. statutory protections that give the audit organization sole 
authority over the selection, retention, advancement, and dismissal of 
its staff, and: 

g. statutory access to records and documents related to the agency, 
program, or function being audited and access to government officials 
or other individuals as needed to conduct the audit.[Footnote 26] 

Organizational Independence for Internal Audit Functions: 

3.16 Certain federal, state, or local government entities employ 
auditors to work for management of the audited entities. These auditors 
may be subject to administrative direction from persons involved in the 
entity management process. Such audit organizations are internal audit 
functions and are encouraged to use the IIA International Standards for 
the Professional Practice of Internal Auditing in conjunction with 
GAGAS. Under GAGAS, a government internal audit function can be 
presumed to be free from organizational impairments to independence if 
the head of the audit organization meets all of the following criteria: 

a. is accountable to the head or deputy head of the government entity 
or to those charged with governance, 

b. reports the audit results both to the head or deputy head of the 
government entity and to those charged with governance, 

c. is located organizationally outside the staff or line-management 
function of the unit under audit, 

d. has access to those charged with governance, and: 

e. is sufficiently removed from political pressures to conduct audits 
and report findings, opinions, and conclusions objectively without fear 
of political reprisal. 

3.17 The internal audit organization should report regularly to those 
charged with governance. 

3.18 When internal audit organizations that are free of organizational 
impairments perform audits of external parties such as auditing 
contractors or outside party agreements, and no personal or external 
impairments exist, they may be considered independent of the audited 
entities and free to report objectively to the heads or deputy heads of 
the government entities to which they are assigned, to those charged 
with governance, and to parties outside the organizations in accordance 
with applicable law, rule, regulation, or policy. 

3.19 The internal audit organization should document the conditions 
that allow it to be considered free of organizational impairments to 
independence for internal reporting and provide the documentation to 
those performing quality control monitoring and to the external peer 
reviewers to determine whether all the necessary safeguards have been 
met. 

Organizational Independence When Performing Nonaudit Services: 

3.20 Audit organizations at times may perform other professional 
services (nonaudit services) that are not performed in accordance with 
GAGAS. Audit organizations that provide nonaudit services should 
evaluate whether providing the services creates an independence 
impairment either in fact or appearance with respect to entities they 
audit.[Footnote 27] Based on the facts and circumstances, professional 
judgment is used in determining whether a nonaudit service would impair 
an audit organization's independence with respect to entities it 
audits. 

3.21 Audit organizations in government entities generally have broad 
audit responsibilities and, therefore, should establish policies and 
procedures for accepting engagements to perform nonaudit services so 
that independence is not impaired with respect to entities they audit. 
(See appendix I, paragraphs A3.02 and A3.03 for examples of nonaudit 
services that are generally specific to audit organizations in 
government entities that generally do not impair the organizations' 
independence with respect to the entities it audits and, therefore, do 
not require compliance with the supplemental safeguards described in 
paragraph 3.30.) Independent public accountants may provide audit and 
nonaudit services (commonly referred to as consulting) under 
contractual commitments to an entity and should consider whether 
nonaudit services they have provided or are committed to provide have a 
significant or material effect on the subject matter of the audits. 

Overarching Independence Principles: 

3.22 The following two overarching principles apply to auditor 
independence when assessing the impact of performing a nonaudit service 
for an audited program or entity: 

(1) audit organizations must not provide nonaudit services that involve 
performing management functions or making management decisions and (2) 
audit organizations must not audit their own work or provide nonaudit 
services in situations in which the nonaudit services are significant 
or material to the subject matter of the audits.[Footnote 28] 

3.23 In considering whether audits performed by the audit organization 
could be significantly or materially affected by the nonaudit service, 
audit organizations should evaluate (1) ongoing audits; (2) planned 
audits; (3) requirements and commitments for providing audits, which 
includes laws, regulations, rules, contracts, and other agreements; and 
(4) policies placing responsibilities on the audit organization for 
providing audit services. 

3.24 If requested[Footnote 29] to perform nonaudit services that would 
impair the audit organization's ability to meet either or both of the 
overarching independence principles for certain types of audit work, 
the audit organization should inform the requestor and the audited 
entity that performing the nonaudit service would impair the auditors' 
independence with regard to subsequent audit or attestation 
engagements. 

Types of Nonaudit Services: 

3.25 Nonaudit services generally fall into one of the following 
categories (See appendix I, paragraphs A3.02 and A3.03 for examples of 
nonaudit services that are generally unique to audit organizations in 
government entities.) 

a. Nonaudit services that would not impair the audit organization's 
independence with respect to the entities it audits and, therefore, do 
not require compliance with the supplemental safeguards in paragraph 
3.30. (See paragraphs 3.26 and 3.27.) 

b. Nonaudit services that do not impair the audit organization's 
independence with respect to the entities it audits as long as the 
supplemental safeguards in paragraph 3.30 are complied with. (See 
paragraph 3.28.) 

c. Nonaudit services that would impair the audit organization's 
independence. Compliance with the supplemental safeguards will not 
overcome this impairment. (See paragraph 3.29.) 

Nonaudit Services That Do Not Impair Auditor Independence: 

3.26 Nonaudit services in which auditors provide technical advice based 
on their technical knowledge and expertise do not impair auditor 
independence with respect to entities they audit and do not require the 
audit organization to apply the supplemental safeguards. However, 
auditor independence would be impaired if the extent or nature of the 
advice resulted in the auditors' making management decisions or 
performing management functions. 

3.27 Examples of the types of services considered as providing 
technical advice include the following: 

a. participating in activities such as commissions, committees, task 
forces, panels, and focus groups as an expert in a purely advisory, 
nonvoting capacity to: 

(1) advise entity management on issues based on the auditors' knowledge 
or: 

(2) address urgent problems; 

b. providing tools and methodologies, such as guidance and good 
business practices, benchmarking studies, and internal control 
assessment methodologies that can be used by management; and: 

c. providing targeted and limited technical advice to the audited 
entity and management to assist them in activities such as (1) 
answering technical questions or providing training, (2) implementing 
audit recommendations, (3) implementing internal controls, and (4) 
providing information on good business practices. 

Nonaudit Services That Would Not Impair Independence if Supplemental 
Safeguards Are Implemented: 

3.28 Services that do not impair the audit organization's independence 
with respect to the entities they audit so long as they comply with 
supplemental safeguards include the following: 

a. providing basic accounting assistance limited to services such as 
preparing draft financial statements that are based on management's 
chart of accounts and trial balance and any adjusting, correcting, and 
closing entries that have been approved by management; preparing draft 
notes to the financial statements based on information determined and 
approved by management; preparing a trial balance based on management's 
chart of accounts; maintaining depreciation schedules for which 
management has determined the method of depreciation, rate of 
depreciation, and salvage value of the asset (If the audit organization 
has prepared draft financial statements and notes and performed the 
financial statement audit, the auditor should obtain documentation from 
management in which management acknowledges the audit organization's 
role in preparing the financial statements and related notes and 
management's review, approval, and responsibility for the financial 
statements and related notes in the management representation letter. 
The management representation letter that is obtained as part of the 
audit may be used for this type of documentation.); 

b. providing payroll services when payroll is not material to the 
subject matter of the audit or to the audit objectives. Such services 
are limited to using records and data that have been approved by entity 
management; 

c. providing appraisal or valuation services limited to services such 
as reviewing the work of the entity or a specialist employed by the 
entity where the entity or specialist provides the primary evidence for 
the balances recorded in financial statements or other information that 
will be audited; valuing an entity's pension, other post-employment 
benefits, or similar liabilities provided management has determined and 
taken responsibility for all significant assumptions and data; 

d. preparing an entity's indirect cost proposal[Footnote 30] or cost 
allocation plan provided that the amounts are not material to the 
financial statements and management assumes responsibility for all 
significant assumptions and data; 

e. providing advisory services on information technology limited to 
services such as advising on system design, system installation, and 
system security if management, in addition to the safeguards in 
paragraph 3.30, acknowledges responsibility for the design, 
installation, and internal control over the entity's system and does 
not rely on the auditors' work as the primary basis for determining (1) 
whether to implement a new system, (2) the adequacy of the new system 
design, (3) the adequacy of major design changes to an existing system, 
and (4) the adequacy of the system to comply with regulatory or other 
requirements; 

f. providing human resource services to assist management in its 
evaluation of potential candidates when the services are limited to 
activities such as serving on an evaluation panel of at least three 
individuals to review applications or interviewing candidates to 
provide input to management in arriving at a listing of best qualified 
applicants to be provided to management; and: 

g. preparing routine tax filings based on information provided by the 
audited entity. 

Nonaudit Services That Impair Independence: 

3.29 Compliance with supplemental safeguards will not overcome 
independence impairments in this category. By their nature, certain 
nonaudit services directly support the entity's operations and impair 
the audit organization's ability to meet either or both of the 
overarching independence principles in paragraph 3.22 for certain types 
of audit work. Examples of the types of services under this category 
include the following: 

a. maintaining or preparing the audited entity's basic accounting 
records or maintaining or taking responsibility for basic financial or 
other records that the audit organization will audit; 

b. posting transactions (whether coded or not coded) to the entity's 
financial records or to other records that subsequently provide input 
to the entity's financial records; 

c. determining account balances or determining capitalization criteria; 

d. designing, developing, installing, or operating the entity's 
accounting system or other information systems that are material or 
significant to the subject matter of the audit; 

e. providing payroll services that (1) are material to the subject 
matter of the audit or the audit objectives, and/or (2) involve making 
management decisions; 

f. providing appraisal or valuation services that exceed the scope 
described in paragraph 3.28 c; 

g. recommending a single individual for a specific position that is key 
to the entity or program under audit, otherwise ranking or influencing 
management's selection of the candidate, or conducting an executive 
search or a recruiting program for the audited entity; 

h. developing an entity's performance measurement system when that 
system is material or significant to the subject matter of the audit; 

i. developing an entity's policies, procedures, and internal controls; 

j. performing management's assessment of internal controls when those 
controls are significant to the subject matter of the audit; 

k. providing services that are intended to be used as management's 
primary basis for making decisions that are significant to the subject 
matter under audit; 

l. carrying out internal audit functions; and: 

m. serving as voting members of an entity's management committee or 
board of directors, making policy decisions that affect future 
direction and operation of an entity's programs, supervising entity 
employees, developing programmatic policy, authorizing an entity's 
transactions, or maintaining custody of an entity's assets.[Footnote 
31] 

Supplemental Safeguards for Maintaining Auditor Independence When 
Performing Nonaudit Services: 

3.30 Performing nonaudit services described in paragraph 3.28 will not 
impair independence if the overarching independence principles stated 
in paragraph 3.22 are not violated. For these nonaudit services, the 
audit organization should comply with each of the following safeguards: 

a. document its consideration of the nonaudit services, including its 
conclusions about the impact on independence; 

b. establish in writing an understanding with the audited entity 
regarding the objectives, scope of work, and product or deliverables of 
the nonaudit service; and management's responsibility for (1) the 
subject matter of the nonaudit services, (2) the substantive outcomes 
of the work, and (3) making any decisions that involve management 
functions related to the nonaudit service and accepting full 
responsibility for such decisions; 

c. exclude personnel who provided the nonaudit services from planning, 
conducting, or reviewing audit work in the subject matter of the 
nonaudit service under the overarching independence principle that 
auditors must not audit their own work;[Footnote 32] and: 

d. do not reduce the scope and extent of the audit work below the level 
that would be appropriate if the nonaudit work were performed by an 
unrelated party. 

Professional Judgment: 

3.31 Auditors must use professional judgment in planning and performing 
audits and attestation engagements and in reporting the results. 

3.32 Professional judgment includes exercising reasonable care and 
professional skepticism. Reasonable care concerns acting diligently in 
accordance with applicable professional standards and ethical 
principles. Professional skepticism is an attitude that includes a 
questioning mind and a critical assessment of evidence. Professional 
skepticism includes a mindset in which auditors assume neither that 
management is dishonest nor of unquestioned honesty. Believing that 
management is honest is not a reason to accept less than sufficient 
appropriate evidence. 

3.33 Using the auditors' professional knowledge, skills, and experience 
to diligently perform, in good faith and with integrity, the gathering 
of information and the objective evaluation of the sufficiency and 
appropriateness of evidence is a critical component of audits. 
Professional judgment and competence are interrelated because judgments 
made are dependent upon the auditors' competence. 

3.34 Professional judgment represents the application of the collective 
knowledge, skills, and experiences of all the personnel involved with 
an assignment, as well as the professional judgment of individual 
auditors. In addition to personnel directly involved in the audit, 
professional judgment may involve collaboration with other 
stakeholders, outside experts, and management in the audit 
organization. 

3.35 Using professional judgment in all aspects of carrying out their 
professional responsibilities, including following the independence 
standards, maintaining objectivity and credibility, assigning competent 
audit staff to the assignment, defining the scope of work, evaluating 
and reporting the results of the work, and maintaining appropriate 
quality control over the assignment process is essential to performing 
and reporting on an audit. 

3.36 Using professional judgment is important in determining the 
required level of understanding of the audit subject matter and related 
circumstances. This includes consideration about whether the audit 
team's collective experience, training, knowledge, skills, abilities, 
and overall understanding are sufficient to assess the risks that the 
subject matter under audit may contain a significant inaccuracy or 
could be misinterpreted. 

3.37 Considering the risk level of each assignment, including the risk 
that they may come to an improper conclusion is another important 
issue. Within the context of audit risk, exercising professional 
judgment in determining the sufficiency and appropriateness of evidence 
to be used to support the findings and conclusions based on the audit 
objectives and any recommendations reported is an integral part of the 
audit process. 

3.38 Auditors should document significant decisions affecting the 
audit's objectives, scope, and methodology; findings; conclusions; and 
recommendations resulting from professional judgment. 

3.39 While this standard places responsibility on each auditor and 
audit organization to exercise professional judgment in planning and 
performing an audit or attestation engagement, it does not imply 
unlimited responsibility, nor does it imply infallibility on the part 
of either the individual auditor or the audit organization. Absolute 
assurance is not attainable because of the nature of evidence and the 
characteristics of fraud. Professional judgment does not mean 
eliminating all possible limitations or weaknesses associated with a 
specific audit, but rather identifying, considering, minimizing, 
mitigating, and explaining them. 

Competence: 

3.40 The staff assigned to perform the audit or attestation engagement 
must collectively possess adequate professional competence for the 
tasks required. 

3.41 The audit organization's management should assess skill needs to 
consider whether its workforce has the essential skills that match 
those necessary to fulfill a particular audit mandate or scope of 
audits to be performed. Accordingly, audit organizations should have a 
process for recruitment, hiring, continuous development, assignment, 
and evaluation of staff to maintain a competent workforce. The nature, 
extent, and formality of the process will depend on various factors 
such as the size of the audit organization, its structure, and its 
work. 

3.42 Competence is derived from a blending of education and experience. 
Competencies are not necessarily measured by years of auditing 
experience because such a quantitative measurement may not accurately 
reflect the kinds of experiences gained by an auditor in any given time 
period. Maintaining competence through a commitment to learning and 
development throughout an auditor's professional life is an important 
element for auditors. Competence enables an auditor to make sound 
professional judgments. 

Technical Knowledge and Competence: 

3.43 The team assigned to conduct an audit or attestation engagement 
under GAGAS must collectively possess the technical knowledge, skills, 
and experience necessary to be competent for the type of work being 
performed before beginning work on that assignment. The audit team 
assigned to a GAGAS audit or attestation engagement should collectively 
possess: 

a. knowledge of GAGAS applicable to the type of work they are assigned 
and the education, skills, and experience to apply this knowledge to 
the work being performed; 

b. general knowledge of the environment in which the audited entity 
operates and the subject matter under review; 

c. skills to communicate clearly and effectively, both orally and in 
writing; and: 

d. skills appropriate for the work being performed. For example, staff 
or specialist skills in: 

(1) statistical sampling if the work involves use of statistical 
sampling; 

(2) information technology if the work involves review of information 
systems; 

(3) engineering if the work involves review of complex engineering 
data; 

(4) specialized audit methodologies or analytical techniques, such as 
the use of complex survey instruments, actuarial-based estimates, or 
statistical analysis tests, if such skills are important to; or: 

(5) specialized knowledge in subject matters, such as scientific, 
medical, environmental, educational, or any other specialized subject 
matter, if the work calls for such expertise. 

Additional Qualifications for Financial Audits and Attestation 
Engagements: 

3.44 Auditors performing financial audits should be knowledgeable in 
generally accepted accounting principles (GAAP), the AICPA's generally 
accepted auditing standards for field work and reporting and the 
related Statements on Auditing Standards (SAS), and the application of 
these standards. Also, if auditors use GAGAS in conjunction with any 
other standards, they should be knowledgeable and competent in applying 
those standards. 

3.45 Similarly, for attestation engagements, GAGAS incorporate the 
AICPA's attestation standards. Auditors should be knowledgeable in the 
AICPA general attestation standard related to criteria, the AICPA 
attestation standards for field work and reporting, and the related 
Statements on Standards for Attestation Engagements (SSAE), and they 
should be competent in applying these standards and SSAE to the task 
assigned. Also, if auditors use GAGAS in conjunction with any other 
standards, they should be knowledgeable and competent in applying those 
standards. 

Continuing Professional Education: 

3.46 Auditors performing work under GAGAS, including planning, 
directing, performing field work, or reporting on an audit or 
attestation engagement under GAGAS, should maintain their professional 
competence through continuing professional education (CPE). Therefore, 
each auditor performing work under GAGAS should complete, every 2 
years, at least 24 hours of CPE that directly relates to government 
auditing, the government environment, or the specific or unique 
environment in which the audited entity operates. For auditors who are 
involved in any amount of planning, directing, or reporting on GAGAS 
assignments and those auditors who are not involved in those activities 
but charge 20 percent or more of their time annually to GAGAS 
assignments should also obtain at least an additional 56 hours of CPE 
(for a total of 80 hours of CPE in every 2 year period) that enhances 
the auditor's professional proficiency to perform audits or attestation 
engagements. 

3.47 CPE programs are structured educational activities with learning 
objectives designed to maintain or enhance participants' knowledge, 
skills, and abilities in areas applicable to performing audits or 
attestation engagements. Determining what subjects are appropriate for 
individual auditors to satisfy both the 80-hour and the 24-hour 
requirements is a matter of professional judgment to be exercised by 
auditors in consultation with appropriate officials in their audit 
organizations. Among the considerations in exercising that judgment are 
the auditors' experience, the responsibilities they assume in 
performing GAGAS assignments, and the operating environment of the 
audited entity. 

3.48 Improving their own competencies and meeting CPE requirements are 
primarily the responsibilities of individual auditors. The audit 
organization should have quality control procedures to help ensure that 
auditors meet the continuing education requirements, including 
documentation of the CPE completed. GAO has developed guidance 
pertaining to CPE requirements to assist auditors and audit 
organizations in exercising professional judgment in complying with the 
CPE requirements.[Footnote 33] 

3.49 External specialists assisting in performing a GAGAS assignment 
should be qualified and maintain professional competence in their areas 
of specialization but are not required to meet the GAGAS CPE 
requirements described. However, auditors who use the work of external 
specialists should assess the professional qualifications of such 
specialists and document their findings and conclusions. Internal 
specialists who are part of the audit organization and perform as a 
member of the audit team should comply with GAGAS, including the CPE 
requirements. 

2003 Quality Control and Assurance Standards: 

The January 2007 version of Government Auditing Standards contains the 
final 2007 revisions to the standards except for the quality control 
and peer review sections. Paragraphs 3.50 through 3.57 contain the 
quality control and assurance standards from the 2003 revision of 
Government Auditing Standards. 

Concurrent with the electronic issuance of this version, we are 
exposing for comment redrafted sections on quality control and peer 
review in response to the wide range of comments we received on those 
sections. The completed 2007 revision of Government Auditing Standards 
will be available after the quality control and peer review sections 
are finalized and incorporated into the standards. 

Quality Control and Assurance: 

3.50 The general standard related to quality control and assurance is: 

Each audit organization performing audits and/or attestation 
engagements in accordance with GAGAS should have an appropriate 
internal quality control system in place and should undergo an external 
peer review. 

3.51 An audit organization's system of quality control encompasses the 
audit organization's structure and the policies adopted and procedures 
established to provide the organization with reasonable assurance of 
complying with applicable standards governing audits and attestation 
engagements. An audit organization's internal quality control system 
should include procedures for monitoring, on an ongoing basis, whether 
the policies and procedures related to the standards are suitably 
designed and are being effectively applied. 

3.52 The nature and extent of an audit organization's internal quality 
control system depends on a number of factors, such as its size, the 
degree of operating autonomy allowed its personnel and its audit 
offices, the nature of its work, its organizational structure, and 
appropriate cost-benefit considerations. Thus, the systems established 
by individual audit organizations will vary as will the need for, and 
extent of, their documentation of the systems. However, each audit 
organization should prepare appropriate documentation for its system of 
quality control to demonstrate compliance with its policies and 
procedures. The form and content of such documentation is a matter of 
judgment. Documentation of compliance should be retained for a period 
of time sufficient to enable those performing monitoring procedures and 
peer reviews to evaluate the extent of the audit organization's 
compliance with the quality control policies and procedures. 

3.53 Audit organizations performing audits and attestation engagements 
in accordance with GAGAS should have an external peer review of their 
auditing and attestation engagement practices at least once every 3 
years by reviewers independent of the audit organization being 
reviewed.[Footnote 34] The external peer review should determine 
whether, during the period under review, the reviewed audit 
organization's internal quality control system was adequate and whether 
quality control policies and procedures were being complied with to 
provide the audit organization with reasonable assurance of conforming 
with applicable professional standards. Audit organizations should take 
remedial, corrective actions as needed based on the results of the peer 
review. 

3.54 Members of the external peer review team should meet the following 
requirements: 

a. Each review team member should have current knowledge of GAGAS and 
of the government environment relative to the work being reviewed. 

b. Each review team member should be independent (as defined in GAGAS) 
of the audit organization being reviewed, its staff, and the audits and 
attestation engagements selected for the external peer review. A review 
team or a member of the review team is not permitted to review the 
audit organization that conducted its audit organization's most recent 
external peer review. 

c. Each review team member should have knowledge on how to perform a 
peer review. Such knowledge may be obtained from on-the-job training, 
training courses, or a combination of both. 

3.55 The peer review should meet the following requirements: 

a. The peer review should include a review of the audit organization's 
internal quality control policies and procedures, including related 
monitoring procedures, audit and attestation engagement reports, audit 
and attest documentation, and other necessary documents (for example, 
independence documentation, CPE records, and personnel management files 
related to compliance with hiring, performance evaluation, and 
assignment policies). The review should also include interviews with 
various levels of the reviewed audit organization's professional staff 
to assess their understanding of and compliance with relevant quality 
control policies and procedures. 

b. The review team should use one of the following approaches to 
selecting audits and attestation engagements for review: (1) select 
audits and attestation engagements that provide a reasonable cross 
section of the assignments performed by the reviewed audit organization 
in accordance with GAGAS or (2) select audits and attestation 
engagements that provide a reasonable cross section of the reviewed 
audit organization's work subject to quality control requirements, 
including one or more assignments performed in accordance with GAGAS. 

c. The peer review should be sufficiently comprehensive to provide a 
reasonable basis for concluding whether the reviewed audit 
organization's system of quality control was complied with to provide 
the organization with reasonable assurance of conforming with 
professional standards in the conduct of its work. The review team 
should consider the adequacy and results of the reviewed audit 
organization's monitoring efforts to efficiently plan its peer review 
procedures. 

d. The review team should prepare a written report(s) communicating the 
results of the external peer review. The report should indicate the 
scope of the review, including any limitations thereon, and should 
express an opinion on whether the system of quality control of the 
reviewed audit organization's audit and/or attestation engagement 
practices was adequate and was being complied with during the year 
reviewed to provide the audit organization with reasonable assurance of 
conforming with professional standards for audits and attestation 
engagements. The report should state the professional 
standards[Footnote 35] to which the reviewed audit organization is 
being held. The report should also describe the reasons for any 
modification of the opinion. When there are matters that resulted in a 
modification to the opinion, reviewers should report a detailed 
description of the findings and recommendations, either in the peer 
review report or in a separate letter of comment or management letter, 
to enable the reviewed audit organization to take appropriate actions. 
The written report should refer to the letter of comment or management 
letter if such a letter is issued along with a modified report. 

3.56 Audit organizations seeking to enter into a contract to perform an 
assignment in accordance with GAGAS should provide their most recent 
external peer review report and any letter of comment, and any 
subsequent peer review reports and letters of comment received during 
the period of the contract, to the party contracting for the audit or 
attestation engagement. Information in the external peer review report 
and letter of comment is often relevant to decisions on procuring audit 
or attestation engagement services. Auditors who are relying on another 
audit organization's work should request a copy of the audit 
organization's peer review report and any letter of comment, and the 
audit organization should provide the peer review report and letter of 
comment when requested. 

3.57 Government audit organizations also should transmit their external 
peer review reports to appropriate oversight bodies. It is also 
recommended that, upon request, the peer review report and letter of 
comment be made available to the public in a timely manner. 

[End of section] 

Chapter 4: Field Work Standards for Financial Audits: 

Introduction: 

4.01 This chapter establishes field work standards and provides 
guidance for financial audits conducted in accordance with generally 
accepted government auditing standards (GAGAS). For financial audits, 
GAGAS incorporate the AICPA's field work and reporting standards and 
the related statements on auditing standards (SAS) unless specifically 
excluded or modified by GAGAS.[Footnote 36] This chapter identifies the 
AICPA field work standards and prescribes additional standards for 
financial audits performed in accordance with GAGAS. 

4.02 For financial audits performed in accordance with GAGAS, chapters 
1 through 5 apply. 

AICPA Field Work Standards: 

4.03 The three AICPA generally accepted standards of field work are as 
follows:[Footnote 37] 

a. The auditor must adequately plan the work and must properly 
supervise any assistants. 

b. The auditor must obtain a sufficient understanding of the entity and 
its environment, including its internal control, to assess the risk of 
material misstatement of the financial statements whether due to error 
or fraud, and to design the nature, timing, and extent of further audit 
procedures. 

c. The auditor must obtain sufficient appropriate audit evidence by 
performing audit procedures to afford a reasonable basis for an opinion 
regarding the financial statements under audit. 

Additional Government Auditing Standards: 

4.04 GAGAS establish field work standards for financial audits in 
addition to the requirements contained in the AICPA standards. Auditors 
should comply with these additional standards when citing GAGAS in 
their audit reports. The additional Government Auditing Standards 
relate to: 

a. auditor communication during planning (see paragraphs 4.05 through 
4.08); 

b. previous audits and attestation engagements (see paragraph 4.09); 

c. detecting material misstatements resulting from violations of 
contract provisions or grant agreements, or from abuse (see paragraphs 
4.10 through 4.13); 

d. developing elements of a finding (see paragraphs 4.14 through 4.18); 
and: 

e. audit documentation (see paragraphs 4.19 through 4.24). 

Auditor Communication During Planning: 

4.05 Under AICPA standards and GAGAS, auditors should communicate with 
the audited entity their understanding of the services to be performed 
for each engagement and document that understanding through a written 
communication.[Footnote 38] GAGAS broaden the parties included in the 
communication and the items for the auditors to communicate. 

4.06 Under GAGAS, when planning the audit, auditors should communicate 
certain information in writing to management of the audited entity, 
those charged with governance,[Footnote 39] and to the individuals 
contracting for or requesting the audit. When auditors perform the 
audit pursuant to a law or regulation and they conduct the work 
directly for the legislative committee that has oversight of the 
audited entity, auditors should communicate with the legislative 
committee. In those situations where there is not a single individual 
or group that both oversees the strategic direction of the entity and 
the fulfillment of its accountability obligations or in other 
situations where the identity of those charged with governance is not 
clearly evident, the auditor should document the process followed and 
conclusions reached for identifying the appropriate individuals to 
receive the required auditor communications. Auditors should 
communicate the following additional information under GAGAS: 

a. The nature of planned work and level of assurance to be provided 
related to internal control over financial reporting and compliance 
with laws, regulations, and provisions of contracts or grant 
agreements. 

b. Any potential restriction on the auditors' reports, in order to 
reduce the risk that the needs or expectations of the parties involved 
may be misinterpreted. 

4.07 Under AICPA standards and GAGAS, tests of internal control over 
financial reporting and compliance with laws, regulations, and 
provisions of contracts or grant agreements in a financial statement 
audit contribute to the evidence supporting the auditors' opinion on 
the financial statements or other conclusions regarding financial data. 
However, such tests generally are not sufficient in scope to provide an 
opinion on the effectiveness of internal control over financial 
reporting or compliance with laws, regulations, and provisions of 
contracts or grant agreements. To meet the needs of certain audit 
report users, laws and regulations sometimes prescribe supplemental 
testing and reporting on internal control over financial reporting and 
compliance with laws, regulations, and provisions of contracts and 
grant agreements.[Footnote 40] 

4.08 If an audit is terminated before it is completed and an audit 
report is not issued, auditors should document the results of the work 
to the date of termination and why the audit was terminated. 
Determining whether and how to communicate the reason for terminating 
the audit to those charged with governance, appropriate officials of 
the audited entity, the entity contracting for or requesting the audit, 
and other appropriate officials will depend on the facts and 
circumstances and, therefore, is a matter of professional judgment. 

Previous Audits and Attestation Engagements: 

4.09 Auditors should evaluate whether the audited entity has taken 
appropriate corrective action to address findings and recommendations 
from previous engagements that could have a material effect on the 
financial statements. When planning the audit, auditors should ask 
management of the audited entity to identify previous audits, 
attestation engagements, and other studies that directly relate to the 
objectives of the audit, including whether related recommendations have 
been implemented. Auditors should use this information in assessing 
risk and determining the nature, timing, and extent of current audit 
work, including determining the extent to which testing the 
implementation of the corrective actions is applicable to the current 
audit objectives. 

Detecting Material Misstatements Resulting from Violations of Contract 
Provisions or Grant Agreements, or from Abuse: 

4.10 Auditors should design the audit to provide reasonable assurance 
of detecting misstatements that result from violations of provisions of 
contracts or grant agreements and could have a direct and material 
effect on the determination of financial statement amounts or other 
financial data significant to the audit objectives. 

4.11 If specific information comes to the auditors' attention that 
provides evidence concerning the existence of possible violations of 
provisions of contracts or grant agreements that could have a material 
indirect effect on the financial statements, the auditors should apply 
audit procedures specifically directed to ascertaining whether such 
violations have occurred. When the auditors conclude that a violation 
of provisions of contracts or grant agreements has or is likely to have 
occurred, they should determine the effect on the financial statements 
as well as the implications for other aspects of the audit. 

4.12 Abuse involves behavior that is deficient or improper when 
compared with behavior that a prudent person would consider reasonable 
and necessary business practice given the facts and circumstances. 
Abuse also includes misuse of authority or position for personal 
financial interests or those of an immediate or close family member or 
business associate. Abuse does not necessarily involve fraud, violation 
of laws, regulations, or provisions of a contract or grant agreement. 

4.13 If during the course of the audit, auditors become aware of abuse 
that could be quantitatively or qualitatively material to the financial 
statements, auditors should apply audit procedures specifically 
directed to ascertain the potential effect on the financial statements 
or other financial data significant to the audit objectives. After 
performing additional work, auditors may discover that the abuse 
represents potential fraud or illegal acts. Because the determination 
of abuse is subjective, auditors are not required to provide reasonable 
assurance of detecting abuse. 

Developing Elements of a Finding: 

4.14 Audit findings may involve deficiencies in internal control, 
fraud, illegal acts, violations of provisions of contracts or grant 
agreements, and abuse. The elements needed for a finding depend 
entirely on the objectives of the audit. Thus, a finding or set of 
findings is complete to the extent that the audit objectives are 
satisfied. When auditors identify deficiencies, auditors should plan 
and perform procedures to develop the elements of the findings that are 
relevant and necessary to achieve the audit objectives. The elements of 
an audit finding are discussed in paragraphs 4.15 through 4.18. 

4.15 Criteria: The laws, regulations, contracts, grant agreements, 
standards, measures, expectations of what should exist, defined 
business practices, and benchmarks against which performance is 
compared or evaluated. Criteria identify the required or desired state 
or expectation with respect to the program or operation. Criteria 
provide a context for evaluating evidence and understanding the 
findings. 

4.16 Condition: Condition is a situation that exists. The condition is 
determined and documented during the audit. 

4.17 Cause: The cause identifies the reason or explanation for the 
condition or the factor or factors responsible for the difference 
between the situation that exists (condition) and the required or 
desired state (criteria), which may also serve as a basis for 
recommendations for corrective actions. Common factors include poorly 
designed policies, procedures, or criteria; inconsistent, incomplete, 
or incorrect implementation; or factors beyond the control of program 
management. Auditors may assess whether the evidence provides a 
reasonable and convincing argument for why the stated cause is the key 
factor or factors contributing to the difference. 

4.18 Effect or potential effect: The effect is a clear, logical link to 
establish the impact or potential impact of the difference between the 
situation that exists (condition) and the required or desired state 
(criteria). The effect or potential effect identifies the outcomes or 
consequences of the condition. When the auditors' objectives include 
identifying the actual or potential consequences of a condition that 
varies (either positively or negatively) from the criteria identified 
in the audit, "effect" is a measure of those consequences. Effect or 
potential effect may be used to demonstrate the need for corrective 
action in response to identified problems or relevant risks. 

Audit Documentation: 

4.19 Under AICPA standards and GAGAS, auditors must prepare audit 
documentation in connection with each engagement in sufficient detail 
to provide a clear understanding of the work performed (including the 
nature, timing, extent, and results of audit procedures performed), the 
audit evidence obtained and its source, and the conclusions 
reached.[Footnote 41] Under AICPA standards and GAGAS, auditors should 
prepare audit documentation that enables an experienced 
auditor,[Footnote 42] having no previous connection to the audit, to 
understand: 

a. the nature, timing, and extent of auditing procedures performed to 
comply with GAGAS and other applicable standards and requirements; 

b. the results of the audit procedures performed and the audit evidence 
obtained; 

c. the conclusions reached on significant matters; and: 

d. that the accounting records agree or reconcile with the audited 
financial statements or other audited information. 

4.20 Under GAGAS, auditors also should document before the audit report 
is issued evidence of supervisory review of the work performed that 
supports findings, conclusions, and recommendations contained in the 
audit report. 

4.21 When auditors do not comply with applicable GAGAS requirements due 
to law, regulation, scope limitations, restrictions on access to 
records, or other issues impacting the audit, the auditors should 
document the departure from the GAGAS requirements and the impact on 
the audit and on the auditors' conclusions. This applies to departures 
from both mandatory requirements and presumptively mandatory 
requirements where alternative procedures performed in the 
circumstances were not sufficient to achieve the objectives of the 
standard. (See paragraphs 1.12 and 1.13.) 

4.22 Audit organizations should establish policies and procedures for 
the safe custody and retention of audit documentation for a time 
sufficient to satisfy legal, regulatory, and administrative 
requirements for record retention. Whether audit documentation is in 
paper, electronic, or other media, the integrity, accessibility, and 
retrievability of the underlying information could be compromised if 
the documentation is altered, added to, or deleted without the 
auditors' knowledge, or if the documentation is lost or damaged. For 
audit documentation that is retained electronically, the audit 
organization should establish information systems controls concerning 
accessing and updating the audit documentation. 

4.23 Underlying GAGAS audits is the premise that audit organizations in 
federal, state, and local governments and public accounting firms 
engaged to perform a financial audit in accordance with GAGAS cooperate 
in auditing programs of common interest so that auditors may use 
others' work and avoid duplication of efforts. Subject to applicable 
laws and regulations, auditors should make appropriate individuals, as 
well as audit documentation, available upon request and in a timely 
manner to other auditors or reviewers to satisfy these objectives. The 
use of auditors' work by other auditors may be facilitated by 
contractual arrangements for GAGAS audits that provide for full and 
timely access to appropriate individuals, as well as audit 
documentation. 

4.24 Audit organizations should develop policies to deal with requests 
by outside parties to obtain access to audit documentation, especially 
when an outside party attempts to obtain information indirectly through 
the auditor rather than directly from the audited entity. In developing 
such policies, audit organizations should determine what laws and 
regulations apply, if any. 

Additional Considerations for GAGAS Financial Audits: 

4.25 Due to the audit objectives and public accountability of GAGAS 
audits, there may be additional considerations for financial audits 
completed in accordance with GAGAS. These considerations relate to: 

a. materiality in GAGAS financial audits (see paragraph 4.26); 

b. consideration of fraud and illegal acts (see paragraphs 4.27 and 
4.28); and: 

c. ongoing investigations or legal proceedings (see paragraph 4.29). 

Materiality in GAGAS Financial Audits: 

4.26 Under both AICPA standards and GAGAS, the auditors' responsibility 
is to plan and perform the audit to obtain reasonable assurance that 
material misstatements, whether caused by errors or fraud, are 
detected.[Footnote 43] The concept of materiality recognizes that some 
matters, either individually or in the aggregate, are important for 
fair presentation of financial statements in conformity with generally 
accepted accounting principles, while other matters are not important. 
In performing the audit, matters that, either individually or in the 
aggregate, could be material to the financial statements are a primary 
consideration.[Footnote 44] Additional considerations may apply to 
GAGAS financial audits of government entities or entities that receive 
government awards. For example, in audits performed in accordance with 
GAGAS, auditors may find it appropriate to use lower materiality levels 
as compared with the materiality levels used in non-GAGAS audits 
because of the public accountability of government entities and 
entities receiving government funding, various legal and regulatory 
requirements, and the visibility and sensitivity of government 
programs.[Footnote 45] 

Consideration of Fraud and Illegal Acts: 

4.27 Under both the AICPA standards[Footnote 46] and GAGAS, auditors 
should plan and perform the audit to obtain reasonable assurance about 
whether the financial statements are free of material misstatement, 
whether caused by error or fraud.[Footnote 47] Recognizing the 
possibility that a material misstatement due to fraud could be present 
is important for achieving this objective. However, absolute assurance 
is not attainable and thus even a properly planned and performed audit 
may not detect a material misstatement resulting from fraud. 

4.28 Under both the AICPA standards[Footnote 48] and GAGAS, auditors 
should design the audit to provide reasonable assurance of detecting 
material misstatements resulting from illegal acts that could have a 
direct and material effect on the financial statements.[Footnote 49] If 
specific information comes to the auditors' attention that provides 
evidence concerning the existence of possible illegal acts[Footnote 50] 
that could have a material indirect effect on the financial statements, 
the auditors should apply audit procedures specifically directed to 
ascertaining whether an illegal act has occurred. When an illegal act 
has or is likely to have occurred, auditors should determine the effect 
on the financial statements as well as the implications for other 
aspects of the audit. 

Ongoing Investigations or Legal Proceedings: 

4.29 Avoiding interference with investigations or legal proceedings is 
important in pursuing indications of fraud, illegal acts, violations of 
provisions of contracts or grant agreements, or abuse. Laws, 
regulations, or policies might require auditors to report indications 
of certain types of fraud, illegal acts, violations of provisions of 
contracts or grant agreements, or abuse to law enforcement or 
investigatory authorities before performing additional audit 
procedures. When investigations or legal proceedings are initiated or 
in process, auditors should evaluate the impact on the current audit. 
In some cases, it may be appropriate for the auditors to work with 
investigators and/or legal authorities, or withdraw from or defer 
further work on the audit engagement or a portion of the engagement to 
avoid interfering with an investigation. 

[End of section] 

Chapter 5: Reporting Standards for Financial Audits: 

Introduction: 

5.01 This chapter establishes reporting standards and provides guidance 
for financial audits conducted in accordance with generally accepted 
government auditing standards (GAGAS). For financial audits, GAGAS 
incorporate the AICPA's field work and reporting standards and the 
related statements on auditing standards (SAS) unless specifically 
excluded or modified by GAGAS.[Footnote 51] This chapter identifies the 
AICPA reporting standards and prescribes additional standards for 
financial audits performed in accordance with GAGAS. 

5.02 For financial audits performed in accordance with GAGAS, chapters 
1 through 5 apply. 

AICPA Reporting Standards: 

5.03 The four AICPA generally accepted standards of reporting[Footnote 
52] are as follows: 

a. The auditor must state in the auditor's report whether the financial 
statements are presented in accordance with generally accepted 
accounting principles (GAAP). 

b. The auditor must identify in the auditor's report those 
circumstances in which such principles have not been consistently 
observed in the current period in relation to the preceding period. 

c. When the auditor determines that informative disclosures are not 
reasonably adequate, the auditor must so state in the auditor's report. 

d. The auditor must either express an opinion regarding the financial 
statements, taken as a whole, or state that an opinion cannot be 
expressed, in the auditor's report. When the auditor cannot express an 
overall opinion, the auditor should state the reasons therefore in the 
auditor's report. In all cases where an auditor's name is associated 
with financial statements, the auditor should clearly indicate the 
character of the auditor's work, if any, and the degree of 
responsibility the auditor is taking in the auditor's report. 

Additional Government Auditing Standards: 

5.04 GAGAS establish reporting standards for financial audits in 
addition to the standards contained in the AICPA standards. Auditors 
should comply with these additional standards when citing GAGAS in 
their audit reports. The additional Government Auditing Standards 
relate to: 

a. reporting auditors' compliance with GAGAS (see paragraphs 5.05 and 
5.06); 

b. reporting on internal control and compliance with laws, regulations, 
and provisions of contracts or grant agreements (see paragraphs 5.07 
through 5.09); 

c. reporting deficiencies in internal control, fraud, illegal acts, 
violations of provisions of contracts or grant agreements, and abuse 
(see paragraphs 5.10 through 5.22); 

d. communicating significant matters in the auditors' report (see 
paragraphs 5.23 through 5.25); 

e. reporting on the restatement of previously-issued financial 
statements (see paragraphs 5.26 through 5.31); 

f. reporting views of responsible officials (see paragraphs 5.32 
through 5.38); 

g. reporting confidential or sensitive information (see paragraphs 5.39 
through 5.43); and: 

h. distributing reports (see paragraph 5.44). 

Reporting Auditors' Compliance with GAGAS: 

5.05 When auditors comply with all applicable GAGAS requirements, they 
should include a statement in the auditors' report that they performed 
the audit in accordance with GAGAS. (See paragraphs 1.12 and 1.13 for 
additional requirements on citing compliance with GAGAS.) 

5.06 An audited entity receiving a GAGAS audit report may also request 
auditors to issue a financial audit report for purposes other than 
complying with requirements for a GAGAS audit. For example, the audited 
entity may need audited financial statements to issue bonds or for 
other financing purposes. GAGAS do not prohibit auditors from issuing a 
separate report conforming only to AICPA or other standards. 

Reporting on Internal Control and Compliance with Laws, Regulations, 
and Provisions of Contracts or Grant Agreements: 

5.07 When providing an opinion or a disclaimer on financial statements, 
auditors must also report on internal control over financial reporting 
and on compliance with laws, regulations, and provisions of contracts 
or grant agreements. 

5.08 Auditors should include either in the same or in separate 
report(s) a description of the scope of the auditors' testing of 
internal control over financial reporting and compliance with laws, 
regulations, and provisions of contracts or grant agreements. If the 
auditor issues separate reports, the auditors' report on financial 
statements should include a reference to the separate reports. Auditors 
should state in the reports whether the tests they performed provided 
sufficient, appropriate evidence to support an opinion[Footnote 53] on 
the effectiveness of internal control over financial reporting and on 
compliance with laws, regulations, and provisions of contracts or grant 
agreements. 

5.09 When auditors report separately (including separate reports bound 
in the same document) on internal control over financial reporting and 
compliance with laws and regulations and provisions of contracts or 
grant agreements, they should state in the financial statement audit 
report that they are issuing those additional reports. They should 
include a reference to the separate reports[Footnote 54] and also state 
that the reports on internal control over financial reporting and 
compliance with laws and regulations and provisions of contracts or 
grant agreements are an integral part of a GAGAS audit and important 
for assessing the results of the audit. 

Reporting Deficiencies in Internal Control, Fraud, Illegal Acts, 
Violations of Provisions of Contracts or Grant Agreements, and Abuse: 

5.10 For financial audits, including audits of financial statements in 
which auditors provide an opinion or disclaimer, auditors should 
report, as applicable to the objectives of the audit, and based upon 
the audit work performed, (1) significant deficiencies in internal 
control, identifying those considered to be material weaknesses; (2) 
all instances of fraud and illegal acts unless inconsequential; and (3) 
violations of provisions of contracts or grant agreements and abuse 
that could have a material effect on the financial statements.[Footnote 
55] 

Deficiencies in Internal Control: 

5.11 For all financial audits, auditors should report the following 
deficiencies in internal control: 

a. Significant deficiency: a deficiency in internal control, or 
combination of deficiencies, that adversely affects the entity's 
ability to initiate, authorize, record, process, or report financial 
data reliably in accordance with generally accepted accounting 
principles such that there is more than a remote[Footnote 56] 
likelihood that a misstatement of the entity's financial statements 
that is more than inconsequential[Footnote 57]will not be prevented or 
detected.[Footnote 58] 

b. Material weakness: a significant deficiency, or combination of 
significant deficiencies, that results in more than a remote likelihood 
that a material misstatement of the financial statements will not be 
prevented or detected. 

5.12 Assessing the significance of control deficiencies includes 
qualitative considerations such as public accountability of the audited 
entity, legal and regulatory requirements, the visibility and 
sensitivity of the entity or program, the needs of users and concerns 
of oversight officials, and current and emerging risks and 
uncertainties facing the government entity or entity that receives 
government funding. The significance of a deficiency in internal 
control also is influenced by: 

a. the likelihood that a deficiency, or combination of deficiencies, 
could fail to prevent or detect a material misstatement of an account 
balance or disclosure; and: 

b. the magnitude of the potential misstatement. 

5.13 Auditors should include all significant deficiencies in the 
auditors' report on internal control over financial reporting and 
indicate those that represent material weaknesses. If (1) a significant 
deficiency is remediated before the auditors' report is issued, and the 
(2) auditors obtain sufficient, appropriate evidence supporting the 
remediation of the significant deficiency, then the auditors should 
report the significant deficiency and the fact that it was remediated 
before the auditors' report was issued. 

5.14 Determining whether and how to communicate to officials of the 
audited entity internal control deficiencies that have an 
inconsequential effect on the financial statement is a matter of 
professional judgment. Auditors should document such communications. 

Fraud, Illegal Acts, Violations of Provisions of Contracts or Grant 
Agreements, and Abuse: 

5.15 Under AICPA standards and GAGAS, auditors have responsibilities 
for detecting fraud and illegal acts that have a material effect on the 
financial statements and determining whether those charged with 
governance are adequately informed about fraud and illegal acts. GAGAS 
include additional reporting standards. When auditors conclude, based 
on sufficient, appropriate evidence, that any of the following either 
has occurred or is likely to have occurred, they should include in 
their audit report the relevant information about: 

a. fraud and illegal acts[Footnote 59] that have an effect on the 
financial statements that is more than inconsequential, 

b. violations of provisions of contracts or grant agreements that have 
a material effect on the determination of financial statement amounts 
or other financial data significant to the audit, and: 

c. abuse that is material, either quantitatively or qualitatively. (See 
paragraphs 4.12 and 4.13 for a discussion of abuse.) 

5.16 When auditors detect violations of provisions of contracts or 
grant agreements or abuse that have an effect on the financial 
statements that is less than material but more than inconsequential, 
they should communicate those findings in writing to officials of the 
audited entity. Determining whether and how to communicate to officials 
of the audited entity fraud, illegal acts, violations of provisions of 
contracts or grant agreements, or abuse that is inconsequential is a 
matter of professional judgment. Auditors should document such 
communications. 

5.17 When fraud, illegal acts, violations of provisions of contracts or 
grant agreements, or abuse either have occurred or are likely to have 
occurred, auditors may consult with authorities or legal counsel about 
whether publicly reporting such information would compromise 
investigative or legal proceedings. Auditors may limit their public 
reporting to matters that would not compromise those proceedings, and 
for example, report only on information that is already a part of the 
public record. 

Reporting Findings Directly to Parties Outside the Audited Entity: 

5.18 Auditors should report known or likely fraud, illegal acts, 
violations of provisions of contracts or grant agreements, or abuse 
directly to parties outside the audited entity in the following two 
circumstances.[Footnote 60] 

a. When entity management fails to satisfy legal or regulatory 
requirements to report such information to external parties specified 
in law or regulation, auditors should first communicate the failure to 
report such information to those charged with governance. If the 
audited entity still does not report this information to the specified 
external parties as soon as practicable after the auditors' 
communication with those charged with governance, then the auditors 
should report the information directly to the specified external 
parties. 

b. When entity management fails to take timely and appropriate steps to 
respond to known or likely fraud, illegal acts, violations of 
provisions of contracts or grant agreements, or abuse that (1) is 
likely to have a material effect on the financial statements and (2) 
involves funding received directly or indirectly from a government 
agency, auditors should first report management's failure to take 
timely and appropriate steps to those charged with governance. If the 
audited entity still does not take timely and appropriate steps as soon 
as practicable after the auditors' communication with those charged 
with governance, then the auditors should report the entity's failure 
to take timely and appropriate steps directly to the funding agency. 

5.19 The reporting in paragraph 5.18 is in addition to any legal 
requirements to report such information directly to parties outside the 
audited entity. Auditors should comply with these requirements even if 
they have resigned or been dismissed from the audit prior to its 
completion. 

5.20 Auditors should obtain sufficient, appropriate evidence, such as 
confirmation from outside parties, to corroborate assertions by 
management of the audited entity that it has reported such findings in 
accordance with laws, regulations, and funding agreements. When 
auditors are unable to do so, they should report such information 
directly as discussed above. 

Presenting Findings in the Auditors' Report: 

5.21 In presenting findings such as deficiencies in internal control, 
fraud, illegal acts, violations of provisions of contracts or grant 
agreements, and abuse, auditors should develop the elements of the 
findings to the extent necessary to achieve the audit objectives. 
Clearly developed audit findings, as discussed in paragraphs 4.14 
through 4.18, assist management or oversight officials of the audited 
entity in understanding the need for taking corrective action. If 
auditors sufficiently develop the elements of a finding, they may 
provide recommendations for corrective action. 

5.22 Auditors should place their findings in perspective by describing 
the nature and extent of the issues being reported and the extent of 
the work performed that resulted in the finding. To give the reader a 
basis for judging the prevalence and consequences of these findings, 
auditors should, as applicable, relate the instances identified to the 
population or the number of cases examined and quantify the results in 
terms of dollar value or other measures, as appropriate. If the results 
cannot be projected, auditors should limit their conclusions 
appropriately. 

Communicating Significant Matters in the Auditors' Report: 

5.23 Under AICPA standards, auditors may emphasize in the auditors' 
report significant matters regarding the financial statements.[Footnote 
61] Due to the public interest in the operations of government entities 
and entities that receive or administer government awards, in GAGAS 
audits there may be situations in which certain types of information in 
addition to the examples presented in AICPA standards would help 
facilitate the readers' understanding of the financial statements and 
the auditors' report. 

5.24 Examples of matters that auditors may communicate in a GAGAS audit 
include the following: 

a. Significant concerns or uncertainties about the fiscal 
sustainability of a government or program or other matters that could 
have a significant impact on the financial condition or operations of 
the government entity beyond one year of the financial statement 
date.[Footnote 62] Such concerns or uncertainties may arise due to 
revenue or expenditure trends; economic dependency on other governments 
or entities; the government's current commitments, responsibilities, 
liabilities, or promises to citizens for future benefits that are not 
sustainable over the long term; deficit trends; the relationship 
between the financial information and other key indicators; and other 
significant risks and uncertainties that raise doubts about the long- 
term sustainability of current government programs in relation to the 
resources expected to be available. However, auditors are not 
responsible for designing audit procedures to detect such concerns or 
uncertainties, and any judgment about the future is based on 
information that is available at the time the judgment is made. 

b. Unusual or catastrophic events that will likely have a significant 
ongoing or future impact on the entity's financial condition or 
operations. 

c. Significant uncertainties surrounding projections or estimations in 
the financial statements. 

d. Any other matter that the auditors consider significant for 
communication to users and oversight bodies in the auditors' report. 

5.25 Determining whether to communicate such information in the 
auditors' report is a matter of professional judgment. The 
communication may be presented in a separate paragraph or separate 
section of the auditors' report and may include information that is not 
disclosed in the financial statements. 

Reporting on Restatement of Previously-Issued Financial Statements: 

5.26 AICPA Professional Standards, AU 561, Subsequent Discovery of 
Facts Existing at the Date of the Auditor's Report, establish standards 
and provide guidance for situations when auditors become aware of new 
information that could have affected their report on previously-issued 
financial statements.[Footnote 63] Under AU 561, if auditors become 
aware of new information that might have affected their opinion on 
previously-issued financial statement(s), then the auditors should 
advise entity management to determine the potential effect(s) of the 
new information on the previously-issued financial statement(s) as soon 
as reasonably possible. Such new information may lead management to 
conclude that previously-issued financial statements were materially 
misstated and to restate and reissue the misstated financial 
statements. In such circumstances, auditors should advise management to 
make appropriate disclosure of the newly discovered facts and their 
impact on the financial statements to those who are likely to rely on 
the financial statements.[Footnote 64] 

5.27 Under GAGAS, auditors should advise management to make appropriate 
disclosures when the auditors believe that the following conditions 
exist: (1) it is likely that previously-issued financial statements are 
misstated, and (2) the misstatement is or reasonably could be material. 
Under GAGAS, auditors also should perform the following procedures 
related to restated financial statements:[Footnote 65] 

a. evaluate the timeliness and appropriateness of management's 
disclosure and actions to determine and correct misstatements in 
previously-issued financial statements (see paragraph 5.28), 

b. report on restated financial statements (see paragraphs 5.29 and 
5.30), and: 

c. report directly to appropriate officials when the audited entity 
does not take the necessary steps (see paragraph 5.31). 

Evaluate the Timeliness and Appropriate