This is the accessible text file for GAO report number GAO-07-731G 
entitled 'Government Auditing Standards: July 2007 Revision' which was 
released on July 27, 2007. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

By the Comptroller General of the United States: 

July 2007: 

Government Auditing Standards: 

July 2007 Revision: 

GAO-07- 731G: 

Letter: 

Chapter 1: Use and Application of GAGAS: 

Introduction: 

Purpose and Applicability of GAGAS: 

Use of Terminology to Define Professional Requirements in GAGAS: 

Stating Compliance with GAGAS in the Auditors' Report: 

Relationship between GAGAS and Other Professional Standards: 

Types of GAGAS Audits and Attestation Engagements: 

Chapter 2: Ethical Principles in Government Auditing: 

Introduction: 

Ethical Principles: 

Chapter 3: General Standards: 

Introduction: 

Independence: 

Professional Judgment: 

Competence: 

Quality Control and Assurance: 

Chapter 4: Field Work Standards for Financial Audits: 

Introduction: 

AICPA Field Work Standards: 

Additional Government Auditing Standards: 

Additional Considerations for GAGAS Financial Audits: 

Chapter 5: Reporting Standards for Financial Audits: 

Introduction: 

AICPA Reporting Standards: 

Additional Government Auditing Standards: 

Chapter 6: General, Field Work, and Reporting Standards for Attestation 
Engagements: 

Introduction: 

AICPA General and Field Work Standards for Attestation Engagements: 

Additional Government Auditing Standards: 

Additional Considerations for GAGAS Attestation Engagements: 

AICPA Reporting Standards for Attestation Engagements: 

Additional Government Auditing Standards: 

Chapter 7: Field Work Standards for Performance Audits: 

Introduction: 

Reasonable Assurance: 

Significance in a Performance Audit: 

Audit Risk: 

Planning: 

Supervision: 

Obtaining Sufficient, Appropriate Evidence: 

Audit Documentation: 

Chapter 8: Reporting Standards for Performance Audits: 

Introduction: 

Reporting: 

Report Contents: 

Distributing Reports: 

Appendixes: 

Appendix I: Supplemental Guidance: 

Introduction: 

Overall Supplemental Guidance: 

Information to Accompany Chapter 1: 

Information to Accompany Chapter 3: 

Information to Accompany Chapter 7: 

Information to Accompany Chapter 8: 

Appendix II: Comptroller General's Advisory Council on Government 
Auditing Standards: 

Advisory Council Members: 

GAO Project Team: 

Index: 

Abbreviations: 

AICPA: American Institute of Certified Public Accountants: 

AU: AICPA Codification of Statements on Auditing Standards: 

CPA: certified public accountant: 

CPE: continuing professional education: 

COSO: Committee of Sponsoring Organizations of the Treadway Commission: 

GAAP: generally accepted accounting principles: 

GAGAS: generally accepted government auditing standards: 

GAO: U.S. Government Accountability Office: 

IAASB: International Auditing and Assurance Standards Board: 

IIA: Institute of Internal Auditors: 

ISA: International Statements on Auditing: 

ISACA: Information Systems Audit and Control Association: 

MD&A: management's discussion and analysis: 

OMB: U.S. Office of Management and Budget: 

PCAOB: Public Company Accounting Oversight Board: 

SAS: Statements on Auditing Standards: 

SSAE: Statements on Standards for Attestation Engagements: 

[End of section] 

The principles of transparency and accountability for the use of public 
resources are key to our nation's governing processes. Government 
officials and recipients of federal moneys are responsible for carrying 
out public functions efficiently, economically, effectively, ethically, 
and equitably, while achieving desired program objectives. High-quality 
auditing is essential for government accountability to the public and 
transparency regarding linking resources to related program results. 
Auditing of government programs should provide independent, objective, 
fact-based, nonpartisan assessments of the stewardship, performance, 
and cost of government policies, programs, and operations. Government 
audits also provide key information to stakeholders and the public to 
maintain accountability; help improve program performance and 
operations; reduce costs; facilitate decision making; stimulate 
improvements; and identify current and projected crosscutting issues 
and trends that affect government programs and the people those 
programs serve. 

The professional standards presented in this document provide a 
framework for performing high-quality audit work with competence, 
integrity, objectivity, and independence. I firmly believe that 
government auditors should lead by example in the areas of 
transparency, performance, accountability, and quality through the 
audit process. 

Current trends and longer-range fiscal challenges make auditor 
oversight especially important to help improve government operations 
and services today and position them for a better tomorrow. Government 
auditing plays a major role in improving government operations and 
services, and in the important dialogue on the future of government 
programs by providing the objective analysis and information needed to 
make the decisions necessary to help create a better future. GAO will 
continue its efforts to lead by example in all of these areas. 

The July 2007 revision of Government Auditing Standards supersedes the 
2003 revision and updates the January 2007 revision. This revision 
contains the January 2007 revision plus updated quality control and 
peer review sections in chapter 3 which were exposed in January 2007. 
The July 2007 revision represents the completed 2007 revision of 
Government Auditing Standards, and is the version that should be used 
by government auditors until further updates and revisions are made. An 
electronic version of this document can be accessed on the Web at  
[Hyperlink, http://www.gao.gov/govaud/ybk01.htm]. 

This revision contains the following fundamental changes from the 2003 
revision that reinforce the principles of transparency and 
accountability and provide the framework for high-quality government 
audits that add value. 

* Heightened the emphasis on ethical principles as the foundation, 
discipline, and structure behind the implementation of the standards, 
including a description of five key ethical principles that should 
guide the work of those who audit government programs and operations. 

* Clarified and streamlined the discussion of the impact of 
professional services other than audits or attestation engagements 
(nonaudit services) and their impact on auditor independence. 

* Enhanced and clarified the requirements for an audit organization's 
system of quality control by specifying the elements of quality that an 
organization's policies and procedures should collectively address. 

* Added a requirement that external audit organizations make their most 
recent peer review reports publicly available. 

* Updated the financial auditing standards based on recent developments 
in financial auditing and internal control, increased transparency 
surrounding restatements, and significant concerns, uncertainties, or 
other unusual events that could have a significant impact on the 
financial condition or operations of a government entity or program. 

* Enhanced performance auditing standards that elaborate on the overall 
framework for high-quality performance auditing, including the concepts 
of reasonable assurance and its relationship to audit risk, 
significance, and the levels of evidence used to support audit findings 
and conclusions. 

* Clarified the standards through standardized language to define the 
auditor's level of responsibility and distinguish between auditor 
requirements and additional guidance. 

* Reinforced the key role of auditing in maintaining accountability and 
providing information for making improvements in government operations. 

This revision of the standards has gone through an extensive 
deliberative process, including public comments and input from the 
Comptroller General's Advisory Council on Government Auditing 
Standards. The Advisory Council generally consists of about 25 experts 
in financial and performance auditing and reporting drawn from federal, 
state, and local government; the private sector; and academia. The 
views of all parties were thoroughly considered in finalizing the 
standards. 

The July 2007 revision of Government Auditing Standards will be 
effective for financial audits and attestation engagements for periods 
beginning on or after January 1, 2008, and for performance audits 
beginning on or after January 1, 2008. Early implementation is 
permissible and encouraged. For financial audits, certain standards of 
the Auditing Standards Board (ASB) that affect Government Auditing 
Standards become effective prior to these dates. We encourage audit 
organizations to implement the relevant sections of the 2007 revision 
for financial audits concurrent with the implementation of the related 
ASB standards. 

I extend special thanks to the members of the Advisory Council for 
their extensive input and feedback through the entire process of 
developing and finalizing the standards. 

Signed by: 

David M. Walker: 
Comptroller General of the United States: 

July 2007: 

[End of section] 

Chapter 1 Use and Application of GAGAS: 

Introduction: 

1.01 Auditing is essential to government accountability to the public. 
Audits and attestation engagements provide an independent, objective, 
nonpartisan assessment of the stewardship, performance, or cost of 
government policies, programs, or operations, depending upon the type 
and scope of the audit. 

1.02 The concept of accountability for use of public resources and 
government authority is key to our nation's governing processes. 
Government officials entrusted with public resources are responsible 
for carrying out public functions legally, effectively, efficiently, 
economically, ethically, and equitably.[Footnote 1] Government managers 
are responsible for providing reliable, useful, and timely information 
for accountability of government programs and their operations. (See 
appendix I paragraph A1.08 for additional information on management's 
responsibility.) Legislators, government officials, and the public need 
to know whether (1) government manages public resources and uses its 
authority properly and in compliance with laws and regulations; (2) 
government programs are achieving their objectives and desired 
outcomes; (3) government services are provided effectively, 
efficiently, economically, ethically, and equitably; and (4) government 
managers are held accountable for their use of public resources. 

Purpose and Applicability of GAGAS: 

1.03 The professional standards and guidance contained in this 
document, commonly referred to as generally accepted government 
auditing standards (GAGAS), provide a framework for conducting high 
quality government audits and attestation engagements with competence, 
integrity, objectivity, and independence. These standards are for use 
by auditors[Footnote 2] of government entities and entities that 
receive government awards and audit organizations[Footnote 3] 
performing GAGAS audits and attestation engagements. GAGAS contain 
requirements and guidance dealing with ethics, independence, auditors' 
professional competence and judgment, quality control, the performance 
of field work, and reporting. Audits and attestation engagements 
performed under GAGAS provide information used for oversight, 
accountability, and improvements of government programs and operations. 
GAGAS contain requirements and guidance to assist auditors in 
objectively acquiring and evaluating sufficient, appropriate evidence 
and reporting the results. When auditors perform their work in this 
manner and comply with GAGAS in reporting the results, their work can 
lead to improved government management, better decision making and 
oversight, effective and efficient operations, and accountability for 
resources and results. 

1.04 Laws, regulations, contracts, grant agreements, or policies 
frequently require audits in accordance with GAGAS. Many auditors and 
audit organizations also voluntarily choose to perform their work in 
accordance with GAGAS. The requirements and guidance in this document 
apply to audits and attestation engagements of government entities, 
programs, activities, and functions, and of government assistance 
administered by contractors, nonprofit entities, and other 
nongovernmental entities when the use of GAGAS is required or is 
voluntarily followed. 

Use of Terminology to Define Professional Requirements in GAGAS: 

1.05 GAGAS contain professional requirements together with related 
guidance in the form of explanatory material.[Footnote 4] Auditors have 
a responsibility to consider the entire text of GAGAS in carrying out 
their work and in understanding and applying the professional 
requirements in GAGAS. 

1.06 Not every paragraph of GAGAS carries a professional requirement 
that auditors and audit organizations are expected to fulfill. Rather, 
the professional requirements are identified through use of specific 
language. 

1.07 GAGAS use two categories of professional requirements, identified 
by specific terms, to describe the degree of responsibility they impose 
on auditors and audit organizations, as follows: 

a. Unconditional requirements: Auditors and audit organizations are 
required to comply with an unconditional requirement in all cases in 
which the circumstances exist to which the unconditional requirement 
applies. GAGAS use the words must or is required to specify an 
unconditional requirement. 

b. Presumptively mandatory requirements: Auditors and audit 
organizations are also required to comply with a presumptively 
mandatory requirement in all cases in which the circumstances exist to 
which the presumptively mandatory requirement applies; however, in rare 
circumstances, auditors and audit organizations may depart from a 
presumptively mandatory requirement provided they document their 
justification for the departure and how the alternative procedures 
performed in the circumstances were sufficient to achieve the 
objectives of the presumptively mandatory requirement. GAGAS use the 
word should to specify a presumptively mandatory requirement. 

1.08 Explanatory material is defined as the text within GAGAS 
(including appendix I) other than the requirements defined in paragraph 
1.07. Explanatory material uses the words may, might, and could to 
describe explanatory information and is provided to: 

a. provide further explanation and guidance on the professional 
requirements or: 

b. identify and describe other procedures or actions relating to 
auditors' or audit organizations' activities. 

1.09 Explanatory material is intended to be descriptive rather than 
required. This material is intended, for example, to explain the 
objective of a requirement where it would be useful to do so; explain 
why particular procedures may be considered or employed under certain 
circumstances; or provide additional information to consider in 
exercising professional judgment. 

1.10 Explanatory material that identifies and describes other 
procedures or actions does not impose a professional requirement on the 
auditor or audit organization to perform the suggested procedures or 
actions. How and whether to carry out such procedures or actions 
depends on the exercise of professional judgment consistent with the 
objective of the standard. 

Stating Compliance with GAGAS in the Auditors' Report: 

1.11 When auditors are required to follow GAGAS or are representing to 
others that they followed GAGAS, they should follow all applicable 
GAGAS requirements and should refer to compliance with GAGAS in the 
auditors' report as set forth in paragraphs 1.12 and 1.13. 

1.12 Auditors should include one of the following types of GAGAS 
compliance statements in reports on GAGAS audits and attestation 
engagements, as appropriate.[Footnote 5] 

a. Unmodified GAGAS compliance statement: Stating that the auditor 
performed the audit or attestation engagement in accordance with GAGAS. 
Auditors should include an unmodified GAGAS compliance statement in the 
audit report when they have (1) followed all applicable unconditional 
and presumptively mandatory GAGAS requirements, or (2) have followed 
all unconditional requirements and documented justification for any 
departures from applicable presumptively mandatory requirements, and 
have achieved the objectives of those requirements through other means. 

b. Modified GAGAS compliance statement: Stating either that (1) the 
auditor performed the audit or attestation engagement in accordance 
with GAGAS, except for specific applicable requirements that were not 
followed, or (2) because of the significance of the departure(s) from 
the requirements, the auditor was unable to and did not perform the 
audit or attestation engagement in accordance with GAGAS. Situations 
when auditors use modified compliance statements include scope 
limitations, such as restrictions on access to records, government 
officials, or other individuals needed to conduct the audit. When 
auditors use a modified GAGAS statement, they should disclose in the 
report the applicable requirement(s) not followed, the reasons for not 
following the requirement(s), and how not following the requirements 
affected, or could have affected, the audit and the assurance provided. 

1.13 When auditors do not comply with any applicable requirements, they 
should (1) assess the significance of the noncompliance to the audit 
objectives, (2) document the assessment, along with their reasons for 
not following the requirement, and (3) determine the type of GAGAS 
compliance statement.[Footnote 6] The auditors' determination will 
depend on the significance of the requirements not followed in relation 
to the audit objectives. 

Relationship between GAGAS and Other Professional Standards: 

1.14 Auditors may use GAGAS in conjunction with professional standards 
issued by other authoritative bodies. Auditors may also cite the use of 
other standards in their audit reports, as appropriate. If the auditor 
is citing compliance with GAGAS and inconsistencies exist between GAGAS 
and other standards cited, the auditor should use GAGAS as the 
prevailing standard for conducting the audit and reporting the results. 

1.15 The relationship between GAGAS and other professional standards 
for financial audits and attestation engagements is as follows: 

a. The American Institute of Certified Public Accountants (AICPA) has 
established professional standards that apply to financial audits and 
attestation engagements for nonissuers[Footnote 7] performed by 
certified public accountants (CPA). For financial audits, GAGAS 
incorporate the AICPA field work and reporting standards and the 
related Statements on Auditing Standards (SAS)[Footnote 8] unless 
specifically excluded or modified by GAGAS. For attestation 
engagements, GAGAS incorporate the AICPA general standard on criteria, 
and the field work and reporting standards and the related Statements 
on Standards for Attestation Engagements (SSAE) unless specifically 
excluded or modified by GAGAS. GAGAS describe ethical principles, and 
establish independence and other general standards, and additional 
field work and reporting standards beyond those provided by the AICPA 
for performing financial audits and attestation engagements. 

b. The Public Company Accounting Oversight Board (PCAOB) has 
established professional standards that apply to financial audits and 
attestation engagements for issuers. Auditors may use GAGAS in 
conjunction with the PCAOB standards. 

c. The International Auditing and Assurance Standards Board (IAASB) has 
established professional standards that apply to financial audits and 
attestation engagements. Auditors may use GAGAS in conjunction with the 
IAASB standards and the related statements on International Statements 
on Auditing (ISA). 

1.16 For performance audits, auditors may use other professional 
standards in conjunction with GAGAS, such as the following: 

a. International Standards for the Professional Practice of Internal 
Auditing, The Institute of Internal Auditors, Inc; 

b. Guiding Principles for Evaluators, American Evaluation Association; 

c. The Program Evaluation Standards, Joint Committee on Standards for 
Education Evaluation; and: 

d. Standards for Educational and Psychological Testing, American 
Psychological Association. 

Types of GAGAS Audits and Attestation Engagements: 

1.17 This section describes the types of audits and attestation 
engagements that audit organizations may perform under GAGAS. This 
description is not intended to limit or require the types of audits or 
attestation engagements that may be performed under GAGAS. 

1.18 All audits and attestation engagements begin with objectives, and 
those objectives determine the type of audit to be performed and the 
applicable standards to be followed. The types of audits that are 
covered by GAGAS, as defined by their objectives, are classified in 
this document as financial audits, attestation engagements, and 
performance audits. 

1.19 In some audits and attestation engagements, the standards 
applicable to the specific audit objective will be apparent. For 
example, if the audit objective is to express an opinion on financial 
statements, the standards for financial audits apply. However, some 
engagements may have multiple or overlapping objectives. For example, 
if the objectives are to determine the reliability of performance 
measures, this work can be done in accordance with either the standards 
for attestation engagements or for performance audits. In cases in 
which there is a choice between applicable standards, auditors should 
evaluate users' needs and the auditors' knowledge, skills, and 
experience in deciding which standards to follow. 

1.20 GAGAS requirements apply to the types of audit and attestation 
engagements that may be performed under GAGAS as follows: 

a. Financial audits: chapters 1 through 5 apply. 

b. Attestation engagements: chapters 1 through 3 and 6 apply. 

c. Performance audits: chapters 1 through 3 and 7 and 8 apply. 

1.21 Appendix I includes supplemental guidance for auditors and the 
audited entities to assist in the implementation of GAGAS. Appendix I 
does not establish auditor requirements but instead is intended to 
facilitate auditor implementation of the standards contained in 
chapters 1 through 8. 

Financial Audits: 

1.22 Financial audits provide an independent assessment of and 
reasonable assurance about whether an entity's reported financial 
condition, results, and use of resources are presented fairly in 
accordance with recognized criteria. Reporting on financial audits 
performed in accordance with GAGAS also includes reports on internal 
control, compliance with laws and regulations, and provisions of 
contracts and grant agreements as they relate to financial 
transactions, systems, and processes. Financial audits performed under 
GAGAS include financial statement audits and other related financial 
audits: 

a. Financial statement audits: The primary purpose of a financial 
statement audit is to provide reasonable assurance through an opinion 
(or disclaim an opinion) about whether an entity's financial statements 
are presented fairly in all material respects in conformity with 
generally accepted accounting principles (GAAP),[Footnote 9] or with a 
comprehensive basis of accounting other than GAAP. 

b. Other types of financial audits: Other types of financial audits 
under GAGAS provide for different levels of assurance and entail 
various scopes of work, including: (1) providing special reports, such 
as for specified elements, accounts, or items of a financial 
statement;[Footnote 10](2) reviewing interim financial 
information;[Footnote 11] (3) issuing letters for underwriters and 
certain other requesting parties; (4) reporting on the controls over 
processing of transactions by service organizations;[Footnote 12] and 
(5) auditing compliance with regulations relating to federal award 
expenditures and other governmental financial assistance in conjunction 
with or as a by-product of a financial statement audit. 

Attestation Engagements: 

1.23 Attestation engagements can cover a broad range of financial or 
nonfinancial objectives and may provide different levels of assurance 
about the subject matter or assertion depending on the users' needs. 
Attestation engagements result in an examination, a review, or an 
agreed-upon procedures report on a subject matter or on an assertion 
about a subject matter that is the responsibility of another party. The 
three types of attestation engagements are: 

a. Examination: Consists of obtaining sufficient, appropriate evidence 
to express an opinion on whether the subject matter is based on (or in 
conformity with) the criteria in all material respects or the assertion 
is presented (or fairly stated), in all material respects, based on the 
criteria. 

b. Review: Consists of sufficient testing to express a conclusion about 
whether any information came to the auditors' attention on the basis of 
the work performed that indicates the subject matter is not based on 
(or not in conformity with) the criteria or the assertion is not 
presented (or not fairly stated) in all material respects based on the 
criteria. As stated in the AICPA SSAE, auditors should not perform 
review-level work for reporting on internal control or compliance with 
laws and regulations. 

c. Agreed-Upon Procedures: Consists of specific procedures performed on 
a subject matter. 

1.24 The subject matter of an attestation engagement may take many 
forms. Possible subjects of attestation engagements include reporting 
on: 

a. prospective financial or performance information; 

b. management's discussion and analysis (MD&A) presentation; 

c. an entity's internal control over financial reporting; 

d. the effectiveness of an entity's internal control over compliance 
with specified requirements, such as those governing the bidding for, 
accounting for, and reporting on grants and contracts; 

e. an entity's compliance with requirements of specified laws, 
regulations, policies, contracts, or grants; 

f. the accuracy and reliability of reported performance measures; 

g. incurred final contract costs are supported with required evidence 
and in compliance with the contract terms; 

h. the allowability and reasonableness of proposed contract amounts 
that are based on detailed costs; 

i. the quantity, condition, or valuation of inventory or assets; and: 

j. specific procedures performed on a subject matter (agreed-upon 
procedures). 

Performance Audits: 

1.25 Performance audits are defined as engagements that provide 
assurance or conclusions based on an evaluation of sufficient, 
appropriate evidence against stated criteria, such as specific 
requirements, measures, or defined business practices. Performance 
audits provide objective analysis so that management and those charged 
with governance and oversight can use the information to improve 
program[Footnote 13] performance and operations, reduce costs, 
facilitate decision making by parties with responsibility to oversee or 
initiate corrective action, and contribute to public accountability. 
Reporting information without following GAGAS is not a performance 
audit but a nonaudit service provided by an audit organization. 

1.26 Performance audits that comply with GAGAS provide reasonable 
assurance that the auditors have obtained sufficient, appropriate 
evidence to support the conclusions reached. Thus, the sufficiency and 
appropriateness of evidence needed and tests of evidence will vary 
based on the audit objectives and conclusions. 

1.27 A performance audit is a dynamic process that includes 
consideration of the applicable standards throughout the course of the 
audit. An ongoing assessment of the objectives, audit risk, audit 
procedures, and evidence during the course of the audit facilitates the 
auditors' determination of what to report and the proper context for 
the audit conclusions, including discussion about the sufficiency and 
appropriateness of evidence being used as a basis for the audit 
conclusions. Performance audit conclusions logically flow from all of 
these elements and provide an assessment of the audit findings and 
their implications. 

1.28 Performance audit objectives may vary widely and include 
assessments of program effectiveness, economy, and efficiency; internal 
control;[Footnote 14] compliance; and prospective analyses. These 
overall objectives are not mutually exclusive. Thus, a performance 
audit may have more than one overall objective. For example, a 
performance audit with an initial objective of program effectiveness 
may also involve an underlying objective of evaluating internal 
controls to determine the reasons for a program's lack of effectiveness 
or how effectiveness can be improved. 

1.29 Program effectiveness and results audit objectives are frequently 
interrelated with economy and efficiency objectives. Audit objectives 
that focus on program effectiveness and results typically measure the 
extent to which a program is achieving its goals and objectives. Audit 
objectives that focus on economy and efficiency address the costs and 
resources used to achieve program results. Examples of audit objectives 
in these categories include: 

a. assessing the extent to which legislative, regulatory, or 
organizational goals and objectives are being achieved; 

b. assessing the relative ability of alternative approaches to yield 
better program performance or eliminate factors that inhibit program 
effectiveness; 

c. analyzing the relative cost-effectiveness of a program or 
activity;[Footnote 15] 

d. determining whether a program produced intended results or produced 
results that were not consistent with the program's objectives; 

e. determining the current status or condition of program operations or 
progress in implementing legislative requirements; 

f. determining whether a program provides equitable access to or 
distribution of public resources within the context of statutory 
parameters; 

g. assessing the extent to which programs duplicate, overlap, or 
conflict with other related programs; 

h. evaluating whether the audited entity is following sound procurement 
practices; 

i. assessing the reliability, validity, or relevance of performance 
measures concerning program effectiveness and results, or economy and 
efficiency; 

j. assessing the reliability, validity, or relevance of financial 
information related to the performance of a program; 

k. determining whether government resources (inputs) are obtained at 
reasonable costs while meeting timeliness and quality considerations; 

l. determining whether appropriate value was obtained based on the cost 
or amount paid or based on the amount of revenue received; 

m. determining whether government services and benefits are accessible 
to those individuals who have a right to access those services and 
benefits; 

n. determining whether fees assessed cover costs; 

o. determining whether and how the program's unit costs can be 
decreased or its productivity increased; and: 

p. assessing the reliability, validity, or relevance of budget 
proposals or budget requests to assist legislatures in the budget 
process. 

1.30 Internal control audit objectives relate to an assessment of the 
component of an organization's system of internal control that is 
designed to provide reasonable assurance of achieving effective and 
efficient operations, reliable financial and performance reporting, or 
compliance with applicable laws and regulations. Internal control 
objectives also may be relevant when determining the cause of 
unsatisfactory program performance. Internal control comprises the 
plans, policies, methods, and procedures used to meet the 
organization's mission, goals, and objectives. Internal control 
includes the processes and procedures for planning, organizing, 
directing, and controlling program operations, and management's system 
for measuring, reporting, and monitoring program performance. Examples 
of audit objectives related to internal control include an assessment 
of the extent to which internal control provides reasonable assurance 
about whether: 

a. organizational missions, goals, and objectives are achieved 
effectively and efficiently; 

b. resources are used in compliance with laws, regulations, or other 
requirements; 

c. resources, including sensitive information accessed or stored 
outside the organization's physical perimeter, are safeguarded against 
unauthorized acquisition, use, or disposition; 

d. management information, such as performance measures, and public 
reports are complete, accurate, and consistent to support performance 
and decision making; 

e. the integrity of information from computerized systems is achieved; 
and: 

f. contingency planning for information systems provides essential back-
up to prevent unwarranted disruption of the activities and functions 
that the systems support. 

1.31 Compliance audit objectives relate to compliance criteria 
established by laws, regulations, contract provisions, grant 
agreements, and other requirements[Footnote 16] that could affect the 
acquisition, protection, use, and disposition of the entity's resources 
and the quantity, quality, timeliness, and cost of services the entity 
produces and delivers. Compliance objectives include determining 
whether: 

a. the purpose of the program, the manner in which it is to be 
conducted, the services delivered, the outcomes, or the population it 
serves is in compliance with laws, regulations, contract provisions, 
grant agreements, and other requirements; 

b. government services and benefits are distributed or delivered to 
citizens based on the individual's eligibility to obtain those services 
and benefits; 

c. incurred or proposed costs are in compliance with applicable laws, 
regulations, and contracts or grant agreements; and: 

d. revenues received are in compliance with applicable laws, 
regulations, and contract or grant agreements. 

1.32 Prospective analysis audit objectives provide analysis or 
conclusions, about information that is based on assumptions about 
events that may occur in the future along with possible actions that 
the audited entity may take in response to the future events. Examples 
of objectives pertaining to this work include providing conclusions 
based on: 

a. current and projected trends and future potential impact on 
government programs and services; 

b. program or policy alternatives, including forecasting program 
outcomes under various assumptions; 

c. policy or legislative proposals, including advantages, 
disadvantages, and analysis of stakeholder views; 

d. prospective information prepared by management; 

e. budgets and forecasts that are based on (1) assumptions about 
expected future events and (2) management's expected reaction to those 
future events; and: 

f. management's assumptions on which prospective information is based. 

Professional Services Other Than Audits (Nonaudit Services) Provided by 
Audit Organizations: 

1.33 GAGAS do not cover professional services other than audits or 
attestation engagements (nonaudit services). (See paragraphs 3.25 
through 3.30 for additional discussion of nonaudit services.) 
Therefore, auditors must not report that the nonaudit services were 
conducted in accordance with GAGAS. When performing nonaudit services 
for an entity for which the audit organization performs a GAGAS audit 
or attestation engagement, audit organizations should communicate, as 
appropriate, with requestors and those charged with governance to 
clarify that the scope of work performed does not constitute an audit 
under GAGAS. 

1.34 Audit organizations that provide nonaudit services must evaluate 
whether providing nonaudit services creates an independence impairment 
either in fact or appearance with respect to the entities they audit. 
(See paragraph 3.02.) 

[End of section] 

Chapter 2 Ethical Principles in Government Auditing: 

[End of section] 

Introduction: 

2.01 Because auditing is essential to government accountability to the 
public, the public expects audit organizations and auditors who conduct 
their work in accordance with generally accepted government auditing 
standards (GAGAS) to follow ethical principles. Management of the audit 
organization sets the tone for ethical behavior throughout the 
organization by maintaining an ethical culture, clearly communicating 
acceptable behavior and expectations to each employee, and creating an 
environment that reinforces and encourages ethical behavior throughout 
all levels of the organization. The ethical tone maintained and 
demonstrated by management and staff is an essential element of a 
positive ethical environment for the audit organization. 

2.02 The ethical principles presented in this chapter provide the 
foundation, discipline, and structure as well as the climate which 
influence the application of GAGAS. Because the information presented 
in this chapter deals with fundamental principles rather than specific 
requirements, this chapter does not contain additional requirements. 

2.03 Conducting audit work in accordance with ethical principles is a 
matter of personal and organizational responsibility. Ethical 
principles apply in preserving auditor independence,[Footnote 17] 
taking on only work that the auditor is competent to perform, 
performing high-quality work, and following the applicable standards 
cited in the audit report. Integrity and objectivity are maintained 
when auditors perform their work and make decisions that are consistent 
with the broader interest of those relying on the auditors' report, 
including the public. 

Ethical Principles: 

2.04 The ethical principles contained in the following sections provide 
the overall framework for application of GAGAS, including general 
standards, field work standards, and reporting standards. Each 
principle is described, rather than set forth as a series of 
requirements, so that auditors can consider the facts and circumstances 
of each situation within the framework of these ethical principles. 
Other ethical requirements or codes of professional conduct may also be 
applicable to auditors who conduct audits in accordance with 
GAGAS.[Footnote 18] 

2.05 The ethical principles that guide the work of auditors who conduct 
audits in accordance with GAGAS are: 

a. the public interest; 

b. integrity; 

c. objectivity; 

d. proper use of government information, resources, and position; and: 

e. professional behavior. 

The Public Interest: 

2.06 The public interest is defined as the collective well-being of the 
community of people and entities the auditors serve. Observing 
integrity, objectivity, and independence in discharging their 
professional responsibilities assists auditors in meeting the principle 
of serving the public interest and honoring the public trust. These 
principles are fundamental to the responsibilities of auditors and 
critical in the government environment. 

2.07 A distinguishing mark of an auditor is acceptance of 
responsibility to serve the public interest. This responsibility is 
critical when auditing in the government environment. GAGAS embody the 
concept of accountability for public resources, which is fundamental to 
serving the public interest. 

Integrity: 

2.08 Public confidence in government is maintained and strengthened by 
auditors' performing their professional responsibilities with 
integrity. Integrity includes auditors' conducting their work with an 
attitude that is objective, fact-based, nonpartisan, and nonideological 
with regard to audited entities and users of the auditors' reports. 
Within the constraints of applicable confidentiality laws, rules, or 
policies, communications with the audited entity, those charged with 
governance, and the individuals contracting for or requesting the audit 
are expected to be honest, candid, and constructive. 

2.09 Making decisions consistent with the public interest of the 
program or activity under audit is an important part of the principle 
of integrity. In discharging their professional responsibilities, 
auditors may encounter conflicting pressures from management of the 
audited entity, various levels of government, and other likely users. 
Auditors may also encounter pressures to violate ethical principles to 
inappropriately achieve personal or organizational gain. In resolving 
those conflicts and pressures, acting with integrity means that 
auditors place priority on their responsibilities to the public 
interest. 

Objectivity: 

2.10 The credibility of auditing in the government sector is based on 
auditors' objectivity in discharging their professional 
responsibilities. Objectivity includes being independent in fact and 
appearance when providing audit and attestation engagements, 
maintaining an attitude of impartiality, having intellectual honesty, 
and being free of conflicts of interest. Avoiding conflicts that may, 
in fact or appearance, impair auditors' objectivity in performing the 
audit or attestation engagement is essential to retaining credibility. 
Maintaining objectivity includes a continuing assessment of 
relationships with audited entities and other stakeholders in the 
context of the auditors' responsibility to the public.[Footnote 19] 

Proper Use of Government Information, Resources, and Position: 

2.11 Government information, resources, or positions are to be used for 
official purposes and not inappropriately for the auditor's personal 
gain or in a manner contrary to law or detrimental to the legitimate 
interests of the audited entity or the audit organization. This concept 
includes the proper handling of sensitive or classified information or 
resources. 

2.12 In the government environment, the public's right to the 
transparency of government information has to be balanced with the 
proper use of that information. In addition, many government programs 
are subject to laws and regulations dealing with the disclosure of 
information. To accomplish this balance, exercising discretion in the 
use of information acquired in the course of auditors' duties is an 
important part in achieving this goal. Improperly disclosing any such 
information to third parties is not an acceptable practice. 

2.13 As accountability professionals, accountability to the public for 
the proper use and prudent management of government resources is an 
essential part of auditors' responsibilities. Protecting and conserving 
government resources and using them appropriately for authorized 
activities is an important element in the public's expectations for 
auditors. 

2.14 Misusing the position of an auditor for personal gain violates an 
auditor's fundamental responsibilities. An auditor's credibility can be 
damaged by actions that could be perceived by an objective third party 
with knowledge of the relevant information as improperly benefiting an 
auditor's personal financial interests or those of an immediate or 
close family member; a general partner; an organization for which the 
auditor serves as an officer, director, trustee, or employee; or an 
organization with which the auditor is negotiating concerning future 
employment. (See paragraphs 3.07 through 3.09 for further discussion of 
personal impairments to independence.) 

Professional Behavior: 

2.15 High expectations for the auditing profession include compliance 
with laws and regulations and avoidance of any conduct that might bring 
discredit to auditors' work, including actions that would cause an 
objective third party with knowledge of the relevant information to 
conclude that the auditors' work was professionally deficient. 
Professional behavior includes auditors' putting forth an honest effort 
in performance of their duties and professional services in accordance 
with the relevant technical and professional standards. 

[End of section] 

Chapter 3 General Standards: 

Introduction: 

3.01 This chapter establishes general standards and provides guidance 
for performing financial audits, attestation engagements, and 
performance audits under generally accepted government auditing 
standards (GAGAS). (See chapter 6 for an additional general standard 
applicable only to attestation engagements.) These general standards, 
along with the overarching ethical principles presented in chapter 2, 
establish a foundation for credibility of auditors' work. These general 
standards emphasize the independence of the audit organization and its 
individual auditors; the exercise of professional judgment in the 
performance of work and the preparation of related reports; the 
competence of audit staff; audit quality control and assurance; and 
external peer reviews. 

Independence: 

3.02 In all matters relating to the audit work, the audit organization 
and the individual auditor, whether government or public, must be free 
from personal, external, and organizational impairments to 
independence, and must avoid the appearance of such impairments of 
independence. 

3.03 Auditors and audit organizations must maintain independence so 
that their opinions, findings, conclusions, judgments, and 
recommendations will be impartial and viewed as impartial by objective 
third parties with knowledge of the relevant information. Auditors 
should avoid situations that could lead objective third parties with 
knowledge of the relevant information to conclude that the auditors are 
not able to maintain independence and thus are not capable of 
exercising objective and impartial judgment on all issues associated 
with conducting the audit and reporting on the work. 

3.04 When evaluating whether independence impairments exist either in 
fact or appearance with respect to the entities for which audit 
organizations perform audits or attestation engagements, auditors and 
audit organizations must take into account the three general classes of 
impairments to independence--personal, external, and 
organizational.[Footnote 20] If one or more of these impairments 
affects or can be perceived to affect independence, the audit 
organization (or auditor) should decline to perform the work--except in 
those situations in which an audit organization in a government entity, 
because of a legislative requirement or for other reasons, cannot 
decline to perform the work, in which case the government audit 
organization must disclose the impairment(s) and modify the GAGAS 
compliance statement. (See paragraphs 1.12 and 1.13.) 

3.05 When auditors use the work of a specialist,[Footnote 21] auditors 
should assess the specialist's ability to perform the work and report 
results impartially as it relates to their relationship with the 
program or entity under audit. If the specialist's independence is 
impaired, auditors should not use the work of that specialist. 

3.06 If an impairment to independence is identified after the audit 
report is issued, the audit organization should assess the impact on 
the audit. If the audit organization concludes that it did not comply 
with GAGAS, it should determine the impact on the auditors' report and 
notify entity management, those charged with governance, the 
requesters, or regulatory agencies that have jurisdiction over the 
audited entity and persons known to be using the audit report about the 
independence impairment and the impact on the audit. The audit 
organization should make such notifications in writing. 

Personal Impairments: 

3.07 Auditors participating on an audit assignment must be free from 
personal impairments to independence.[Footnote 22] Personal impairments 
of auditors result from relationships or beliefs that might cause 
auditors to limit the extent of the inquiry, limit disclosure, or 
weaken or slant audit findings in any way. Individual auditors should 
notify the appropriate officials within their audit organizations if 
they have any personal impairment to independence. Examples of personal 
impairments of individual auditors include, but are not limited to, the 
following: 

a. immediate family or close family member[Footnote 23] who is a 
director or officer of the audited entity, or, as an employee of the 
audited entity, is in a position to exert direct and significant 
influence over the entity or the program under audit; 

b. financial interest that is direct, or is significant/material though 
indirect, in the audited entity or program;[Footnote 24] 

c. responsibility for managing an entity or making decisions that could 
affect operations of the entity or program being audited; for example, 
serving as a director, officer, or other senior position of the entity, 
activity, or program being audited, or as a member of management in any 
decision making, supervisory, or ongoing monitoring function for the 
entity, activity, or program under audit; 

d. concurrent or subsequent performance of an audit by the same 
individual who maintained the official accounting records when such 
services involved preparing source documents or originating data, in 
electronic or other form; posting transactions (whether coded by 
management or not coded); authorizing, executing, or consummating 
transactions (for example, approving invoices, payrolls, claims, or 
other payments of the entity or program being audited); maintaining an 
entity's bank account or otherwise having custody of the audited 
entity's funds; or otherwise exercising authority on behalf of the 
entity, or having authority to do so; 

e. preconceived ideas toward individuals, groups, organizations, or 
objectives of a particular program that could bias the audit; 

f. biases, including those resulting from political, ideological, or 
social convictions that result from membership or employment in, or 
loyalty to, a particular type of policy, group, organization, or level 
of government; and: 

g. seeking employment during the conduct of the audit with an audited 
organization. 

3.08 Audit organizations and auditors may encounter many different 
circumstances or combinations of circumstances that could create a 
personal impairment. Therefore, it is impossible to identify every 
situation that could result in a personal impairment. Accordingly, 
audit organizations should include as part of their quality control 
system procedures to identify personal impairments and help ensure 
compliance with GAGAS independence requirements. At a minimum, audit 
organizations should: 

a. establish policies and procedures to identify, report, and resolve 
personal impairments to independence, 

b. communicate the audit organization's policies and procedures to all 
auditors in the organization and promote understanding of the policies 
and procedures, 

c. establish internal policies and procedures to monitor compliance 
with the audit organization's policies and procedures, 

d. establish a disciplinary mechanism to promote compliance with the 
audit organization's policies and procedures, 

e. stress the importance of independence and the expectation that 
auditors will always act in the public interest, and: 

f. maintain documentation of the steps taken to identify potential 
personal independence impairments. 

3.09 When the audit organization identifies a personal impairment to 
independence prior to or during an audit, the audit organization should 
take action to resolve the impairment in a timely manner. In situations 
in which the personal impairment is applicable only to an individual 
auditor or a specialist on a particular audit, the audit organization 
may be able to eliminate the personal impairment. For example, the 
audit organization could remove that auditor or specialist from any 
work on that audit or require the auditor or specialist to eliminate 
the cause of the personal impairment. If the personal impairment cannot 
be eliminated, the audit organization should withdraw from the audit. 
In situations in which auditors employed by government entities cannot 
withdraw from the audit, they should follow paragraph 3.04. 

External Impairments: 

3.10 Audit organizations must be free from external impairments to 
independence. Factors external to the audit organization may restrict 
the work or interfere with auditors' ability to form independent and 
objective opinions, findings, and conclusions. External impairments to 
independence occur when auditors are deterred from acting objectively 
and exercising professional skepticism by pressures, actual or 
perceived, from management and employees of the audited entity or 
oversight organizations. For example, under the following conditions, 
auditors may not have complete freedom to make an independent and 
objective judgment, thereby adversely affecting the audit: 

a. external interference or influence that could improperly limit or 
modify the scope of an audit or threaten to do so, including exerting 
pressure to inappropriately reduce the extent of work performed in 
order to reduce costs or fees; 

b. external interference with the selection or application of audit 
procedures or in the selection of transactions to be examined; 

c. unreasonable restrictions on the time allowed to complete an audit 
or issue the report; 

d. externally imposed restriction on access to records, government 
officials, or other individuals needed to conduct the audit; 

e. external interference over the assignment, appointment, 
compensation, and promotion of audit personnel; 

f. restrictions on funds or other resources provided to the audit 
organization that adversely affect the audit organization's ability to 
carry out its responsibilities; 

g. authority to overrule or to inappropriately influence the auditors' 
judgment as to the appropriate content of the report; 

h. threat of replacing the auditors over a disagreement with the 
contents of an audit report, the auditors' conclusions, or the 
application of an accounting principle or other criteria; and: 

i. influences that jeopardize the auditors' continued employment for 
reasons other than incompetence, misconduct, or the need for audits or 
attestation engagements. 

3.11 Audit organizations should include policies and procedures for 
identifying and resolving external impairments as part of their quality 
control system for compliance with GAGAS independence requirements. 

Organizational Independence: 

3.12 The ability of audit organizations in government entities to 
perform work and report the results objectively can be affected by 
placement within government, and the structure of the government entity 
being audited. Whether reporting to third parties externally or to top 
management within the audited entity internally, audit organizations 
must be free from organizational impairments to independence with 
respect to the entities they audit. Impairments to organizational 
independence result when the audit function is organizationally located 
within the reporting line of the areas under audit or when the auditor 
is assigned or takes on responsibilities that affect operations of the 
area under audit. 

Organizational Independence for External Audit Organizations: 

3.13 External audit organizations can be presumed to be free from 
organizational impairments to independence when the audit function is 
organizationally placed outside the reporting line of the entity under 
audit and the auditor is not responsible for entity operations. Audit 
organizations in government entities can meet the requirement for 
organizational independence in a number of ways and may be presumed to 
be free from organizational impairments to independence from the 
audited entity if the audit organization is: 

a. at a level of government other than the one to which the audited 
entity is assigned (federal, state, or local); for example, federal 
auditors auditing a state government program; or: 

b. in a different branch of government within the same level of 
government as the audited entity; for example, legislative auditors 
auditing an executive branch program. 

3.14 Audit organizations in government entities may also be presumed to 
be free from organizational impairments if the head of the audit 
organization meets any of the following criteria: 

a. directly elected by voters of the jurisdiction being audited; 

b. elected or appointed by a legislative body, subject to removal by a 
legislative body, and reports the results of audits to and is 
accountable to a legislative body; 

c. appointed by someone other than a legislative body, so long as the 
appointment is confirmed by a legislative body and removal from the 
position is subject to oversight or approval by a legislative 
body,[Footnote 25] and reports the results of audits to and is 
accountable to a legislative body; or: 

d. appointed by, accountable to, reports to, and can only be removed by 
a statutorily created governing body, the majority of whose members are 
independently elected or appointed and come from outside the 
organization being audited. 

3.15 In addition to the presumptive criteria in paragraphs 3.13 and 
3.14, GAGAS recognize that there may be other organizational structures 
under which audit organizations in government entities could be 
considered to be free from organizational impairments and thereby be 
considered organizationally independent for reporting externally. These 
structures provide safeguards to prevent the audited entity from 
interfering with the audit organization's ability to perform the work 
and report the results impartially. For an external audit organization 
to be considered free from organizational impairments under a structure 
different from the ones listed in paragraphs 3.13 and 3.14, the audit 
organization should have all of the following safeguards. In such 
situations, the audit organization should document how each of the 
following safeguards were satisfied and provide the documentation to 
those performing quality control monitoring and to the external peer 
reviewers to determine whether all the necessary safeguards have been 
met. 

a. statutory protections that prevent the audited entity from 
abolishing the audit organization; 

b. statutory protections that require that if the head of the audit 
organization is removed from office, the head of the agency report this 
fact and the reasons for the removal to the legislative body; 

c. statutory protections that prevent the audited entity from 
interfering with the initiation, scope, timing, and completion of any 
audit; 

d. statutory protections that prevent the audited entity from 
interfering with audit reporting, including the findings and 
conclusions or the manner, means, or timing of the audit organization's 
reports; 

e. statutory protections that require the audit organization to report 
to a legislative body or other independent governing body on a 
recurring basis; 

f. statutory protections that give the audit organization sole 
authority over the selection, retention, advancement, and dismissal of 
its staff; and: 

g. statutory access to records and documents related to the agency, 
program, or function being audited and access to government officials 
or other individuals as needed to conduct the audit.[Footnote 26] 

Organizational Independence for Internal Audit Functions: 

3.16 Certain federal, state, or local government entities employ 
auditors to work for management of the audited entities. These auditors 
may be subject to administrative direction from persons involved in the 
entity management process. Such audit organizations are internal audit 
functions and are encouraged to use the Institute of Internal Auditors 
(IIA) International Standards for the Professional Practice of Internal 
Auditing in conjunction with GAGAS. Under GAGAS, a government internal 
audit function can be presumed to be free from organizational 
impairments to independence for reporting internally if the head of the 
audit organization meets all of the following criteria: 

a. is accountable to the head or deputy head of the government entity 
or to those charged with governance; 

b. reports the audit results both to the head or deputy head of the 
government entity and to those charged with governance; 

c. is located organizationally outside the staff or line-management 
function of the unit under audit; 

d. has access to those charged with governance; and: 

e. is sufficiently removed from political pressures to conduct audits 
and report findings, opinions, and conclusions objectively without fear 
of political reprisal. 

3.17 The internal audit organization should report regularly to those 
charged with governance. 

3.18 When internal audit organizations that are free of organizational 
impairments perform audits of external parties such as auditing 
contractors or outside party agreements, and no personal or external 
impairments exist, they may be considered independent of the audited 
entities and free to report objectively to the heads or deputy heads of 
the government entities to which they are assigned, to those charged 
with governance, and to parties outside the organizations in accordance 
with applicable law, rule, regulation, or policy. 

3.19 The internal audit organization should document the conditions 
that allow it to be considered free of organizational impairments to 
independence for internal reporting and provide the documentation to 
those performing quality control monitoring and to the external peer 
reviewers to determine whether all the necessary safeguards have been 
met. 

Organizational Independence When Performing Nonaudit Services: 

3.20 Audit organizations at times may perform other professional 
services (nonaudit services) that are not performed in accordance with 
GAGAS. Audit organizations that provide nonaudit services must evaluate 
whether providing the services creates an independence impairment 
either in fact or appearance with respect to entities they 
audit.[Footnote 27] Based on the facts and circumstances, professional 
judgment is used in determining whether a nonaudit service would impair 
an audit organization's independence with respect to entities it 
audits. 

3.21 Audit organizations in government entities generally have broad 
audit responsibilities and, therefore, should establish policies and 
procedures for accepting engagements to perform nonaudit services so 
that independence is not impaired with respect to entities they audit. 
(See appendix I, paragraphs A3.02 and A3.03 for examples of nonaudit 
services that are generally specific to audit organizations in 
government entities that generally do not impair the organizations' 
independence with respect to the entities it audits and, therefore, do 
not require compliance with the supplemental safeguards described in 
paragraph 3.30.) Independent public accountants may provide audit and 
nonaudit services (commonly referred to as consulting) under 
contractual commitments to an entity and should determine whether 
nonaudit services they have provided or are committed to provide have a 
significant or material effect on the subject matter of the audits. 

Overarching Independence Principles: 

3.22 The following two overarching principles apply to auditor 
independence when assessing the impact of performing a nonaudit service 
for an audited program or entity: (1) audit organizations must not 
provide nonaudit services that involve performing management functions 
or making management decisions and (2) audit organizations must not 
audit their own work or provide nonaudit services in situations in 
which the nonaudit services are significant or material to the subject 
matter of the audits.[Footnote 28] 

3.23 In considering whether audits performed by the audit organization 
could be significantly or materially affected by the nonaudit service, 
audit organizations should evaluate (1) ongoing audits; (2) planned 
audits; (3) requirements and commitments for providing audits, which 
includes laws, regulations, rules, contracts, and other agreements; and 
(4) policies placing responsibilities on the audit organization for 
providing audit services. 

3.24 If requested[Footnote 29] to perform nonaudit services that would 
impair the audit organization's ability to meet either or both of the 
overarching independence principles for certain types of audit work, 
the audit organization should inform the requestor and the audited 
entity that performing the nonaudit service would impair the auditors' 
independence with regard to subsequent audit or attestation 
engagements. 

Types of Nonaudit Services: 

3.25 Nonaudit services generally fall into one of the following 
categories (see appendix I, paragraphs A3.02 and A3.03 for examples of 
nonaudit services that are generally unique to audit organizations in 
government entities): 

a. Nonaudit services that do not impair the audit organization's 
independence with respect to the entities it audits and, therefore, do 
not require compliance with the supplemental safeguards in paragraph 
3.30. (See paragraphs 3.26 and 3.27.) 

b. Nonaudit services that would not impair the audit organization's 
independence with respect to the entities it audits as long as the 
audit organization complies with the supplemental safeguards in 
paragraph 3.30. (See paragraph 3.28.) 

c. Nonaudit services that do impair the audit organization's 
independence. Compliance with the supplemental safeguards will not 
overcome this impairment. (See paragraph 3.29.) 

Nonaudit Services That Do Not Impair Auditor Independence: 

3.26 Nonaudit services in which auditors provide technical advice based 
on their technical knowledge and expertise do not impair auditor 
independence with respect to entities they audit and do not require the 
audit organization to apply the supplemental safeguards. However, 
auditor independence would be impaired if the extent or nature of the 
advice resulted in the auditors' making management decisions or 
performing management functions. 

3.27 Examples of the types of services considered as providing 
technical advice include the following: 

a. participating in activities such as commissions, committees, task 
forces, panels, and focus groups as an expert in a purely advisory, 
nonvoting capacity to: 

(1) advise entity management on issues based on the auditors' knowledge 
or: 

(2) address urgent problems; 

b. providing tools and methodologies, such as guidance and good 
business practices, benchmarking studies, and internal control 
assessment methodologies that can be used by management; and: 

c. providing targeted and limited technical advice to the audited 
entity and management to assist them in activities such as (1) 
answering technical questions or providing training, (2) implementing 
audit recommendations, (3) implementing internal controls, and (4) 
providing information on good business practices. 

Nonaudit Services That Would Not Impair Independence if Supplemental 
Safeguards Are Implemented: 

3.28 Services that do not impair the audit organization's independence 
with respect to the entities they audit so long as they comply with 
supplemental safeguards include the following: 

a. providing basic accounting assistance limited to services such as 
preparing draft financial statements that are based on management's 
chart of accounts and trial balance and any adjusting, correcting, and 
closing entries that have been approved by management; preparing draft 
notes to the financial statements based on information determined and 
approved by management; preparing a trial balance based on management's 
chart of accounts; maintaining depreciation schedules for which 
management has determined the method of depreciation, rate of 
depreciation, and salvage value of the asset (If the audit organization 
has prepared draft financial statements and notes and performed the 
financial statement audit, the auditor should obtain documentation from 
management in which management acknowledges the audit organization's 
role in preparing the financial statements and related notes and 
management's review, approval, and responsibility for the financial 
statements and related notes in the management representation letter. 
The management representation letter that is obtained as part of the 
audit may be used for this type of documentation.); 

b. providing payroll services when payroll is not material to the 
subject matter of the audit or to the audit objectives. Such services 
are limited to using records and data that have been approved by entity 
management; 

c. providing appraisal or valuation services limited to services such 
as reviewing the work of the entity or a specialist employed by the 
entity where the entity or specialist provides the primary evidence for 
the balances recorded in financial statements or other information that 
will be audited; valuing an entity's pension, other post-employment 
benefits, or similar liabilities provided management has determined and 
taken responsibility for all significant assumptions and data; 

d. preparing an entity's indirect cost proposal[Footnote 30] or cost 
allocation plan provided that the amounts are not material to the 
financial statements and management assumes responsibility for all 
significant assumptions and data; 

e. providing advisory services on information technology limited to 
services such as advising on system design, system installation, and 
system security if management, in addition to the safeguards in 
paragraph 3.30, acknowledges responsibility for the design, 
installation, and internal control over the entity's system and does 
not rely on the auditors' work as the primary basis for determining (1) 
whether to implement a new system, (2) the adequacy of the new system 
design, (3) the adequacy of major design changes to an existing system, 
and (4) the adequacy of the system to comply with regulatory or other 
requirements; 

f. providing human resource services to assist management in its 
evaluation of potential candidates when the services are limited to 
activities such as serving on an evaluation panel of at least three 
individuals to review applications or interviewing candidates to 
provide input to management in arriving at a listing of best qualified 
applicants to be provided to management; and: 

g. preparing routine tax filings based on information provided by the 
audited entity. 

Nonaudit Services That Impair Independence: 

3.29 Compliance with supplemental safeguards will not overcome 
independence impairments in this category. By their nature, certain 
nonaudit services directly support the entity's operations and impair 
the audit organization's ability to meet either or both of the 
overarching independence principles in paragraph 3.22 for certain types 
of audit work. Examples of the types of services under this category 
include the following: 

a. maintaining or preparing the audited entity's basic accounting 
records or maintaining or taking responsibility for basic financial or 
other records that the audit organization will audit; 

b. posting transactions (whether coded or not coded) to the entity's 
financial records or to other records that subsequently provide input 
to the entity's financial records; 

c. determining account balances or determining capitalization criteria; 

d. designing, developing, installing, or operating the entity's 
accounting system or other information systems that are material or 
significant to the subject matter of the audit; 

e. providing payroll services that (1) are material to the subject 
matter of the audit or the audit objectives, and/or (2) involve making 
management decisions; 

f. providing appraisal or valuation services that exceed the scope 
described in paragraph 3.28 c; 

g. recommending a single individual for a specific position that is key 
to the entity or program under audit, otherwise ranking or influencing 
management's selection of the candidate, or conducting an executive 
search or a recruiting program for the audited entity; 

h. developing an entity's performance measurement system when that 
system is material or significant to the subject matter of the audit; 

i. developing an entity's policies, procedures, and internal controls; 

j. performing management's assessment of internal controls when those 
controls are significant to the subject matter of the audit; 

k. providing services that are intended to be used as management's 
primary basis for making decisions that are significant to the subject 
matter under audit; 

l. carrying out internal audit functions, when performed by external 
auditors; and: 

m. serving as voting members of an entity's management committee or 
board of directors, making policy decisions that affect future 
direction and operation of an entity's programs, supervising entity 
employees, developing programmatic policy, authorizing an entity's 
transactions, or maintaining custody of an entity's assets.[Footnote 
31] 

Supplemental Safeguards for Maintaining Auditor Independence When 
Performing Nonaudit Services: 

3.30 Performing nonaudit services described in paragraph 3.28 will not 
impair independence if the overarching independence principles stated 
in paragraph 3.22 are not violated. For these nonaudit services, the 
audit organization should comply with each of the following safeguards: 

a. document its consideration of the nonaudit services, including its 
conclusions about the impact on independence; 

b. establish in writing an understanding with the audited entity 
regarding the objectives, scope of work, and product or deliverables of 
the nonaudit service; and management's responsibility for (1) the 
subject matter of the nonaudit services, (2) the substantive outcomes 
of the work, and (3) making any decisions that involve management 
functions related to the nonaudit service and accepting full 
responsibility for such decisions; 

c. exclude personnel who provided the nonaudit services from planning, 
conducting, or reviewing audit work in the subject matter of the 
nonaudit service;[Footnote 32] and: 

d. do not reduce the scope and extent of the audit work below the level 
that would be appropriate if the nonaudit service were performed by an 
unrelated party. 

Professional Judgment: 

3.31 Auditors must use professional judgment in planning and performing 
audits and attestation engagements and in reporting the results. 

3.32 Professional judgment includes exercising reasonable care and 
professional skepticism. Reasonable care concerns acting diligently in 
accordance with applicable professional standards and ethical 
principles. Professional skepticism is an attitude that includes a 
questioning mind and a critical assessment of evidence. Professional 
skepticism includes a mindset in which auditors assume neither that 
management is dishonest nor of unquestioned honesty. Believing that 
management is honest is not a reason to accept less than sufficient, 
appropriate evidence. 

3.33 Using the auditors' professional knowledge, skills, and experience 
to diligently perform, in good faith and with integrity, the gathering 
of information and the objective evaluation of the sufficiency and 
appropriateness of evidence is a critical component of audits. 
Professional judgment and competence are interrelated because judgments 
made are dependent upon the auditors' competence. 

3.34 Professional judgment represents the application of the collective 
knowledge, skills, and experiences of all the personnel involved with 
an assignment, as well as the professional judgment of individual 
auditors. In addition to personnel directly involved in the audit, 
professional judgment may involve collaboration with other 
stakeholders, outside experts, and management in the audit 
organization. 

3.35 Using professional judgment in all aspects of carrying out their 
professional responsibilities, including following the independence 
standards, maintaining objectivity and credibility, assigning competent 
audit staff to the assignment, defining the scope of work, evaluating 
and reporting the results of the work, and maintaining appropriate 
quality control over the assignment process is essential to performing 
and reporting on an audit. 

3.36 Using professional judgment is important in determining the 
required level of understanding of the audit subject matter and related 
circumstances. This includes consideration about whether the audit 
team's collective experience, training, knowledge, skills, abilities, 
and overall understanding are sufficient to assess the risks that the 
subject matter under audit may contain a significant inaccuracy or 
could be misinterpreted. 

3.37 Considering the risk level of each assignment, including the risk 
that they may come to an improper conclusion is another important 
issue. Within the context of audit risk, exercising professional 
judgment in determining the sufficiency and appropriateness of evidence 
to be used to support the findings and conclusions based on the audit 
objectives and any recommendations reported is an integral part of the 
audit process. 

3.38 Auditors should document significant decisions affecting the audit 
objectives, scope, and methodology; findings; conclusions; and 
recommendations resulting from professional judgment. 

3.39 While this standard places responsibility on each auditor and 
audit organization to exercise professional judgment in planning and 
performing an audit or attestation engagement, it does not imply 
unlimited responsibility, nor does it imply infallibility on the part 
of either the individual auditor or the audit organization. Absolute 
assurance is not attainable because of the nature of evidence and the 
characteristics of fraud. Professional judgment does not mean 
eliminating all possible limitations or weaknesses associated with a 
specific audit, but rather identifying, considering, minimizing, 
mitigating, and explaining them. 

Competence: 

3.40 The staff assigned to perform the audit or attestation engagement 
must collectively possess adequate professional competence for the 
tasks required. 

3.41 The audit organization's management should assess skill needs to 
consider whether its workforce has the essential skills that match 
those necessary to fulfill a particular audit mandate or scope of 
audits to be performed. Accordingly, audit organizations should have a 
process for recruitment, hiring, continuous development, assignment, 
and evaluation of staff to maintain a competent workforce. The nature, 
extent, and formality of the process will depend on various factors 
such as the size of the audit organization, its structure, and its 
work. 

3.42 Competence is derived from a blending of education and experience. 
Competencies are not necessarily measured by years of auditing 
experience because such a quantitative measurement may not accurately 
reflect the kinds of experiences gained by an auditor in any given time 
period. Maintaining competence through a commitment to learning and 
development throughout an auditor's professional life is an important 
element for auditors. Competence enables an auditor to make sound 
professional judgments. 

Technical Knowledge and Competence: 

3.43 The staff assigned to conduct an audit or attestation engagement 
under GAGAS must collectively possess the technical knowledge, skills, 
and experience necessary to be competent for the type of work being 
performed before beginning work on that assignment. The staff assigned 
to a GAGAS audit or attestation engagement should collectively possess: 

a. knowledge of GAGAS applicable to the type of work they are assigned 
and the education, skills, and experience to apply this knowledge to 
the work being performed; 

b. general knowledge of the environment in which the audited entity 
operates and the subject matter under review; 

c. skills to communicate clearly and effectively, both orally and in 
writing; and: 

d. skills appropriate for the work being performed. For example, staff 
or specialist skills in: 

(1) statistical sampling if the work involves use of statistical 
sampling; 

(2) information technology if the work involves review of information 
systems; 

(3) engineering if the work involves review of complex engineering 
data; 

(4) specialized audit methodologies or analytical techniques, such as 
the use of complex survey instruments, actuarial-based estimates, or 
statistical analysis tests, as applicable; or: 

(5) specialized knowledge in subject matters, such as scientific, 
medical, environmental, educational, or any other specialized subject 
matter, if the work calls for such expertise. 

Additional Qualifications for Financial Audits and Attestation 
Engagements: 

3.44 Auditors performing financial audits should be knowledgeable in 
generally accepted accounting principles (GAAP), the American Institute 
of Certified Public Accountants (AICPA) generally accepted auditing 
standards for field work and reporting and the related Statements on 
Auditing Standards (SAS), and the application of these standards. Also, 
if auditors use GAGAS in conjunction with any other standards, they 
should be knowledgeable and competent in applying those standards. 
Auditors engaged to perform financial audits or attestation engagements 
should be licensed certified public accountants or persons working for 
a licensed certified public accounting firm or a government auditing 
organization.[Footnote 33] 

3.45 Similarly, for attestation engagements, GAGAS incorporate the 
AICPA attestation standards. Auditors should be knowledgeable in the 
AICPA general attestation standard related to criteria, the AICPA 
attestation standards for field work and reporting, and the related 
Statements on Standards for Attestation Engagements (SSAE), and they 
should be competent in applying these standards and SSAE to the task 
assigned. Also, if auditors use GAGAS in conjunction with any other 
standards, they should be knowledgeable and competent in applying those 
standards. 

Continuing Professional Education: 

3.46 Auditors performing work under GAGAS, including planning, 
directing, performing field work, or reporting on an audit or 
attestation engagement under GAGAS, should maintain their professional 
competence through continuing professional education (CPE). Therefore, 
each auditor performing work under GAGAS should complete, every 2 
years, at least 24 hours of CPE that directly relates to government 
auditing, the government environment, or the specific or unique 
environment in which the audited entity operates. For auditors who are 
involved in any amount of planning, directing, or reporting on GAGAS 
assignments and those auditors who are not involved in those activities 
but charge 20 percent or more of their time annually to GAGAS 
assignments should also obtain at least an additional 56 hours of CPE 
(for a total of 80 hours of CPE in every 2-year period) that enhances 
the auditor's professional proficiency to perform audits or attestation 
engagements. Auditors required to take the total 80 hours of CPE should 
complete at least 20 hours of CPE in each year of the 2-year period. 

3.47 CPE programs are structured educational activities with learning 
objectives designed to maintain or enhance participants' knowledge, 
skills, and abilities in areas applicable to performing audits or 
attestation engagements. Determining what subjects are appropriate for 
individual auditors to satisfy both the 80-hour and the 24-hour 
requirements is a matter of professional judgment to be exercised by 
auditors in consultation with appropriate officials in their audit 
organizations. Among the considerations in exercising that judgment are 
the auditors' experience, the responsibilities they assume in 
performing GAGAS assignments, and the operating environment of the 
audited entity. 

3.48 Improving their own competencies and meeting CPE requirements are 
primarily the responsibilities of individual auditors. The audit 
organization should have quality control procedures to help ensure that 
auditors meet the continuing education requirements, including 
documentation of the CPE completed. The Government Accountability 
Office (GAO) has developed guidance pertaining to CPE requirements to 
assist auditors and audit organizations in exercising professional 
judgment in complying with the CPE requirements.[Footnote 34] 

3.49 External specialists assisting in performing a GAGAS assignment 
should be qualified and maintain professional competence in their areas 
of specialization but are not required to meet the GAGAS CPE 
requirements described. However, auditors who use the work of external 
specialists should assess the professional qualifications of such 
specialists and document their findings and conclusions. Internal 
specialists who are part of the audit organization and perform as a 
member of the audit team should comply with GAGAS, including the CPE 
requirements. 

Quality Control and Assurance: 

3.50 Each audit organization performing audits or attestation 
engagements in accordance with GAGAS must: 

a. establish a system of quality control that is designed to provide 
the audit organization with reasonable assurance that the organization 
and its personnel comply with professional standards and applicable 
legal and regulatory requirements, and: 

b. have an external peer review at least once every 3 years.[Footnote 
35] 

System of Quality Control: 

3.51 An audit organization's system of quality control encompasses the 
audit organization's leadership, emphasis on performing high quality 
work, and the organization's policies and procedures designed to 
provide reasonable assurance of complying with professional standards 
and applicable legal and regulatory requirements.[Footnote 36] The 
nature, extent, and formality of an audit organization's quality 
control system will vary based on the audit organization's 
circumstances, such as the audit organization's size, number of offices 
and geographic dispersion, the knowledge and experience of its 
personnel, the nature and complexity of its audit work, and cost- 
benefit considerations. 

3.52 Each audit organization must document its quality control policies 
and procedures and communicate those policies and procedures to its 
personnel. The audit organization should document compliance with its 
quality control policies and procedures and maintain such documentation 
for a period of time sufficient to enable those performing monitoring 
procedures and peer reviews to evaluate the extent of the audit 
organization's compliance with its quality control policies and 
procedures. The form and content of such documentation are a matter of 
professional judgment and will vary based on the audit organization's 
circumstances. 

3.53 An audit organization should include policies and procedures in 
its system of quality control that collectively address: 

a. Leadership responsibilities for quality within the audit 
organization: Policies and procedures that designate responsibility for 
quality of audits and attestation engagements performed under GAGAS and 
communication of policies and procedures relating to quality. Such 
policies and communications encourage a culture that recognizes that 
quality is essential in performing GAGAS audits. 

b. Independence, legal, and ethical requirements: Policies and 
procedures designed to provide reasonable assurance that the audit 
organization and its personnel maintain independence, and comply with 
applicable legal and ethical requirements.[Footnote 37] 

c. Initiation,[Footnote 38] acceptance, and continuance of audit and 
attestation engagements: Policies and procedures for the initiation, 
acceptance, and continuance of audit and attestation engagements, 
designed to provide reasonable assurance that the audit organization 
will undertake audit engagements only if it can comply with 
professional standards and ethical principles and is acting within the 
legal mandate or authority of the audit organization. 

d. Human resources: Policies and procedures designed to provide the 
audit organization with reasonable assurance that it has personnel with 
the capabilities and competence to perform its audits in accordance 
with professional standards and legal and regulatory 
requirements.[Footnote 39] 

e. Audit and attestation engagement performance, documentation, and 
reporting: Policies and procedures designed to provide the audit 
organization with reasonable assurance that audits and attestation 
engagements are performed and reports are issued in accordance with 
professional standards and legal and regulatory requirements. (For 
financial audits, chapters 1 through 5 apply; for attestation 
engagements, chapters 1 through 3 and 6 apply; for performance audits, 
chapters 1 through 3 and 7 and 8 apply.) 

f. Monitoring of quality: An ongoing, periodic assessment of work 
completed on audits and attestation engagements designed to provide 
management of the audit organization with reasonable assurance that the 
policies and procedures related to the system of quality control are 
suitably designed and operating effectively in practice. The purpose of 
monitoring compliance with quality control policies and procedures is 
to provide an evaluation of (1) adherence to professional standards and 
legal and regulatory requirements, (2) whether the quality control 
system has been appropriately designed, and (3) whether quality control 
policies and procedures are operating effectively and complied with in 
practice. Monitoring procedures will vary based on the audit 
organization's facts and circumstances. The audit organization should 
perform monitoring procedures that enable it to assess compliance with 
applicable professional standards and quality control policies and 
procedures for GAGAS audits. Individuals performing monitoring should 
collectively have sufficient expertise and authority for this role. 

3.54 The audit organization should analyze and summarize the results of 
its monitoring procedures at least annually, with identification of any 
systemic issues needing improvement, along with recommendations for 
corrective action. (Under GAGAS, reviews of the work and the report 
that are performed as part of supervision are not monitoring controls 
when used alone. However, these types of pre-issuance reviews may be 
used as a part of this analysis and summary.) 

External Peer Review: 

3.55 Audit organizations performing audits and attestation engagements 
in accordance with GAGAS must have an external peer review performed by 
reviewers independent of the audit organization being reviewed at least 
once every 3 years.[Footnote 40] 

3.56 The audit organization should obtain an external peer review 
sufficient in scope to provide a reasonable basis for determining 
whether, for the period under review,[Footnote 41] the reviewed audit 
organization's system of quality control was suitably designed and 
whether the audit organization is complying with its quality control 
system in order to provide the audit organization with reasonable 
assurance of conforming with applicable professional standards. 

3.57 The peer review team should include the following elements in the 
scope of the peer review: 

a. review of the audit organization's quality control policies and 
procedures; 

b. consideration of the adequacy and results of the audit 
organization's internal monitoring procedures; 

c. review of selected audit and attestation engagement reports and 
related documentation; 

d. review of other documents necessary for assessing compliance with 
standards, for example, independence documentation, CPE records, and 
relevant human resource management files; and: 

e. interviews with a selection of the reviewed audit organization's 
professional staff at various levels to assess their understanding of 
and compliance with relevant quality control policies and procedures. 

3.58 The peer review team should perform a risk assessment to help 
determine the number and types of engagements to select. Based on the 
risk assessment, the team should use one or a combination of the 
following approaches to selecting individual audits and attestation 
engagements for review: (1) select GAGAS audits and attestation 
engagements that provide a reasonable cross-section of the GAGAS 
assignments performed by the reviewed audit organization or (2) select 
audits and attestation engagements that provide a reasonable cross- 
section from all types of work subject to the reviewed audit 
organization's quality control system, including one or more 
assignments performed in accordance with GAGAS.[Footnote 42] 

3.59 The peer review team should prepare one or more written reports 
communicating the results of the peer review, including the following: 

a. description of the scope of the peer review, including any 
limitations; 

b. an opinion on whether the system of quality control of the reviewed 
audit organization's audit and/or attestation engagement practices was 
adequately designed and complied with during the period reviewed to 
provide the audit organization with reasonable assurance of conforming 
with applicable professional standards; 

c. specification of the professional standards to which the reviewed 
audit organization is being held; 

d. for modified or adverse opinions,[Footnote 43] a description of 
reasons for the modification or adverse opinion, along with a detailed 
description of the findings and recommendations, in the peer review 
report, to enable the reviewed audit organization to take appropriate 
actions; and: 

e. reference to a separate letter of comments, if such a letter is 
issued. 

3.60 The peer review team should meet the following criteria: 

a. The review team collectively has current knowledge of GAGAS and 
government auditing. 

b. The organization conducting the peer review and individual review 
team members are independent (as defined in GAGAS) of the audit 
organization being reviewed, its staff, and the audits and attestation 
engagements selected for the peer review. 

c. The review team collectively has sufficient knowledge of how to 
perform a peer review. Such knowledge may be obtained from on-the-job 
training, training courses, or a combination of both. Having personnel 
on the peer review team with prior experience on a peer review or 
internal inspection team is desirable. 

3.61 An external audit organization[Footnote 44] should make its most 
recent peer review report[Footnote 45] publicly available; for example, 
by posting the peer review report on an external Web site or to a 
publicly available file designed for public transparency of peer review 
results. If neither of these options is available to the audit 
organization, then it should use the same transparency mechanism it 
uses to make other information public, and also provide the peer review 
report to others upon request. Internal audit organizations that report 
internally to management should provide a copy of the external peer 
review report to those charged with governance. Government audit 
organizations should also communicate the overall results and the 
availability of their external peer review reports to appropriate 
oversight bodies. 

3.62 Information in external peer review reports and letters of comment 
may be relevant to decisions on procuring audit or attestation 
engagements. Therefore, audit organizations seeking to enter into a 
contract to perform an audit or attestation engagement in accordance 
with GAGAS should provide the following to the party contracting for 
such services: 

a. the audit organization's most recent peer review report and any 
letter of comment, and: 

b. any subsequent peer review reports and letters of comment received 
during the period of the contract. 

3.63 Auditors who are using another audit organization's work should 
request a copy of the audit organization's latest peer review report 
and any letter of comment, and the audit organization should provide 
these documents when requested. (See paragraphs 3.05 and 7.41 through 
7.43 for further requirements and guidance on using the work of 
others.) 

[End of section] 

Chapter 4 Field Work Standards for Financial Audits: 

Introduction: 

4.01 This chapter establishes field work standards and provides 
guidance for financial audits conducted in accordance with generally 
accepted government auditing standards (GAGAS). This chapter identifies 
the American Institute of Certified Public Accountants (AICPA) field 
work standards and prescribes additional standards for financial audits 
performed in accordance with GAGAS. 

a. For financial audits, GAGAS incorporate the AICPA field work and 
reporting standards and the related statements on auditing standards 
(SAS) unless specifically excluded or modified by GAGAS.[Footnote 46] 

b. Under AICPA standards and GAGAS, auditors must plan and perform the 
audit to obtain sufficient appropriate audit evidence so that audit 
risk will be limited to a low level that is, in their professional 
judgment, appropriate for expressing an opinion on the financial 
statements. The high, but not absolute, level of assurance that is 
intended to be obtained by auditors is expressed in the auditor's 
report as obtaining reasonable assurance about whether the financial 
statements are free of material misstatement (whether caused by error 
or fraud). Absolute assurance is not attainable because of the nature 
of audit evidence and the characteristics of fraud. Therefore, an audit 
conducted in accordance with generally accepted auditing standards may 
not detect a material misstatement. 

4.02 For financial audits performed in accordance with GAGAS, chapters 
1 through 5 apply. 

AICPA Field Work Standards: 

4.03 The three AICPA generally accepted standards of field work are as 
follows:[Footnote 47] 

a. The auditor must adequately plan the work and must properly 
supervise any assistants. 

b. The auditor must obtain a sufficient understanding of the entity and 
its environment, including its internal control, to assess the risk of 
material misstatement of the financial statements whether due to error 
or fraud, and to design the nature, timing, and extent of further audit 
procedures. 

c. The auditor must obtain sufficient appropriate audit evidence by 
performing audit procedures to afford a reasonable basis for an opinion 
regarding the financial statements under audit. 

Additional Government Auditing Standards: 

4.04 GAGAS establish field work standards for financial audits in 
addition to the requirements contained in the AICPA standards. Auditors 
should comply with these additional standards when citing GAGAS in 
their audit reports. The additional government auditing standards 
relate to: 

a. auditor communication during planning (see paragraphs 4.05 through 
4.08); 

b. previous audits and attestation engagements (see paragraph 4.09); 

c. detecting material misstatements resulting from violations of 
provisions of contracts or grant agreements, or from abuse (see 
paragraphs 4.10 through 4.13); 

d. developing elements of a finding (see paragraphs 4.14 through 4.18); 
and: 

e. audit documentation (see paragraphs 4.19 through 4.24). 

Auditor Communication During Planning: 

4.05 Under AICPA standards and GAGAS, auditors should communicate with 
the audited entity their understanding of the services to be performed 
for each engagement and document that understanding through a written 
communication.[Footnote 48] GAGAS broaden the parties included in the 
communication and the items for the auditors to communicate. 

4.06 Under GAGAS, when planning the audit, auditors should communicate 
certain information in writing to management of the audited entity, 
those charged with governance,[Footnote 49] and to the individuals 
contracting for or requesting the audit. When auditors perform the 
audit pursuant to a law or regulation or they conduct the work for the 
legislative committee that has oversight of the audited entity, 
auditors should communicate with the legislative committee. In those 
situations where there is not a single individual or group that both 
oversees the strategic direction of the entity and the fulfillment of 
its accountability obligations or in other situations where the 
identity of those charged with governance is not clearly evident, 
auditors should document the process followed and conclusions reached 
for identifying the appropriate individuals to receive the required 
auditor communications. Auditors should communicate the following 
additional information under GAGAS: 

a. The nature of planned work and level of assurance to be provided 
related to internal control over financial reporting and compliance 
with laws, regulations, and provisions of contracts or grant 
agreements. 

b. Any potential restriction on the auditors' reports, in order to 
reduce the risk that the needs or expectations of the parties involved 
may be misinterpreted. 

4.07 Under AICPA standards and GAGAS, tests of internal control over 
financial reporting and compliance with laws, regulations, and 
provisions of contracts or grant agreements in a financial statement 
audit contribute to the evidence supporting the auditors' opinion on 
the financial statements or other conclusions regarding financial data. 
However, such tests generally are not sufficient in scope to provide an 
opinion on the effectiveness of internal control over financial 
reporting or compliance with laws, regulations, and provisions of 
contracts or grant agreements. To meet the needs of certain audit 
report users, laws and regulations sometimes prescribe supplemental 
testing and reporting on internal control over financial reporting and 
compliance with laws, regulations, and provisions of contracts and 
grant agreements.[Footnote 50] 

4.08 If an audit is terminated before it is completed and an audit 
report is not issued, auditors should document the results of the work 
to the date of termination and why the audit was terminated. 
Determining whether and how to communicate the reason for terminating 
the audit to those charged with governance, appropriate officials of 
the audited entity, the entity contracting for or requesting the audit, 
and other appropriate officials will depend on the facts and 
circumstances and, therefore, is a matter of professional judgment. 

Previous Audits and Attestation Engagements: 

4.09 Auditors should evaluate whether the audited entity has taken 
appropriate corrective action to address findings and recommendations 
from previous engagements that could have a material effect on the 
financial statements. When planning the audit, auditors should ask 
management of the audited entity to identify previous audits, 
attestation engagements, and other studies that directly relate to the 
objectives of the audit, including whether related recommendations have 
been implemented. Auditors should use this information in assessing 
risk and determining the nature, timing, and extent of current audit 
work, including determining the extent to which testing the 
implementation of the corrective actions is applicable to the current 
audit objectives. 

Detecting Material Misstatements Resulting from Violations of 
Provisions of Contracts or Grant Agreements or from Abuse: 

4.10 Auditors should design the audit to provide reasonable assurance 
of detecting misstatements that result from violations of provisions of 
contracts or grant agreements and could have a direct and material 
effect on the determination of financial statement amounts or other 
financial data significant to the audit objectives. 

4.11 If specific information comes to the auditors' attention that 
provides evidence concerning the existence of possible violations of 
provisions of contracts or grant agreements that could have a material 
indirect effect on the financial statements, the auditors should apply 
audit procedures specifically directed to ascertaining whether such 
violations have occurred. When the auditors conclude that a violation 
of provisions of contracts or grant agreements has or is likely to have 
occurred, they should determine the effect on the financial statements 
as well as the implications for other aspects of the audit. 

4.12 Abuse involves behavior that is deficient or improper when 
compared with behavior that a prudent person would consider reasonable 
and necessary business practice given the facts and circumstances. 
Abuse also includes misuse of authority or position for personal 
financial interests or those of an immediate or close family member or 
business associate. Abuse does not necessarily involve fraud, violation 
of laws, regulations, or provisions of a contract or grant agreement. 

4.13 If during the course of the audit, auditors become aware of abuse 
that could be quantitatively or qualitatively material to the financial 
statements, auditors should apply audit procedures specifically 
directed to ascertain the potential effect on the financial statements 
or other financial data significant to the audit objectives. After 
performing additional work, auditors may discover that the abuse 
represents potential fraud or illegal acts. Because the determination 
of abuse is subjective, auditors are not required to provide reasonable 
assurance of detecting abuse. 

Developing Elements of a Finding: 

4.14 Audit findings may involve deficiencies in internal control, 
fraud, illegal acts, violations of provisions of contracts or grant 
agreements, and abuse. The elements needed for a finding depend 
entirely on the objectives of the audit. Thus, a finding or set of 
findings is complete to the extent that the audit objectives are 
satisfied. When auditors identify deficiencies, auditors should plan 
and perform procedures to develop the elements of the findings that are 
relevant and necessary to achieve the audit objectives. The elements of 
an audit finding are discussed in paragraphs 4.15 through 4.18. 

4.15 Criteria: The laws, regulations, contracts, grant agreements, 
standards, measures, expected performance, defined business practices, 
and benchmarks against which performance is compared or evaluated. 
Criteria identify the required or desired state or expectation with 
respect to the program or operation. Criteria provide a context for 
evaluating evidence and understanding the findings. 

4.16 Condition: Condition is a situation that exists. The condition is 
determined and documented during the audit. 

4.17 Cause: The cause identifies the reason or explanation for the 
condition or the factor or factors responsible for the difference 
between the situation that exists (condition) and the required or 
desired state (criteria), which may also serve as a basis for 
recommendations for corrective actions. Common factors include poorly 
designed policies, procedures, or criteria; inconsistent, incomplete, 
or incorrect implementation; or factors beyond the control of program 
management. Auditors may assess whether the evidence provides a 
reasonable and convincing argument for why the stated cause is the key 
factor or factors contributing to the difference. 

4.18 Effect or potential effect: The effect is a clear, logical link to 
establish the impact or potential impact of the difference between the 
situation that exists (condition) and the required or desired state 
(criteria). The effect or potential effect identifies the outcomes or 
consequences of the condition. When the audit objectives include 
identifying the actual or potential consequences of a condition that 
varies (either positively or negatively) from the criteria identified 
in the audit, "effect" is a measure of those consequences. Effect or 
potential effect may be used to demonstrate the need for corrective 
action in response to identified problems or relevant risks. 

Audit Documentation: 

4.19 Under AICPA standards and GAGAS, auditors must prepare audit 
documentation in connection with each audit in sufficient detail to 
provide a clear understanding of the work performed (including the 
nature, timing, extent, and results of audit procedures performed), the 
audit evidence obtained and its source, and the conclusions 
reached.[Footnote 51] Under AICPA standards and GAGAS, auditors should 
prepare audit documentation that enables an experienced 
auditor,[Footnote 52] having no previous connection to the audit, to 
understand: 

a. the nature, timing, and extent of auditing procedures performed to 
comply with GAGAS and other applicable standards and requirements; 

b. the results of the audit procedures performed and the audit evidence 
obtained; 

c. the conclusions reached on significant matters; and: 

d. that the accounting records agree or reconcile with the audited 
financial statements or other audited information. 

4.20 Under GAGAS, auditors also should document, before the audit 
report is issued, evidence of supervisory review of the work performed 
that supports findings, conclusions, and recommendations contained in 
the audit report. 

4.21 When auditors do not comply with applicable GAGAS requirements due 
to law, regulation, scope limitations, restrictions on access to 
records, or other issues impacting the audit, the auditors should 
document the departure from the GAGAS requirements and the impact on 
the audit and on the auditors' conclusions. This applies to departures 
from both mandatory requirements and presumptively mandatory 
requirements where alternative procedures performed in the 
circumstances were not sufficient to achieve the objectives of the 
standard. (See paragraphs 1.12 and 1.13.) 

4.22 Audit organizations should establish policies and procedures for 
the safe custody and retention of audit documentation for a time 
sufficient to satisfy legal, regulatory, and administrative 
requirements for record retention. Whether audit documentation is in 
paper, electronic, or other media, the integrity, accessibility, and 
retrievability of the underlying information could be compromised if 
the documentation is altered, added to, or deleted without the 
auditors' knowledge, or if the documentation is lost or damaged. For 
audit documentation that is retained electronically, the audit 
organization should establish information systems controls concerning 
accessing and updating the audit documentation. 

4.23 Underlying GAGAS audits is the premise that audit organizations in 
federal, state, and local governments and public accounting firms 
engaged to perform a financial audit in accordance with GAGAS cooperate 
in auditing programs of common interest so that auditors may use 
others' work and avoid duplication of efforts. Subject to applicable 
laws and regulations, auditors should make appropriate individuals, as 
well as audit documentation, available upon request and in a timely 
manner to other auditors or reviewers to satisfy these objectives. The 
use of auditors' work by other auditors may be facilitated by 
contractual arrangements for GAGAS audits that provide for full and 
timely access to appropriate individuals, as well as audit 
documentation. 

4.24 Audit organizations should develop policies to deal with requests 
by outside parties to obtain access to audit documentation, especially 
when an outside party attempts to obtain information indirectly through 
the auditor rather than directly from the audited entity. In developing 
such policies, audit organizations should determine what laws and 
regulations apply, if any. 

Additional Considerations for GAGAS Financial Audits: 

4.25 Due to the audit objectives and public accountability of GAGAS 
audits, there may be additional considerations for financial audits 
completed in accordance with GAGAS. These considerations relate to: 

a. materiality in GAGAS financial audits (see paragraph 4.26); 

b. consideration of fraud and illegal acts (see paragraphs 4.27 and 
4.28); and: 

c. ongoing investigations or legal proceedings (see paragraph 4.29). 

Materiality in GAGAS Financial Audits: 

4.26 Under both AICPA standards and GAGAS, the auditors' responsibility 
is to plan and perform the audit to obtain reasonable assurance that 
material misstatements, whether caused by errors or fraud, are 
detected.[Footnote 53] The concept of materiality recognizes that some 
matters, either individually or in the aggregate, are important for 
fair presentation of financial statements in conformity with generally 
accepted accounting principles, while other matters are not important. 
In performing the audit, matters that, either individually or in the 
aggregate, could be material to the financial statements are a primary 
consideration.[Footnote 54] Additional considerations may apply to 
GAGAS financial audits of government entities or entities that receive 
government awards. For example, in audits performed in accordance with 
GAGAS, auditors may find it appropriate to use lower materiality levels 
as compared with the materiality levels used in non-GAGAS audits 
because of the public accountability of government entities and 
entities receiving government funding, various legal and regulatory 
requirements, and the visibility and sensitivity of government 
programs.[Footnote 55] 

Consideration of Fraud and Illegal Acts: 

4.27 Under both the AICPA standards[Footnote 56] and GAGAS, auditors 
should plan and perform the audit to obtain reasonable assurance about 
whether the financial statements are free of material misstatement, 
whether caused by error or fraud.[Footnote 57] Recognizing the 
possibility that a material misstatement due to fraud could be present 
is important for achieving this objective. However, absolute assurance 
is not attainable and thus even a properly planned and performed audit 
may not detect a material misstatement resulting from fraud. 

4.28 Under both the AICPA standards[Footnote 58] and GAGAS, auditors 
should design the audit to provide reasonable assurance of detecting 
material misstatements resulting from illegal acts that could have a 
direct and material effect on the financial statements.[Footnote 59] If 
specific information comes to the auditors' attention that provides 
evidence concerning the existence of possible illegal acts[Footnote 60] 
that could have a material indirect effect on the financial statements, 
the auditors should apply audit procedures specifically directed to 
ascertaining whether an illegal act has occurred. When an illegal act 
has or is likely to have occurred, auditors should determine the effect 
on the financial statements as well as the implications for other 
aspects of the audit. 

Ongoing Investigations or Legal Proceedings: 

4.29 Avoiding interference with investigations or legal proceedings is 
important in pursuing indications of fraud, illegal acts, violations of 
provisions of contracts or grant agreements, or abuse. Laws, 
regulations, or policies might require auditors to report indications 
of certain types of fraud, illegal acts, violations of provisions of 
contracts or grant agreements, or abuse to law enforcement or 
investigatory authorities before performing additional audit 
procedures. When investigations or legal proceedings are initiated or 
in process, auditors should evaluate the impact on the current audit. 
In some cases, it may be appropriate for the auditors to work with 
investigators and/or legal authorities, or withdraw from or defer 
further work on the audit engagement or a portion of the engagement to 
avoid interfering with an investigation. 

[End of section] 

Chapter 5 Reporting Standards for Financial Audits: 

Introduction: 

5.01 This chapter establishes reporting standards and provides guidance 
for financial audits conducted in accordance with generally accepted 
government auditing standards (GAGAS). For financial audits, GAGAS 
incorporate the American Institute of Certified Public Accountants 
(AICPA) field work and reporting standards and the related statements 
on auditing standards (SAS) unless specifically excluded or modified by 
GAGAS.[Footnote 61] This chapter identifies the AICPA reporting 
standards and prescribes additional standards for financial audits 
performed in accordance with GAGAS. 

5.02 For financial audits performed in accordance with GAGAS, chapters 
1 through 5 apply. 

AICPA Reporting Standards: 

5.03 The four AICPA generally accepted standards of reporting[Footnote 
62] are as follows: 

a. The auditor must state in the auditor's report whether the financial 
statements are presented in accordance with generally accepted 
accounting principles (GAAP). 

b. The auditor must identify in the auditor's report those 
circumstances in which such principles have not been consistently 
observed in the current period in relation to the preceding period. 

c. When the auditor determines that informative disclosures are not 
reasonably adequate, the auditor must so state in the auditor's report. 

d. The auditor must either express an opinion regarding the financial 
statements, taken as a whole, or state that an opinion cannot be 
expressed, in the auditor's report. When the auditor cannot express an 
overall opinion, the auditor should state the reasons therefor in the 
auditor's report. In all cases where an auditor's name is associated 
with financial statements, the auditor should clearly indicate the 
character of the auditor's work, if any, and the degree of 
responsibility the auditor is taking in the auditor's report. 

Additional Government Auditing Standards: 

5.04 GAGAS establish reporting standards for financial audits in 
addition to the standards contained in the AICPA standards. Auditors 
should comply with these additional standards when citing GAGAS in 
their audit reports. The additional government auditing standards 
relate to: 

a. reporting auditors' compliance with GAGAS (see paragraphs 5.05 and 
5.06); 

b. reporting on internal control and compliance with laws, regulations, 
and provisions of contracts or grant agreements (see paragraphs 5.07 
through 5.09); 

c. reporting deficiencies in internal control, fraud, illegal acts, 
violations of provisions of contracts or grant agreements, and abuse 
(see paragraphs 5.10 through 5.22); 

d. communicating significant matters in the auditors' report (see 
paragraphs 5.23 through 5.25); 

e. reporting on the restatement of previously-issued financial 
statements (see paragraphs 5.26 through 5.31); 

f. reporting views of responsible officials (see paragraphs 5.32 
through 5.38); 

g. reporting confidential or sensitive information (see paragraphs 5.39 
through 5.43); and: 

h. distributing reports (see paragraph 5.44). 

Reporting Auditors' Compliance with GAGAS: 

5.05 When auditors comply with all applicable GAGAS requirements, they 
should include a statement in the auditors' report that they performed 
the audit in accordance with GAGAS. (See paragraphs 1.12 and 1.13 for 
additional requirements on citing compliance with GAGAS.) 

5.06 An audited entity receiving a GAGAS audit report may also request 
auditors to issue a financial audit report for purposes other than 
complying with requirements for a GAGAS audit. For example, the audited 
entity may need audited financial statements to issue bonds or for 
other financing purposes. GAGAS do not prohibit auditors from issuing a 
separate report conforming only to AICPA or other standards. 

Reporting on Internal Control and Compliance with Laws, Regulations, 
and Provisions of Contracts or Grant Agreements: 

5.07 When providing an opinion or a disclaimer on financial statements, 
auditors must also report on internal control over financial reporting 
and on compliance with laws, regulations, and provisions of contracts 
or grant agreements. 

5.08 Auditors should include either in the same or in separate 
report(s) a description of the scope of the auditors' testing of 
internal control over financial reporting and compliance with laws, 
regulations, and provisions of contracts or grant agreements. If the 
auditors issue separate reports, they should include a reference to the 
separate reports in the report on financial statements. Auditors should 
state in the reports whether the tests they performed provided 
sufficient, appropriate evidence to support an opinion on the 
effectiveness of internal control over financial reporting and on 
compliance with laws, regulations, and provisions of contracts or grant 
agreements. The internal control reporting standard under GAGAS differs 
from the objective of an examination of internal control in accordance 
with the AICPA Statement on Standards for Attestation Engagements 
(SSAE), which is to express an opinion on the design or the design and 
operating effectiveness of an entity's internal control, as applicable. 
To form a basis for expressing such an opinion, the auditor must plan 
and perform the examination to obtain reasonable assurance about 
whether the entity maintained, in all material respects, effective 
internal control as of a point in time or for a specified period of 
time. 

5.09 When auditors report separately (including separate reports bound 
in the same document) on internal control over financial reporting and 
compliance with laws and regulations and provisions of contracts or 
grant agreements, they should state in the financial statement audit 
report that they are issuing those additional reports. They should 
include a reference to the separate reports[Footnote 63] and also state 
that the reports on internal control over financial reporting and 
compliance with laws and regulations and provisions of contracts or 
grant agreements are an integral part of a GAGAS audit and important 
for assessing the results of the audit. If auditors issued or intend to 
issue a management letter, they should refer to that management letter 
in the reports. 

Reporting Deficiencies in Internal Control, Fraud, Illegal Acts, 
Violations of Provisions of Contracts or Grant Agreements, and Abuse: 

5.10 For financial audits, including audits of financial statements in 
which auditors provide an opinion or disclaimer, auditors should 
report, as applicable to the objectives of the audit, and based upon 
the audit work performed, (1) significant deficiencies in internal 
control, identifying those considered to be material weaknesses; (2) 
all instances of fraud and illegal acts unless inconsequential; and (3) 
violations of provisions of contracts or grant agreements and abuse 
that could have a material effect on the financial statements.[Footnote 
64] 

Deficiencies in Internal Control: 

5.11 For all financial audits, auditors should report the following 
deficiencies in internal control: 

a. Significant deficiency: a deficiency in internal control, or 
combination of deficiencies, that adversely affects the entity's 
ability to initiate, authorize, record, process, or report financial 
data reliably in accordance with GAAP such that there is more than a 
remote[Footnote 65] likelihood that a misstatement of the entity's 
financial statements that is more than inconsequential[Footnote 66]will 
not be prevented or detected.[Footnote 67] 

b. Material weakness: a significant deficiency, or combination of 
significant deficiencies, that results in more than a remote likelihood 
that a material misstatement of the financial statements will not be 
prevented or detected. 

5.12 Assessing the significance of control deficiencies includes 
qualitative considerations such as public accountability of the audited 
entity, legal and regulatory requirements, the visibility and 
sensitivity of the entity or program, the needs of users and concerns 
of oversight officials, and current and emerging risks and 
uncertainties facing the government entity or entity that receives 
government funding. The significance of a deficiency in internal 
control also is influenced by: 

a. the likelihood that a deficiency, or combination of deficiencies, 
could fail to prevent or detect a material misstatement of an account 
balance or disclosure; and: 

b. the magnitude of the potential misstatement. 

5.13 Auditors should include all significant deficiencies in the 
auditors' report on internal control over financial reporting and 
indicate those that represent material weaknesses. If (1) a significant 
deficiency is remediated before the auditors' report is issued and (2) 
the auditors obtain sufficient, appropriate evidence supporting the 
remediation of the significant deficiency, then the auditors should 
report the significant deficiency and the fact that it was remediated 
before the auditors' report was issued. 

5.14 Determining whether and how to communicate to officials of the 
audited entity internal control deficiencies that have an 
inconsequential effect on the financial statements is a matter of 
professional judgment. Auditors should document such communications. 

Fraud, Illegal Acts, Violations of Provisions of Contracts or Grant 
Agreements, and Abuse: 

5.15 Under AICPA standards and GAGAS, auditors have responsibilities 
for detecting fraud and illegal acts that have a material effect on the 
financial statements and determining whether those charged with 
governance are adequately informed about fraud and illegal acts. GAGAS 
include additional reporting standards. When auditors conclude, based 
on sufficient, appropriate evidence, that any of the following either 
has occurred or is likely to have occurred, they should include in 
their audit report the relevant information about: 

a. fraud and illegal acts[Footnote 68] that have an effect on the 
financial statements that is more than inconsequential, 

b. violations of provisions of contracts or grant agreements that have 
a material effect on the determination of financial statement amounts 
or other financial data significant to the audit, and: 

c. abuse that is material, either quantitatively or qualitatively. (See 
paragraphs 4.12 and 4.13 for a discussion of abuse.) 

5.16 When auditors detect violations of provisions of contracts or 
grant agreements or abuse that have an effect on the financial 
statements that is less than material but more than inconsequential, 
they should communicate those findings in writing to officials of the 
audited entity. Determining whether and how to communicate to officials 
of the audited entity fraud, illegal acts, violations of provisions of 
contracts or grant agreements, or abuse that is inconsequential is a 
matter of professional judgment. Auditors should document such 
communications. 

5.17 When fraud, illegal acts, violations of provisions of contracts or 
grant agreements, or abuse either have occurred or are likely to have 
occurred, auditors may consult with authorities or legal counsel about 
whether publicly reporting such information would compromise 
investigative or legal proceedings. Auditors may limit their public 
reporting to matters that would not compromise those proceedings, and 
for example, report only on information that is already a part of the 
public record. 

Reporting Findings Directly to Parties Outside the Audited Entity: 

5.18 Auditors should report known or likely fraud, illegal acts, 
violations of provisions of contracts or grant agreements, or abuse 
directly to parties outside the audited entity in the following two 
circumstances.[Footnote 69] 

a. When entity management fails to satisfy legal or regulatory 
requirements to report such information to external parties specified 
in law or regulation, auditors should first communicate the failure to 
report such information to those charged with governance. If the 
audited entity still does not report this information to the specified 
external parties as soon as practicable after the auditors' 
communication with those charged with governance, then the auditors 
should report the information directly to the specified external 
parties. 

b. When entity management fails to take timely and appropriate steps to 
respond to known or likely fraud, illegal acts, violations of 
provisions of contracts or grant agreements, or abuse that (1) is 
likely to have a material effect on the financial statements and (2) 
involves funding received directly or indirectly from a government 
agency, auditors should first report management's failure to take