Yellow Book Applicability

When is the Yellow Book applicable?

Yellow Book Applicability

Paragraph 1.04 of the Yellow Book (2011 Revision) states “The professional standards and guidance contained in this document, commonly referred to as generally accepted government auditing standards (GAGAS), provide a framework for conducting high quality audits with competence, integrity, objectivity, and independence.”

Paragraph 1.07 c. states “The term audit …refers to financial audits, attestation engagements, and performance audits conducted in accordance with GAGAS.” This definition does not include compilations or reviews under the Statements on Standards for Accounting and Review Services.

So the Yellow Book is applicable for audits, attestation engagements (including examinations, reviews and agreed upon procedures), and performance audits.

Usually, the trigger for whether a Yellow Book engagement will be performed is a grant agreement stipulation or a law (e.g., state law). Additionally, you must comply with the Yellow Book for all Single Audits.

Click here to see the full Yellow Book.

CPA Comfort Letters to Mortgage Companies

Issuing comfort letters may create unknown risks for CPAs

Have you ever had a bank or mortgage company ask you for a “comfort letter” to verify a client’s income?

Responding to such a request can create unknown risks for the CPA. (The AICPA provides guidance on this issue in TIS Section 9110, Special Reports .19 Lender Comfort Letters.)

CPA comfort letters to mortgage companies

Picture from

CPA Comfort Letters to Mortgage Companies

Today the LinkedIn AICPA group had this post from a CPA in Boston:

Yesterday I received a phone call from a mortgage company looking for a “CPA Letter”. When I asked,  “what is that?”, the person thought I was joking.

Maybe I was pretending since I have heard of comfort letter requests. Some of the content requested was how long has my client been “self-employed”. 

Is there a place where I can find what the AICPA says is proper to put on a comfort letter?

My response to the LinkedIn member follows.

George – I see this issue about once every two years.

The comfort letter at issue is usually associated with stated-income loans, which are mortgages that do not require borrowers to document their income. Such loans usually are sought by self-employed people.

Such a letter provides third-party verification of details in the loan application and could transfer some of the potential liability to the CPA in the event of default on the loan.

According to Auditing Standards Board Statement on Standards for Attestation Engagements No. 10, Attest Engagements, an attestation engagement is called for if the client wants a written report providing assurance about a specific subject. Of course, performing an attestation engagement is not prohibited in the case of a lender’s comfort letter request, but you (the CPA) must follow the procedures required in an attestation engagement.

The client will likely not want to incur the expense of a formal attestation engagement.

AT Section 9101, Attest Engagements: Attest Engagements Interpretations of Section 101, No. 2, Paragraph 25 states that practitioners should not provide any form of assurance that an entity is not insolvent or would not be rendered insolvent upon a proposed condition, or that an entity has the ability to pay debts as they mature.

As an alternative, you may want to offer to send a copy (with the client’s written authorization) of the client’s tax forms directly to the lender with a simple cover page stating, “Please find attached the tax forms I prepared for Client for the past three years.”

Shifting the Risk

George – The bottom line: the mortgage company is trying to find a way to document the loan cheaply. Such a letter can transfer risks from the mortgage company to you. It’s a bit of a jam for you because your client probably wants you to “simply write a short letter”; the client may not understand the risk it creates for you.

Another Option – AUP

You can perform an attest service (e.g. agreed upon procedures report), but it will take time and you will need to perform certain procedures and issue a report using standard agreed upon procedures language. This could take a few hours, but it will mitigate your risk.