The AICPA’s April 2016 Peer Review newsletter highlights the lack of audit documentation as a continuing problem in audits.
AU-C section 230, Audit Documentation requires the auditor, in documenting the nature, timing, and extent of audit procedures performed, to record:
- the identifying characteristics of the specific items or matters tested;
- who performed the audit work and the date such
work was completed; and
- who reviewed the audit work performed and the date and extent of such review.
What does this mean? Auditors can’t, for example, just say, “I randomly selected journal entries throughout the year. All entries were appropriately made.” Either the journal entries must be included in the audit file, or–at a minimum–the journal entry numbers must be noted. A person who has never seen the file must be able to reperform the test; without the journal entry numbers, the reperformance can’t be done.
Why would the Auditing Standards Board require “identifying characteristics”? To put it bluntly: Because some auditors will say they tested journal entries when they did not. The “identifying characteristics” requirement creates accountability for the auditor.
Don’t get me wrong. Memorandums have their place, but specificity is necessary. Too often we auditors make wondering generalities rather than statements of substance. Once we detail the specific work performed, then it is appropriate to make more general statements such as “It appears the accounts payable controls are working appropriately.” But without the detailed documentation, the general statement is just filler.
The April 2016 AICPA Peer Review newsletter says:
AU-C section 230, Audit Documentation, notes that audit documentation can include audit plans and checklists. It further states that the existence of an adequately documented audit plan demonstrates that the auditor has planned the audit. However, the audit plan supports the fact that the audit was planned, not that specific procedures were performed.
Checklists can be used to facilitate audit procedures, but, using them correctly requires that they be appropriately tailored for the specific audit. Checking off a step in an audit program or a checklist will not provide sufficient documentation about the nature, timing, and extent of audit procedures performed or the identifying characteristics of the specific items or matters tested.
Here are examples of identifying characteristics. (These are just examples; documentation will vary based upon what the auditor is attempting to do.)
- In fraud inquiries, the documentation of who you spoke with and when and the person’s position
- When examining purchase orders, documentation of:
- P.O. numbers
- P.O. dates
- For journal entry tests, documentation of:
- Journal entry numbers
- Date of the journal entries
- When sampling check disbursements, documentation of:
- The name of the report that the sample is coming from
- The starting and ending numbers of the population
- The interval being used (e.g., every 25th check)
- All check numbers examined
- What was examined (e.g., payee)
How to Improve
So how can we make sure our work papers possess proper identifying characteristics?
Review one or two audit files for appropriate documentation. Ask yourself, “Have I made any general statements without detailed support?” and “Am I over-relying on checklists without supporting documentation that proves the step has been performed?”
Here are some example work papers to review:
- Fraud inquiries (have we documented who we spoke with, their position, and when we talked?)
- Test of journal entries (have we identified the specific journal entries reviewed?)
- Search for unrecorded liabilities (have we documented thresholds and the period of time for which the search was performed?)
- Tests for compliance with grant requirements (have we identified the specific documents examined such as bids, invoice numbers, purchase orders, check numbers?)
- Plant, property and equipment (for additions vouched to invoices, have we documented the invoice number and date? Have we specified any threshold such as “all amounts greater than $25,000”?)
Signing Off on Work Papers
Another common work paper deficiency is a lack of sign-offs. Who prepared the work paper and when? Who reviewed the same? While not every work paper must be reviewed, all have a preparer—documentation doesn’t just magically appear! So, at a minimum, all work papers should have a preparer sign-off. Without sign-offs, we may not be able to determine who created the work paper.
Finally reviewers should sign off on each work paper reviewed. A single sign-off at the top of the file does not provide sufficient documentation of what was reviewed. Sign-offs are a means of documenting accountability. Some auditors omit sign-offs as a means of avoiding responsibility—not a good thing. With regard to a work paper, we should either own it or discard it.
Learn from the CPA Scribo newsletter!
Get my free weekly accounting and auditing digest with the latest content.