Elaine M. Frenette, CPPM, CF NES 2011 Las Vegas, NV

1. The Yellow Book Reader’s Digest Version Elaine M. Frenette, CPPM, CF NES 2011 Las Vegas, NV

2. Objective Provide a brief ‘snapshot’ of the Government Auditing Standards (Yellow Book) for Performance Audits (not meant to be ‘end-all’ and ‘be-all’ – you MUST read and assimilate GAGAS)

3. Objective Take a slightly smaller bite of the elephant rather than trying to swallow the elephant whole!

4. Generally Accepted Government Auditing Standards (GAGAS) • Yellow Book - July 2007 Revision • 2010 Exposure Draft issued August 2010 • Invited comments through 22 November 2010 • Issued in Final Form – 2011 • Will supersede July 2007 revision • Effective date – established when issued

5. Major developments in the accountability & audit profession • Emphasize specific considerations applicable to government environment http://www.gao.gov/govaud/ybk01.htm

6. Performance Audits • Chapters 1 – 2 – 3 • Chapters 7 and 8 Apply when performing performance audits in accordance with GAGAS

7. Performance Audits Chapter 1 Use and Application of GAGAS Chapter 2 Ethical Principles in Government Auditing Chapter 3 General Standards

8. Chapter 1Use and Application of GAGAS • “Provide a framework for performing high-quality audit work with • Competence • Integrity • Objectivity • Independence” • Standards help accomplish this • If properly applied

9. Vocabulary Auditor “Individuals performing work under GAGAS…and, therefore, individuals who may have the titles auditor, analyst, evaluator, inspector, or other similar titles” GAO-07-731G, p. 6

10. Vocabulary Audit Organization “Government audit organizations as well as public accounting firms that perform audits using GAGAS” GAO-07-731G, p.6

11. Use and Application • GAGAS (Yellow Book) • Provide guidance & requirements in performing audits in an ethical manner • Assist in “objectively acquiring and evaluating sufficient, appropriate evidence and reporting the results.” GAO-07-731G, p.6

12. Professional Requirements Professional requirements identified through use of language – Two Categories • Describe degree of responsibility imposed on auditors & organizations • Unconditional Requirements • Presumptively Mandatory Requirements

13. Unconditional • Dictionary.com: • Not limited by conditions; absolute; complete • GAGAS will use terms • MUST or IS Required • IF audit based on GAGAS – REQUIRED to comply with unconditional requirement where it applies

14. Presumptively Mandatory • Presumptive • Synonyms: • Prospective • Likely • Circumstantial • GAGAS terminology • “should” instead of ‘must’ or ‘is required’

15. Presumptively Mandatory • Auditors “required to comply” BUT “rare circumstances whereby an auditor may forego that particular requirement provided they document their justification for the departure and how the alternative procedures performed in the circumstances were sufficient to achieve the objectives of the presumptively mandatory requirement.” GAO-07-731G, p. 8

16. Explanatory Material • Language is considered • ‘guidance’ • Further explanation of professional requirements • Government expects ‘professional judgment’ to be used

17. Explanatory Material • GAGAS terminology • May • Might • Could

18. Explanatory Material • Provides information in exercising professional judgment • Does NOT mandate auditor to perform suggested procedures or actions

19. Compliance Statements • If required or choose to use GAGAS • Must comply with the standards • Make reference in final report • Two types of Statements • Unmodified • Modified

20. Unmodified Statement • Unmodified • Followed ALL requirements in GAGAS • Both unconditional & presumptively mandatory OR • Justified any ‘departure’ from presumptively mandatory requirements • Documenting HOW objective of requirement was still achieved

21. Modified Statement • When is MODIFIED statement used? • Depends on significance of departure from requirement • Scope of audit • Access unavailable to certain records/individuals (Special Programs) • Document reason for not performing audit in accordance with GAGAS

22. Modified Statement • Assess significance of the noncompliance to audit objective • DOCUMENT assessment (reasons for not following requirement) • Determine type of GAGAS compliance statement

23. Other Professional Standards • Authoritatively approved • International Standards for the Professional Practice of Internal Auditing, The Institute of Internal Auditors, Inc. (www.theiia.org) • Guiding Principles for Evaluators, American Evaluation Association (www.eval.org)

24. Other Professional Standards • GAGAS should be used if conflict between the two

25. Objectives • ALL audits begin with objectives • Looking for an opinion Clear and specific Or Multiple or overlapping objectives

26. Objectives • “What is the ultimate outcome of this exercise?” • “What are you trying to accomplish with this audit?” • “Auditing an organization’s performance, compliance with regulations, etc.?”

27. Performance Audits • “Engagements that provide assurance or conclusions based on an evaluation of sufficient, appropriate evidence against stated criteria, such as specific requirements, measures, or defined business practices.” GAO-07-731G Government Auditing Standards, p. 17

28. Performance Audits • Reasonably assured • appropriate type & amount of information was obtained to support final audit report • Sufficiency & appropriateness • depends on audit objectives & conclusions

29. Performance Audits • “Dynamic Process” • Objective & procedure continually reviewed • To assure ‘sufficient, appropriate evidence against the stated criteria’

30. Performance Audits • Goals & Objectives (audits/self assessments) • Examples: (not limited to these) • Determine organization • Is in compliance with legislative, regulatory or organizational goals & objectives • Is in compliance with sound procurement practices • Has performance measures that are reliable, valid, relevant and effective in relation to their contractual obligations

31. Chapter 2Ethical Principles • Provides fundamental principles • Public Interest • acceptance of responsibility to serve the public interest • Integrity • fact-based, nonpartisan, honest • Objectivity • Maintain attitude of impartiality

32. Ethical Principles • Proper use of government info, resources, position • Proper handling of sensitive/classified information or resources • Exercising discretion • not using position for personal gain • Professional behavior • Compliance with laws & regulations

33. Chapter 3General Standards • Independence • Free from personal, external, organizational impairments to independence – must remain impartial • Avoid appearance of partiality • Professional Judgment • Professional skepticism (management is neither dishonest nor of unquestioned honesty) • Questioning mind • Critical assessment of evidence

34. General Standards “Believing that management is honest is not a reason to accept less than sufficient, appropriate evidence.” GAO-07-731G Government Auditing Standards, p. 49

35. General Standards • Technical Knowledge/Competence • Blending of education and experience • Commitment to continued learning and development

36. General Standards • Continuing Professional Education (CPE) • 24 hours of CPE every 2 years (directly relating to government auditing, government environment, or specific/unique environment of entity being audited) • 56 additional • TOTAL = 80 GAO-07-731G Government Auditing Standards pp. 53-54

37. General Standards • Audit organization • MUST establish system of Quality Control • To provide assurance personnel comply with professional standards & legal/regulatory requirements and • External Peer Review • At least once every 3 years (example: DCMA MICR)

38. Chapter 7Field Work Standards for Performance Audits • Planning • Supervising staff • Obtaining sufficient, appropriate evidence • Preparing audit documentation

39. Field Work Standards Form framework for applying standards • Reasonable Assurance • Significance • Audit Risk

40. Reasonable Assurance • Evidence is sufficient and appropriate to support findings and conclusions • Sufficiency/appropriateness will vary • Audit objectives • Findings • Conclusions

41. Significance “Relative importance of a matter within the context in which it is being considered, including quantitative and qualitative factors.” GAO-07-731G Government Auditing Standards p.123

42. Significance • Significance • Impact of the matter to the overall program • Relevance of the matter Professional Judgment

43. Audit Risk • Possibility auditor’s findings, conclusions, recommendations, assurance may be • Improper or incomplete • WHY? • Evidence NOT sufficient/appropriate • Inadequate audit process • Intentional omissions/misleading info due to misrepresentation/fraud

44. Audit Risk • Qualitative & Quantitative considerations – impact risk • Time frames • Complexity • Size of program ($) • Adequacy of audited system/processes to detect inconsistencies, significant errors • Auditor’s access to records

45. Audit Risk • Auditor will not detect • Significant errors • Inconsistencies • Reduce Risk • Increase scope of work • add experts • Change methodology – obtain additional evidence

46. Must adequately plan and document the planning Reduces audit risk to provide reasonable assurance evidence is sufficient and appropriate to support findings and conclusions Planning

47. Define Objectives Questions about the organization/function, etc. that need to be answered Ex: How adequate is their acquisition system, maintenance or disposition program? Planning

48. Determine Scope (boundary) Subject matter to be assessed/reported on Ex: necessary documents/records, period of time, locations, etc. Methodology Specific steps used to gather information Includes nature and extent of procedures used Planning

49. Continuous Process SHOULD Assess Risk and significance HOW?? Planning

50. Understand the following: Nature of program being audited Internal Controls (management control) Information Systems Legal/regulatory requirements/contract provisions/grant agreements Results of previous audits Planning