Government Auditing Standards

Government Auditing Standards

Table of Contents
Chapter1:Introduction
1
Purpose
1
Applicability 1
Accountability 2
BasicPremises 2
Auditors'Responsibilities
3
ProcurementofAuditServices 3
Chapter2:TypesofGovernmentAudits
5
Purpose
5
FinancialAudits
5
PerformanceAudits
6
OtherActivitiesofAnAuditOrganization
Chapter3:GeneralStandards
9
Purpose
9
Qualifications 9
ContinuingEducationRequirements
StaffQualifications
10
Independence 11
PersonalImpairments 11
ExternalImpairments 12
OrganizationalIndependence 13
InternalAuditors
13

ExternalAuditors

13

DueProfessionalCare 14
QualityControl
14
Chapter4:FieldWorkStandardsforFinancialAudits
17
Purpose
17
RelationtoAICPAStandards 17
Planning
18
AuditorCommunication
18
AuditFollowup
20
Fraud,IllegalActs,andOtherNoncompliance 20
Auditors'UnderstandingofPossibleFraudandofLawsandRegulations 21
DueCareConcerningPossibleFraudandIllegalActs 21
NoncomplianceOtherThanIllegalActs21
InternalControl
22
SafeguardingofAssets 24
ControlOverComplianceWithLawsandRegulations 25
WorkingPapers
26
FinancialRelatedAudits
26

Chapter5:ReportingStandardsforFinancialAudits
Purpose
28
RelationtoAICPAStandards 28

28

Government Auditing Standards

Table of Contents
ReportingCompliancewithGenerallyAcceptedGovernmentStandards 29
ReportingonCompliancewithLawsandRegulationsandonInternalControlOverFinancialReporting0
ScopeofComplianceandInternalControlWork
30
Fraud,IllegalActs,andOtherNoncompliance 30
DirectReportingofFraudandIllegalActs
31
DeficienciesinInternalControl 32
PrivilegedandConfidentialInformation33
ReportDistribution
33
FinancialRelatedAudits
34
Chapter6:FieldWorkStandardsforPerformanceAudits 36
Purpose
36
Planning
36
SignificanceandUserNeeds 37
UnderstandingtheProgram
37
Criteria
38
AuditFollowUp
39
ConsideringOthers'Work
39
StaffandOtherResources
40
WrittenAuditPlan
40
Supervision 41
CompliancewithLawsandRegulations 41
IllegalActsandOtherNoncompliance 41
Abuse 43
ObtainingInformationAboutLaws,Regulations,andOtherComplianceRequirements 43
LimitationsofAnAudit
43
ManagementControls 44
Evidence
45
AuditFindings 46
TestsofEvidence
46
WorkingPapers
48
Chapter7:ReportingStandardsforPerformanceAudits
Purpose
50
Form 50
Timeliness
50
ReportContents
51
Objectives,Scope,andMethodology 51
AuditResults 51
Recommendations
52
StatementonAuditingStandards
52
ComplianceWithLawsandRegulations
ManagementControls 54
ViewsofResponsibleOfficials 54

50

53

NoteworthyAccomplishments 55
IssuesNeedingFurtherStudy 55
PrivilegedandConfidentialInformation55

ii

Government Auditing Standards

Table of Contents
ReportPresentation
Complete
Accurate
Objective
Convincing

55
55
56
56
56
Concise

ReportDistribution

Clear 57
57

57

ii
i

Chapter 1: Introduction
Purpose
1.1Thisdocumentcontainsstandardsforauditsofgovernmentorganizations,programs,activities,and
functions,andofgovernmentassistancereceivedbycontractors,nonprofitorganizations,andother
nongovernmentorganizations.Thesestandards,oftenreferredtoasgenerallyacceptedgovernmentauditing
standards(GAGAS),aretobefollowedbyauditorsandauditorganizationswhenrequiredbylaw,
regulation,agreement,contract,orpolicy.Thestandardspertaintoauditors'professionalqualifications,the
qualityofauditeffort,andthecharacteristicsofprofessionalandmeaningfulauditreports.

Applicability
1.2FederallegislationrequiresthatthefederalinspectorsgeneralcomplywiththeComptrollerGeneral's
standardsforauditsoffederalorganizations,programs,activities,andfunctions.Thelegislationfurther
statesthattheinspectorsgeneralaretoensurethatnonfederalauditorscomplywiththesestandardswhen
theyauditfederalorganizations,programs,activities,andfunctions.

[NOTE1:TheInspectorGeneralActof1978,asamended,5U.S.C.App.(1982).]
1.3Otherfederalauditorsmustalsofollowthesestandards.TheOfficeofManagementandBudget(OMB)
2
includedthesestandardsinOMBCircularA73 asbasicauditcriteriaforfederalexecutivedepartments
andagencies.
[NOTE2:Section6,"AuditofFederalOperationsandPrograms"]
1.4TheChiefFinancialOfficersActof1990requiresthatthesestandardsbefollowedinauditsoffederal
departmentsandagencies.

[NOTE3:TheChiefFinancialOfficersActof1990(PublicLaw101576).]
1.5TheSingleAuditActof1984requiresthatthesestandardsbefollowedinauditsofstateandlocal
governmentswhichreceivefederalfinancialassistance.

[NOTE4:TheSingleAuditActof1984(31U.S.C.75017507)]
1.6Otherfederalpoliciesandregulations,suchasOMBCircularA133,requirethatthesestandardsbe
followedinauditsofinstitutionsofhighereducationandothernonprofitorganizationsthatreceivefederal
financialassistance.

[NOTE5:OMBCircularA133,"AuditsofInstitutionsofHigherEducationandOther
NonprofitInstitutions."]
1.7Auditorsconductingauditsunderagreementorcontractalsomayberequiredtocomplywiththese
standardsunderthetermsoftheagreementorcontract.

Government Auditing Standards

1.8 Thestandardsinthisdocumentaregenerallyrelevanttoandrecommendedforusebystateandlocal
governmentauditorsandpublicaccountantsinauditsofstateandlocalgovernmentorganizations,
programs,activities,andfunctions.Severalstateandlocalauditorganizations,aswellasseveralnations,
haveofficiallyadoptedthesestandards.

1.9 TheAmericanInstituteofCertifiedPublicAccountants(AICPA)hasissuedauditingandattestation
standardsthatapplyinfinancialaudits,asdiscussedinchapters4and5.TheInstituteofInternalAuditors
andtheAmericanEvaluationAssociation(formerlytheEvaluationResearchSociety)haveissuedrelated
6

standards.
[NOTE6:CodificationoftheStandardsfortheProfessionalPracticeofInternalAuditing,TheInstituteof
InternalAuditors,Inc.,copyright1993;andNewDirectionsforProgramEvaluation:Standardsfor
EvaluationPractice,no.15.SanFrancisco:JosseyBass,September1982.]

Accountability
1.10 Oursystemofmanagingpublicprogramstodayrestsonanelaboratestructureofrelationshipsamongall
levelsofgovernment.Officialsandemployeeswhomanagetheseprogramsneedtorenderanaccountoftheir
activitiestothepublic.Whilenotalwaysspecifiedbylaw,thisaccountabilityconceptisinherentinthe
governingprocessesofthisnation.

1.11 Theneedforaccountabilityhascausedademandformoreinformationaboutgovernmentprogramsand
services.Publicofficials,legislators,andcitizenswantandneedtoknowwhethergovernmentfundsare
handledproperlyandincompliancewithlawsandregulations.Theyalsowantandneedtoknowwhether
governmentorganizations,programs,andservicesareachievingtheirpurposesandwhetherthese
organizations,programs,andservicesareoperatingeconomicallyandefficiently.

1.12 Thisdocumentprovidesauditingstandardstohelpprovideaccountabilityandtoassistpublic
officialsandemployeesincarryingouttheirresponsibilities.Thesestandardsaremorethanthe
codificationofcurrentpractices.Theyincludeconceptsandauditareasthatarestillevolvingandarevital
totheaccountabilityobjectivessoughtinauditinggovernmentsandtheirprogramsandservices.

Basic Premises
1.13Thefollowingpremisesunderliethesestandardsandwereconsideredintheirdevelopment.

1. Theterm"audit"includesbothfinancialandperformanceaudits.
2. Publicofficialsandothersentrustedwithhandlingpublicresources(forexample,managersofa
notforprofitorganizationthatreceivesfederalassistance)areresponsibleforapplyingthoseresources
efficiently,economically,andeffectivelytoachievethepurposesforwhichtheresourceswerefurnished.
Thisresponsibilityappliestoallresources,whetherentrustedtopublicofficialsorothersbytheirown
constituenciesorbyotherlevelsofgovernment.
c.Publicofficialsandothersentrustedwithpublicresourcesareresponsibleforcomplyingwithapplicable
lawsandregulations.Thatresponsibilityencompassesidentifyingtherequirementswithwhichtheentityand
theofficialmustcomplyandimplementingsystemsdesignedtoachievethatcompliance.

Government Auditing Standards

4. Publicofficialsandothersentrustedwithpublicresourcesareresponsibleforestablishingandmaintaining
effectivecontrolstoensurethatappropriategoalsandobjectivesaremet;resourcesaresafeguarded;lawsand
regulationsarefollowed;andreliabledataareobtained,maintained,andfairlydisclosed.

5. Publicofficialsandothersentrustedwithpublicresourcesareaccountablebothtothepublicandto
otherlevelsandbranchesofgovernmentfortheresourcesprovidedtocarryoutgovernmentprogramsand
services.Consequently,theyshouldprovideappropriatereportstothosetowhomtheyareaccountable.

6.Auditofgovernmentreportingisanessentialelementofpubliccontrolandaccountability.Auditing
providescredibilitytotheinformationreportedbyorobtainedfrommanagementthroughobjectively
acquiringandevaluatingevidence.Theimportanceandcomprehensivenatureofauditingplaceaspecial
responsibilityonpublicofficialsorothersentrustedwithpublicresourceswhoauthorizeorarrangeauditsto
bedoneinaccordancewiththesestandards.Thisresponsibilityistoprovideauditcoveragethatisbroad
enoughtohelpfulfillthereasonableneedsofpotentialusersoftheauditreport.Auditorscanassistpublic
officialsandothersinunderstandingtheauditors'responsibilitiesunderGAGASandotherauditcoverage
requiredbylaworregulation.Thiscomprehensivenatureofauditingalsohighlightstheimportanceof
auditorsclearlyunderstandingtheauditobjectives,thescopeoftheworktobeconducted,andthereporting
requirements.

7. Financialauditingcontributestoprovidingaccountabilitysinceitprovidesindependentreportsonwhether
anentity'sfinancialinformationispresentedfairlyand/oronitsinternalcontrolsandcompliancewithlaws
andregulations.

8. Performanceauditingcontributestoprovidingaccountabilitybecauseitprovidesanindependent
assessmentoftheperformanceofagovernmentorganization,program,activity,orfunctioninorderto
provideinformationtoimprovepublicaccountabilityandfacilitatedecisionmakingbypartieswith
responsibilitytooverseeorinitiatecorrectiveaction.

9.

Torealizegovernmentalaccountability,thecitizens,theirelectedrepresentatives,andprogram
managersneedinformationtoassesstheintegrity,performance,andstewardshipofthegovernment's
activities.Thus,unlesslegalrestrictionsorethicalconsiderationspreventit,auditreportsshouldbeavailable
tothepublicandtootherlevelsofgovernmentthathavesuppliedresources.[NOTE7:TheSingleAuditAct
(31U.S.C.7502(f))requiresthatthereportonsingleauditsbemadeavailableforpublicinspection.]

Auditors' Responsibilities
1.14Thecomprehensivenatureofauditingdoneinaccordancewiththesestandardsplacesontheaudit
organizationtheresponsibilityforensuringthat(1)theauditisconductedbypersonnelwhocollectively
havethenecessaryskills,(2)independenceismaintained,(3)applicablestandardsarefollowedinplanning
andconductingauditsandreportingtheresults,(4)theorganizationhasanappropriateinternalquality
controlsysteminplace,and(5)theorganizationundergoesanexternalqualitycontrolreview.

Procurement of Audit Services

1.15Whilenotanauditstandard,itisimportantthatasoundprocurementpracticebefollowedwhen
contractingforauditservices.Soundcontractawardandapprovalprocedures,includingthemonitoringof
contractperformance,shouldbeinplace.Theobjectivesandscopeoftheauditshouldbemadeclear.In

Government Auditing Standards

additiontoprice,otherfactorstobeconsideredincludetheresponsivenessofthebiddertotherequest
forproposal;theexperienceofthebidder;availabilityofbidderstaffwithprofessionalqualificationsand
technicalabilities;andtheresultsofthebidders'externalqualitycontrolreviews.[NOTE8:SeeHowto
AvoidaSubstandardAudit:SuggestionsforProcuringanAudit,NationalIntergovernmentalAuditForum,
May1988.]

IfyouhavequestionsaboutGovernmentAuditing
Standards,sendemailto yellowbook@gao.gov.
Updated8/13/99

Chapter 2: Types of Government Audits

Purpose
2.1 Thischapterdescribesthetypesofauditsthatgovernmentandnongovernmentauditorganizations
conductandthatorganizationsarrangetohaveconducted,ofgovernmentorganizations,programs,activities,
functions,andfunds.Thisdescriptionisnotintendedtolimitorrequirethetypesofauditsthatmaybe
conductedorarranged.Inconductingthesetypesofaudits,auditorsshouldfollowtheapplicablestandards
includedandincorporatedinthechapterswhichfollow.

2.2 Allauditsbeginwithobjectives,andthoseobjectivesdeterminethetypeofaudittobeconductedandthe
auditstandardstobefollowed.Thetypesofaudits,asdefinedbytheirobjectives,areclassifiedinthese
standardsasfinancialauditsorperformanceaudits.

2.3 Auditsmayhaveacombinationoffinancialandperformanceauditobjectivesormayhaveobjectives
limitedtoonlysomeaspectsofoneaudittype.Forexample,auditorsconductauditsofgovernmentcontracts
andgrantswithprivatesectororganizations,aswellasgovernmentandnonprofitorganizations,thatoften
includebothfinancialandperformanceobjectives.Thesearecommonlyreferredtoas"contractaudits"or
"grantaudits."Otherexamplesofsuchauditsincludeauditsofspecificinternalcontrols,complianceissues,
andcomputerbasedsystems.Auditorsshouldfollowthestandardsthatareapplicabletotheindividual
objectivesoftheaudit.

Financial Audits
2.4Financialauditsincludefinancialstatementandfinancialrelatedaudits.

1. Financialstatementauditsprovidereasonableassuranceaboutwhetherthefinancialstatementsofan

auditedentitypresentfairlythefinancialposition,resultsofoperations,andcashflowsinconformitywith
1
generallyacceptedaccountingprinciples. Financialstatementauditsalsoincludeauditsoffinancial
statementspreparedinconformitywithanyofseveralotherbasesofaccountingdiscussedinauditing
standardsissuedbytheAmericanInstituteofCertifiedPublicAccountants(AICPA).

2. Financialrelatedauditsincludedeterminingwhether(1)financialinformationispresentedinaccordance
withestablishedorstatedcriteria,(2)theentityhasadheredtospecificfinancialcompliancerequirements,or
(3)theentity'sinternalcontrolstructureoverfinancialreportingand/orsafeguardingassetsissuitably
designedandimplementedtoachievethecontrolobjectives.
[NOTE1:ThreeauthoritativebodiesforgenerallyacceptedaccountingprinciplesaretheGovernmental
AccountingStandardsBoard(GASB),theFinancialAccountingStandardsBoard(FASB),andthesponsors
oftheFederalAccountingStandardsAdvisoryBoard(FASAB).GASBestablishesaccountingprinciplesand
financialreportingstandardsforstateandlocalgovernmententities.FASBestablishesaccountingprinciples
andfinancialreportingstandardsfornongovernmententities.ThesponsorsofFASABtheSecretaryofthe
Treasury,theDirectoroftheOfficeofManagementandBudget,andtheComptrollerGeneraljointly
establishaccountingprinciplesandfinancialreportingstandardsforthefederalgovernment,basedon
recommendationsfromFASAB.]

Government Auditing Standards

2.5Financialrelatedauditsmay,forexample,includeauditsofthefollowingitems:

1. Segmentsoffinancialstatements;financialinformation(forexample,statementofrevenueand
expenses,statementofcashreceiptsanddisbursements,statementoffixedassets);budgetrequests;and
variancesbetweenestimatedandactualfinancialperformance.

2. Internalcontrolsovercompliancewithlawsandregulations,suchasthosegoverningthe(1)biddingfor,
(2)accountingfor,and(3)reportingongrantsandcontracts(includingproposals,amountsbilled,amounts
dueonterminationclaims,andsoforth).

3. Internalcontrolsoverfinancialreportingand/orsafeguardingassets,includingcontrolsusing
computerbasedsystems.
d.Compliancewithlawsandregulationsandallegationsoffraud.

Performance Audits
2.6 Aperformanceauditisanobjectiveandsystematicexaminationofevidenceforthepurposeofproviding
anindependentassessmentoftheperformanceofagovernmentorganization,program,activity,orfunctionin
ordertoprovideinformationtoimprovepublicaccountabilityandfacilitatedecisionmakingbypartieswith
responsibilitytooverseeorinitiatecorrectiveaction.

2.7 Performanceauditsincludeeconomyandefficiencyandprogramaudits.
1. Economyandefficiencyauditsincludedetermining(1)whethertheentityisacquiring,protecting,and
usingitsresources(suchaspersonnel,property,andspace)economicallyandefficiently,(2)thecausesof
inefficienciesoruneconomicalpractices,and(3)whethertheentityhascompliedwithlawsandregulations
onmattersofeconomyandefficiency.

2. Programauditsincludedetermining(1)theextenttowhichthedesiredresultsorbenefitsestablishedby
thelegislatureorotherauthorizingbodyarebeingachieved,(2)theeffectivenessoforganizations,programs,
activities,orfunctions,and(3)whethertheentityhascompliedwithsignificantlawsandregulations
applicabletotheprogram.
2.8Economyandefficiencyauditsmay,forexample,considerwhethertheentity

1. isfollowingsoundprocurementpractices;
2. isacquiringtheappropriatetype,quality,andamountofresourcesatanappropriatecost;
3. isproperlyprotectingandmaintainingitsresources;
4. isavoidingduplicationofeffortbyemployeesandworkthatserveslittleornopurpose;
5. isavoidingidlenessandoverstaffing;
6.

isusingefficientoperatingprocedures;

7. isusingtheoptimumamountofresources(staff,equipment,andfacilities)inproducingordeliveringthe

Government Auditing Standards

appropriatequantityandqualityofgoodsorservicesinatimelymanner;

8. iscomplyingwithrequirementsoflawsandregulationsthatcouldsignificantlyaffecttheacquisition,
protection,anduseoftheentity'sresources;

9.

hasanadequatemanagementcontrolsystemformeasuring,reporting,andmonitoringa
program'seconomyandefficiency;and

10.

hasreportedmeasuresofeconomyandefficiencythatarevalidandreliable.
2

2.9Programaudits may,forexample

1. assesswhethertheobjectivesofanew,orongoingprogramareproper,suitable,orrelevant;
2. determinetheextenttowhichaprogramachievesadesiredlevelofprogramresults;
3. assesstheeffectivenessoftheprogramand/orofindividualprogramcomponents;
4. identifyfactorsinhibitingsatisfactoryperformance;
5. determinewhethermanagementhasconsideredalternativesforcarryingouttheprogramthatmightyield
desiredresultsmoreeffectivelyoratalowercost;

6.determine whether the program complements, duplicates, overlaps, or conflicts with other
relatedprograms;

7. identifywaysofmakingprogramsworkbetter;
8. assesscompliancewithlawsandregulationsapplicabletotheprogram;
9.

assess the adequacy of the management control system for measuring, reporting, and
monitoringaprogram'seffectiveness;and

10.

determinewhethermanagementhasreportedmeasuresofprogrameffectivenessthatarevalidand

reliable.[NOTE2:Theseauditsmayapplytoservices,activities,andfunctionsaswellasprograms.]

Other Activities of An Audit Organization

2.10Auditorsmayperformservicesotherthanaudits.Forexample,someauditorsmay

1. assistalegislativebodybydevelopingquestionsforuseathearings,
2. developmethodsandapproachestobeappliedinevaluatinganeworaproposedprogram,
3. forecastpotentialprogramoutcomesundervariousassumptionswithoutevaluatingcurrentoperations,and
4. performinvestigativework.

Government Auditing Standards

2.11Theheadoftheauditorganizationmaywishtoestablishpoliciesapplyingstandardsinthisstatementto
itsemployeesperformingtheseandothertypesofnonauditwork.

IfyouhavequestionsaboutGovernmentAuditingStandards,
sendemailto yellowbook@gao.gov.
Updated8/13/99

Chapter 3: General Standards

Purpose
3.1 Thischapterprescribesgeneralstandardsforconductingfinancialandperformanceaudits.Thesegeneral
standardsrelatetothequalificationsofthestaff,theauditorganization'sandtheindividualauditor's
independence,theexerciseofdueprofessionalcareinconductingtheauditandinpreparingrelatedreports,
andthepresenceofqualitycontrols.Generalstandardsaredistinctfromthosestandardsthatrelateto
conductingfieldworkandpreparingrelatedreports.

3.2 Thesegeneralstandardsapplytoallauditorganizations,bothgovernmentandnongovernment(for
example,publicaccountingfirmsandconsultingfirms),conductingauditsofgovernmentorganizations,
programs,activities,andfunctionsandofgovernmentassistancereceivedbynongovernmentorganizations.

Qualifications
3.3Thefirstgeneralstandardis:
Thestaffassignedtoconducttheauditshouldcollectivelypossessadequateprofessionalproficiencyfor
thetasksrequired.

3.4 Thisstandardplacesresponsibilityontheauditorganizationtoensurethateachauditisconductedby
staffwhocollectivelyhavetheknowledgeandskillsnecessaryforthataudit.Theyshouldalsohavea
thoroughknowledgeofgovernmentauditingandofthespecificoruniqueenvironmentinwhichtheaudited
entityoperates,relativetothenatureoftheauditbeingconducted.

3.5 Thequalificationsmentionedhereapplytotheknowledgeandskillsoftheauditorganizationasawhole
andnotnecessarilytoeachindividualauditor.Anorganizationmayneedtoemploypersonnelorhireoutside
consultantsknowledgeableinsuchareasasaccounting,statistics,law,engineering,auditdesignand
methodology,automateddataprocessing,publicadministration,economics,socialsciences,oractuarial
science.

Continuing Education Requirements

3.6Tomeetthisstandard,theauditorganizationshouldhaveaprogramtoensurethatitsstaffmaintain
professionalproficiencythroughcontinuingeducationandtraining.Thus,eachauditorresponsiblefor
planning,directing,conducting,orreportingonauditsunderthesestandardsshouldcomplete,every2years,
atleast80hoursofcontinuingeducationandtrainingwhichcontributestotheauditor'sprofessional
proficiency.Atleast20hoursshouldbecompletedinany1yearofthe2yearperiod.Individuals
responsibleforplanningordirectinganaudit,conductingsubstantialportionsofthefieldwork,orreporting
ontheauditunderthesestandardsshouldcompleteatleast24ofthe80hoursofcontinuingeducationand
traininginsubjectsdirectlyrelatedtothegovernmentenvironmentandtogovernmentauditing.Ifthe
auditedentityoperatesinaspecificoruniqueenvironment,auditorsshouldreceivetrainingthatisrelatedto
thatenvironment.

Government Auditing Standards

3.7Theauditorganizationisresponsibleforestablishingandimplementingaprogramtoensurethatauditors
meetthecontinuingeducationandtrainingrequirementsjuststated.Theorganizationshouldmaintain
documentationoftheeducationandtrainingcompleted.

[NOTE1:Thequalificationsstandardandcontinuingeducationrequirementsplaceresponsibilitiesonboth
theauditorganizationandindividualauditors.Carryingouttheseresponsibilitiesrequiressoundprofessional
judgment.Toassistauditorganizationsandindividualauditorsinexercisingthatjudgment,theGeneral
AccountingOffice(GAO)issuedInterpretationofContinuingEducationandTrainingRequirements,April
1991,GovernmentPrintingOfficestocknumber020000002506.]

3.8 Thecontinuingeducationandtrainingmayincludesuchtopicsascurrentdevelopmentsinaudit
methodology,accounting,assessmentofinternalcontrols,principlesofmanagementorsupervision,financial
management,statisticalsampling,evaluationdesign,anddataanalysis.Itmayalsoincludesubjectsrelatedto
theauditor'sfieldofwork,suchaspublicadministration,publicpolicyandstructure,industrialengineering,
economics,socialsciences,orcomputerscience.

3.9 Externalconsultantsandinternalexpertsandspecialistsshouldbequalifiedandmaintainprofessional
proficiencyintheirareasofexpertiseand/orspecializationbutarenotrequiredtomeettheabovecontinuing
educationandtrainingrequirements.Auditorsperformingnonauditactivitiesandservicesalsoarenot
requiredtomeettheabovecontinuingeducationandtrainingrequirements.

Staff Qualifications
3.10Qualificationsforstaffmembersconductingauditsinclude:

1. Knowledgeofthemethodsandtechniquesapplicabletogovernmentauditingandtheeducation,skills,and
experiencetoapplysuchknowledgetotheauditbeingconducted.

2. Knowledgeofgovernmentorganizations,programs,activities,andfunctions.
3. Skillstocommunicateclearlyandeffectively,bothorallyandinwriting.
4. Skillsappropriatefortheauditworkbeingconducted.Forinstance
(1)iftheworkrequiresuseofstatisticalsampling,thestafforconsultantstothestaffshouldincludepersons
withstatisticalsamplingskills;

(2) iftheworkrequiresextensivereviewofcomputerizedsystems,thestafforconsultantstothestaffshould

includepersonswithcomputerauditskills;

(3) iftheworkinvolvesreviewofcomplexengineeringdata,thestafforconsultantstothestaffshould
includepersonswithengineeringskills;or
(4) iftheworkinvolvestheuseofnontraditionalauditmethodologies,thestafforconsultantstothestaff

shouldincludepersonswithskillsinthosemethodologies.

5. Thefollowingqualificationsareneededforfinancialauditsthatleadtoanexpressionofanopinion.
(1) Theauditorsshouldbeproficientintheappropriateaccountingprinciplesandingovernmentauditing
standards.

10

Government Auditing Standards

(2)Thepublicaccountantsengagedtoconductauditsshouldbe(a)licensedcertifiedpublicaccountantsor
personsworkingforalicensedcertifiedpublicaccountingfirmor(b)publicaccountantslicensedonor
beforeDecember31,1970,orpersonsworkingforapublicaccountingfirmlicensedonorbeforeDecember
31,1970.

[NOTE2:Accountantsandaccountingfirmsmeetingtheselicensingrequirementsshouldalsocomply
withtheapplicableprovisionsofthepublicaccountancylawandrulesofthejurisdiction(s)wheretheaudit
isbeingconductedandthejurisdiction(s)inwhichtheaccountantsandtheirfirmsarelicensed.]

Independence
3.11Thesecondgeneralstandardis:
Inallmattersrelatingtotheauditwork,theauditorganizationandtheindividualauditors,whether
governmentorpublic,shouldbefreefrompersonalandexternalimpairmentstoindependence,should
beorganizationallyindependent,andshouldmaintainanindependentattitudeandappearance.

3.12 Thisstandardplacesresponsibilityoneachauditorandtheauditorganizationtomaintainindependence
sothatopinions,conclusions,judgments,andrecommendationswillbeimpartialandwillbeviewedas
impartialbyknowledgeablethirdparties.

3.13 Auditorsshouldconsidernotonlywhethertheyareindependentandtheirattitudesandbeliefspermit
themtobeindependentbutalsowhetherthereisanythingabouttheirsituationsthatmightleadothersto
questiontheirindependence.Allsituationsdeserveconsiderationbecauseitisessentialnotonlythatauditors
are,infact,independentandimpartial,butalsothatknowledgeablethirdpartiesconsiderthemso.

3.14 Governmentauditors,includinghiredconsultantsandinternalexpertsandspecialists,needtoconsider
threegeneralclassesofimpairmentstoindependencepersonal,external,andorganizational.Ifoneormore
oftheseimpairmentsaffectsanauditor'sabilitytodotheworkandreportfindingsimpartially,thatauditor
shouldeitherdeclinetoperformtheaudit,orinthosesituationswherethatauditorcannotdeclinetoperform
theaudit,theimpairment(s)shouldbereportedinthescopesectionoftheauditreport.Also,whenauditors
areemployeesoftheauditedentity,thatfactshouldbereflectedinaprominentplaceintheauditreport.

3.15 Nongovernmentauditorsalsoneedtoconsiderthosepersonalandexternalimpairmentsthatmightaffect
theirabilitytodotheirworkandreporttheirfindingsimpartially.Iftheirabilityisadverselyaffected,they
shoulddeclinetoperformtheaudit.PublicaccountantsshouldalsofollowtheAmericanInstituteofCertified
PublicAccountants(AICPA)codeofprofessionalconduct,thecodeofprofessionalconductofthestate
boardwithjurisdictionoverthepracticeofthepublicaccountantandtheauditorganization,andtheguidance
onpersonalandexternalimpairmentsinthesestandards.

Personal Impairments
3.16Therearecircumstancesunderwhichauditorsmaynotbeimpartial,ormaynotbeperceivedas
impartial.Theauditorganizationisresponsibleforhavingpoliciesandproceduresinplacetohelpdetermine
ifauditorshaveanypersonalimpairments.Managersandsupervisorsneedtobealertforpersonal
impairmentsoftheirstaffmembers.Auditorsareresponsiblefornotifyingtheappropriateofficialwithin
theirauditorganizationiftheyhaveanypersonalimpairments.Theseimpairmentsapplytoindividual
auditors,buttheymayalsoapplytotheauditorganization.Personalimpairmentsmayinclude,butarenot

11

Government Auditing Standards

limitedto,thefollowing:

1. official,professional,personal,orfinancialrelationshipsthatmightcauseanauditortolimittheextentof
theinquiry,tolimitdisclosure,ortoweakenorslantauditfindingsinanyway;

2. preconceivedideastowardindividuals,groups,organizations,orobjectivesofaparticularprogramthat
couldbiastheaudit;

3. previousresponsibilityfordecisionmakingormanaginganentitythatwouldaffectcurrentoperationsof
theentityorprogrambeingaudited;

4. biases,includingthoseinducedbypoliticalorsocialconvictions,thatresultfromemploymentin,or
loyaltyto,aparticulargroup,organization,orlevelofgovernment;

5. subsequent performance of an audit by the same individual who, for example, had previously
approvedinvoices,payrolls,claims,andotherproposedpaymentsoftheentityorprogrambeingaudited;

6.concurrentorsubsequentperformanceofanauditbythesameindividualwhomaintainedtheofficial
3

accountingrecords; and

7. financialinterestthatisdirect,orissubstantialthoughindirect,intheauditedentityorprogram.
[NOTE3:Forexample,anindividualperformsasubstantialpartoftheaccountingprocessorcycle,suchas
analyzing,journalizing,posting,preparing,adjustingandclosingentries,andpreparingthefinancial
statements,andlaterthesameindividualperformsanaudit.Ininstancesinwhichtheauditoractsasthemain
processorfortransactionsinitiatedbytheauditedentity,buttheauditedentityacknowledgesresponsibility
forthefinancialrecordsandfinancialstatements,theindependenceoftheauditorisnotnecessarily
impaired.]

External Impairments
3.17Factorsexternaltotheauditorganizationmayrestricttheauditorinterferewithanauditor'sabilityto
formindependentandobjectiveopinionsandconclusions.Forexample,underthefollowingconditions,an
auditmaybeadverselyaffectedandanauditormaynothavecompletefreedomtomakeanindependentand
objectivejudgment:

1. externalinterferenceorinfluencethatimproperlyorimprudentlylimitsormodifiesthescopeofanaudit;
2. external interference with the selection or application of audit procedures or in the selection of
transactionstobeexamined;

3. unreasonablerestrictionsonthetimeallowedtocompleteanaudit;
4. interferenceexternaltotheauditorganizationintheassignment,appointment,andpromotionofaudit
personnel;

5. restrictionsonfundsorotherresourcesprovidedtotheauditorganizationthatwouldadverselyaffectthe
auditorganization'sabilitytocarryoutitsresponsibilities;

6.

authoritytooverruleortoinfluencetheauditor'sjudgmentastotheappropriatecontentofanaudit

report;

12

Government Auditing Standards

and
g.influencesthatjeopardizetheauditor'scontinuedemploymentforreasonsotherthancompetencyorthe
needforauditservices.

Organizational Independence
3.18Governmentauditors'independencecanbeaffectedbytheirplacewithinthestructureofthe
governmententitytowhichtheyareassignedandalsobywhethertheyareauditinginternallyorauditing
otherentities.

Internal Auditors
3.19 Afederal,state,orlocalgovernmentauditorganization,oranauditorganizationwithinother
governmententities,suchasapubliccollege,university,orhospital,maybesubjecttoadministrative
directionfrompersonsinvolvedinthegovernmentmanagementprocess.Tohelpachieveorganizational
independence,auditorganizationsshouldreporttheresultsoftheirauditsandbeaccountabletotheheador
deputyheadofthegovernmententityandshouldbeorganizationallylocatedoutsidethestafforline
managementfunctionoftheunitunderaudit.Theauditorganization'sindependenceisenhancedwhenit
alsoreportsregularlytotheentity'sindependentauditcommitteeand/ortheappropriategovernment
oversightbody.

3.20 Auditorsshouldalsobesufficientlyremovedfrompoliticalpressurestoensurethattheycanconduct
theirauditsobjectivelyandcanreporttheirfindings,opinions,andconclusionsobjectivelywithoutfearof
politicalrepercussion.Wheneverfeasible,theyshouldbeunderapersonnelsysteminwhichcompensation,
training,jobtenure,andadvancementarebasedonmerit.

3.21 Iftheaboveconditionsaremet,andnopersonalorexternalimpairmentsexist,theauditstaffshouldbe
consideredorganizationallyindependenttoauditinternallyandfreetoreportobjectivelytotopmanagement.

3.22 Whenorganizationallyindependentinternalauditorsconductauditsexternaltothegovernmententityto
whichtheyaredirectlyassigned,theymaybeconsideredindependentoftheauditedentityandfreetoreport
objectivelytotheheadordeputyheadofthegovernmententitytowhichassigned.

External Auditors
3.23 Government auditors employed by audit organizations whose heads are elected and legislative
auditorsauditingexecutiveentitiesmaybeconsideredfreeoforganizationalimpairmentswhenauditing
outsidethegovernmententitytowhichtheyareassigned.

3.24 Governmentauditorsmaybepresumedtobeindependentoftheauditedentity,assumingnopersonalor
externalimpairmentsexist,iftheentityis

1. alevelofgovernmentotherthantheonetowhichtheyareassigned(federal,state,orlocal)or
2. adifferentbranchofgovernmentwithinthelevelofgovernmenttowhichtheyareassigned(legislative,
executive,orjudicial).

3.25Governmentauditorsmayalsobepresumedtobeindependent,assumingnopersonalorexternal

impairmentsexist,iftheauditorganization'sheadis
13

Government Auditing Standards

1. electedbythecitizensoftheirjurisdiction,
2. electedorappointedbyalegislativebodyofthelevelofgovernmenttowhichtheyareassignedand
reporttheresultsofauditsto,andareaccountabletothelegislativebody,or

3. appointedbythechiefexecutivebutconfirmedby,reporttheresultsofauditsto,andareaccountableto
alegislativebodyofthelevelofgovernmenttowhichtheyareassigned.

Due Professional Care

3.26Thethirdgeneralstandardis:
Dueprofessionalcareshouldbeusedinconductingtheauditandinpreparingrelatedreports.

3.27 Thisstandardrequiresauditorstoworkwithdueprofessionalcare.Duecareimposesaresponsibility

uponeachauditorwithintheauditorganizationtoobservegenerallyacceptedgovernmentauditingstandards.

3.28 Exercisingdueprofessionalcaremeansusingsoundjudgmentinestablishingthescope,selectingthe
methodology,andchoosingtestsandproceduresfortheaudit.Thesamesoundjudgmentshouldbeapplied
inconductingthetestsandproceduresandinevaluatingandreportingtheauditresults.

3.29 Auditorsshouldusesoundprofessionaljudgmentindeterminingthestandardsthatapplytotheworkto
beconducted.Theauditors'determinationthatcertainstandardsdonotapplytotheauditshouldbe
documentedintheworkingpapers.Situationsmayoccurinwhichgovernmentauditorsarenotableto
followanapplicablestandardandarenotabletowithdrawfromtheaudit.Inthosesituations,theauditors
shoulddiscloseinthescopesectionoftheirreport,thefactthatanapplicablestandardwasnotfollowed,the
reasonstherefor,andtheknowneffectthatnotfollowingthestandardhadontheresultsoftheaudit.

3.30 Whilethisstandardplacesresponsibilityoneachauditorandauditorganizationtoexercisedue
professionalcareintheperformanceofanauditassignment,itdoesnotimplyunlimitedresponsibility;
neitherdoesitimplyinfallibilityonthepartofeithertheindividualauditorortheauditorganization.

Quality Control
3.31Thefourthgeneralstandardis:
Eachauditorganizationconductingauditsinaccordancewiththesestandardsshouldhavean
appropriateinternalqualitycontrolsysteminplaceandundergoanexternalqualitycontrolreview.
3.32Theinternalqualitycontrolsystemestablishedbytheauditorganizationshouldprovidereasonable
assurancethatit(1)hasadopted,andisfollowing,applicableauditingstandardsand(2)hasestablished,and
isfollowing,adequateauditpoliciesandprocedures.Thenatureandextentofanorganization'sinternal
qualitycontrolsystemdependonanumberoffactors,suchasitssize,thedegreeofoperatingautonomy
alloweditspersonnelanditsauditoffices,thenatureofitswork,itsorganizationalstructure,and
appropriatecostbenefitconsiderations.Thus,thesystemsestablishedbyindividualorganizationswillvary,

aswilltheextentoftheirdocumentation.
14

Government Auditing Standards

3.33Organizationsconductingauditsinaccordancewiththesestandardsshouldhaveanexternalquality
controlreviewatleastonceevery3yearsbyanorganizationnotaffiliatedwiththeorganizationbeing
4
reviewed. Theexternalqualitycontrolreviewshoulddeterminewhethertheorganization'sinternalquality
controlsystemisinplaceandoperatingeffectivelytoprovidereasonableassurancethatestablished
policiesandproceduresandapplicableauditingstandardsarebeingfollowed.
[NOTE4:Auditorganizationsshouldhaveanexternalqualitycontrolreviewcompleted(thatis,report
issued)within3yearsfromthedatetheystarttheirfirstauditinaccordancewiththesestandards.Subsequent
externalqualitycontrolreviewsshouldbecompletedwithin3yearsaftertheissuanceofthepriorreview.]
3.34Anexternalqualitycontrolreviewunderthisstandardshouldmeetthefollowingrequirements.

1. Reviewersshouldbequalifiedandhavecurrentknowledgeofthetypeofworktobereviewedandthe
applicableauditingstandards.Forexample,individualsreviewinggovernmentauditsshouldhaveathorough
knowledgeofthegovernmentenvironmentandgovernmentauditingrelativetotheworkbeingreviewed.

2. Reviewersshouldbeindependent(asdefinedinthesestandards)oftheauditorganizationbeingreviewed,
itsstaff,anditsauditeeswhoseauditsareselectedforreview.Anauditorganizationisnotpermittedto
reviewtheorganizationthatconducteditsmostrecentexternalqualitycontrolreview.

3. Reviewersshouldusesoundprofessionaljudgmentinconductingandreportingtheresultsoftheexternal
qualitycontrolreview.

4. Reviewersshoulduseoneofthefollowingapproachestoselectingauditsforreview:(1)selectauditsthat
provideareasonablecrosssectionoftheauditsconductedinaccordancewiththesestandardsor(2)select
auditsthatprovideareasonablecrosssectionoftheorganization'saudits,includingoneormoreaudits
conductedinaccordancewiththesestandards.

5. Thisreviewshouldincludeareviewoftheauditreports,workingpapers,andothernecessarydocuments
(forexample,correspondenceandcontinuingeducationdocumentation)aswellasinterviewswiththe
reviewedorganization'sprofessionalstaff.

6.

Awrittenreportshouldbepreparedcommunicatingtheresultsoftheexternalqualitycontrolreview.

[NOTE5:ExternalqualitycontrolreviewsconductedthroughorbytheAICPA,NationalState
AuditorsAssociation,NationalAssociationofLocalGovernmentAuditors,President'sCouncilon
IntegrityandEfficiency,ExecutiveCouncilonIntegrityandEfficiency,andInstituteofInternal
Auditorsmeettheserequirements.]

3.35 Externalqualitycontrolreviewproceduresshouldbetailoredtothesizeandnatureofanorganization's
auditwork.Forexample,anorganizationthatperformsonlyafewauditsmaybemoreeffectivelyreviewed
byemphasizingareviewofthequalityofthoseauditsratherthantheorganization'sinternalqualitycontrol
policiesandprocedures.

3.36 Auditorganizationsseekingtoenterintoacontracttoperformanauditinaccordancewiththese
standardsshouldprovidetheirmostrecentexternalqualitycontrolreviewreporttothepartycontractingfor
theaudit.Informationintheexternalqualitycontrolreviewreportoftenwouldberelevanttodecisionson
procuringauditservices.Auditorganizationsalsoshouldmaketheirexternalqualitycontrolreviewreports
availabletoauditorsusingtheirworkandtoappropriateoversightbodies.Itisrecommendedthatthereport
bemadeavailabletothepublic.

15

Government Auditing Standards

[NOTE6:Theterm"report"doesnotincludeseparatelettersofcomment.]

IfyouhavequestionsaboutGovernmentAuditingStandards,
sendemailto yellowbook@gao.gov.
Updated8/13/99

1
6

Chapter 4: Field Work Standards for Financial Audits

(RevisedthroughAmendment2)

Purpose
4.1Thischapterprescribesstandardsoffieldworkforfinancialaudits,whichincludefinancialstatement
auditsandfinancialrelatedaudits.

Relation to AICPA Standards

RevisedJuly1999

4.2Forfinancialstatementaudits,generallyacceptedgovernmentauditingstandards(GAGAS)incorporate
theAmericanInstituteofCertifiedPublicAccountants'(AICPA)threegenerallyacceptedstandardsoffield
work,whichare:

1. Theworkistobeadequatelyplannedandassistants,ifany,aretobeproperlysupervised.
2. Asufficientunderstandingofinternalcontrolistobeobtainedtoplantheauditandtodeterminethe
nature,timing,andextentofteststobeperformed.

3. Sufficientcompetentevidentialmatteristobeobtainedthroughinspection,observation,inquiries,and
confirmationstoaffordareasonablebasisforanopinionregardingthefinancialstatementsunderaudit.
4.3TheAICPAhasissuedstatementsonauditingstandards(SAS)thatinterpretitsstandardsoffieldwork
1
(includingaSASoncomplianceauditing). ThischapterincorporatestheseSASsandprescribesadditional
standardson

1. auditorcommunication(seeparagraphs4.6.3through4.6.9),
2. auditfollowup(seeparagraphs4.7,4.10,and4.11);
3. noncomplianceotherthanillegalacts(seeparagraphs4.13and4.18through4.20);
4. documentationoftheassessmentofcontrolriskforassertionssignificantlydependentuponcomputerized
informationsystems(seeparagraphs4.21.1through4.21.4);and

5. workingpapers.(Seeparagraphs4.35through4.38.)
[NOTE1:GAGASincorporateanynewAICPAfieldworkstandardsrelevanttofinancialstatement
auditsunlesstheGeneralAccountingOffice(GAO)excludesthembyformalannouncement.]

17

Government Auditing Standards

4.4Thischapteralsodiscussesthreeotherkeyaspectsoffinancialstatementaudits:

1. materiality(seeparagraphs4.6.1and4.6.2),
2. fraudandillegalacts(seeparagraphs4.14through4.17),and
3. internalcontrol.(Seeparagraphs4.22and4.25through4.30.)
4.5Thischapterconcludesbyexplainingwhichstandardsauditorsshouldfollowinperforming
financialrelatedaudits.

Planning
RevisedJuly1999

4.6AICPAstandardsandGAGASrequirethefollowing:
Theworkistobeproperlyplanned,andauditorsshouldconsidermateriality,amongothermatters,in
determiningthenature,timing,andextentofauditingproceduresandinevaluatingtheresultsofthose
procedures.

4.6.1 Auditorsconsiderationofmaterialityisamatterofprofessionaljudgmentandisinfluencedbytheir
perceptionoftheneedsofareasonablepersonwhowillrelyonthefinancialstatements.Materiality
judgmentsaremadeinlightofsurroundingcircumstancesandnecessarilyinvolvebothquantitativeand
qualitativeconsiderations.

4.6.2 Inanauditofthefinancialstatementsofagovernmententityoranentitythatreceivesgovernment
assistance,auditorsmaysetlowermaterialitylevelsthaninauditsintheprivatesectorbecauseofthepublic
accountabilityoftheauditee,thevariouslegalandregulatoryrequirements,andthevisibilityandsensitivity
ofgovernmentprograms,activities,andfunctions.

Auditor Communication
4.6.3Thefirstadditionalplanningstandardforfinancialstatementauditsis:
Auditorsshouldcommunicateinformationtotheauditee,theindividualscontractingfororrequestingthe
auditservices,andtheauditcommitteeregardingthenatureandextentofplannedtestingandreporting
oncompliancewithlawsandregulationsandinternalcontroloverfinancialreporting.

4.6.4 AICPAstandardsandGAGASrequireauditorstoestablishanunderstandingwiththeclientandto
communicatewithauditcommittees.GAGASbroadenwhoauditorsmustcommunicatewithandrequire
auditorstocommunicatespecificinformationregardingthenatureandextentoftestingandreportingon
compliancewithlawsandregulationsandinternalcontroloverfinancialreportingduringtheplanningstages
ofafinancialstatementaudittoreducetheriskthattheneedsorexpectationsofthepartiesinvolvedmaybe
misinterpreted.

4.6.5 Theauditeeistheorganizationorentitybeingaudited.Auditorsshouldcommunicatetheirresponsibilities
fortheengagementtotheappropriateofficialsoftheauditee(whichwouldnormallyincludetheheadofthe

organization,theauditcommitteeorboardofdirectorsorotherequivalentoversightbodyin
18

Government Auditing Standards

theabsenceofanauditcommittee,andtheindividualwhopossessesasufficientlevelofauthorityand
responsibilityforthefinancialreportingprocess,suchasthechieffinancialofficer).Insituationswhere
auditorsareperformingtheauditunderacontractwithapartyotherthantheauditee,orpursuanttoathird
partyrequest,auditorsshouldalsocommunicatewiththeindividualscontractingfororrequestingtheaudit,
suchascontractingofficialsorlegislativemembersorstaff.Whenauditorsareperformingtheauditpursuant
toalaworregulation,auditorsshouldcommunicatewiththelegislativemembersorstaffwhohaveoversight
oftheauditee.

1.1

[NOTE1.1:Thisrequirementappliesonlytosituationswherethelaworregulationspecificallyidentifiesthe
entitytobeaudited,suchasanauditofaspecificagencysfinancialstatementsrequiredbytheChief
FinancialOfficersAct,asexpandedbytheGovernmentManagementReformActof1994.Situationswhere
thefinancialstatementauditmandateappliestoentitiesnotspecificallyidentified,suchasauditsrequiredby
theSingleAuditActAmendmentsof1996,areexcluded.]

4.6.6 Duringtheplanningstagesofanaudit,auditorsshouldcommunicatetheirresponsibilitiesinafinancial
statementaudit,includingtheirresponsibilitiesfortestingandreportingoncompliancewithlawsand
regulationsandinternalcontroloverfinancialreporting.Suchcommunicationshouldincludethenatureof
anyadditionaltestingofcomplianceandinternalcontrolrequiredbylawsandregulationsorotherwise
requested,andwhethertheauditorsareplanningonprovidingopinionsoncompliancewithlawsand
regulationsandinternalcontroloverfinancialreporting.

4.6.7 Auditorsshouldusetheirprofessionaljudgmenttodeterminetheformandcontentofthe
communication.Writtencommunicationispreferred.Auditorsshoulddocumentthecommunicationinthe
workingpapers.Auditorsmayuseanengagementlettertocommunicatetheinformationdescribedin
paragraph4.6.6.Toassistinunderstandingthelimitationsofauditors'responsibilitiesfortestingand
reportingoncomplianceandinternalcontroloverfinancialreporting,auditorsmaywanttocontrastthose
responsibilitieswithotherfinancialrelatedauditsofcomplianceandcontrols.Thediscussioninparagraphs
4.6.8 and4.6.9maybehelpfultoauditorsinexplainingtheirresponsibilitiesfortestingandreportingon
compliancewithlawsandregulationsandinternalcontroloverfinancialreportingtotheauditeeandother
interestedparties.
4.6.8Testsofcompliancewithlawsandregulationsandinternalcontroloverfinancialreportingina
financialstatementauditcontributetotheevidencesupportingtheauditors'opiniononthefinancial
statements.However,theygenerallydonotprovideabasisforopiningoncomplianceorinternalcontrol
overfinancialreporting.Tomeetcertainauditreportusers'needs,lawsandregulationssometimesprescribe
testingandreportingoncomplianceandinternalcontroloverfinancialreportingtosupplementthefinancial
statementaudit'scoverageoftheseareas.

1.2

[NOTE1.2:Forexample,whenengagedtoperformauditsundertheSingleAuditActofstateandlocal
governmententitiesandnonprofitorganizationsthatreceivefederalawards,auditorsshouldbefamiliarwith
theSingleAuditActAmendmentsof1996andOfficeofManagementandBudget(OMB)CircularA133.
Theactandcircularincludespecificauditrequirements,mainlyintheareasofcompliancewithlawsand
regulationsandinternalcontrol,thatexceedtheminimumauditrequirementsinthestandardsinchapters4
and5ofthisdocument.AuditsconductedundertheChiefFinancialOfficersActof1990,asexpandedbythe
GovernmentManagementReformActof1994,alsohavespecificauditrequirementsprescribedbyOMBin
theareasofcomplianceandinternalcontrol.Manystateandlocalgovernmentshaveadditionalaudit
requirements.]
4.6.9Evenafterauditorsperformandreporttheresultsofadditionaltestsofcomplianceandinternalcontrol
overfinancialreportingrequiredbylawsandregulations,somereasonableneedsofreportusersstillmaybe
unmet.Auditorsmaymeettheseneedsbyperformingfurthertestsofcomplianceandinternalcontrolin

19

Government Auditing Standards

eitheroftwoways:

1. supplemental(oragreedupon)proceduresor
2. examination,resultinginanopinion.

Audit Follow-up
4.7Thesecondadditionalplanningstandardforfinancialstatementauditsis:
Auditorsshouldfollowuponknownmaterialfindingsandrecommendationsfrompreviousaudits.
[Paragraphs4.8and4.9havebeenmovedandrenumberedtoparagraphs4.6.1and4.6.2.]

4.10 Auditorsshouldfollowuponknownmaterialfindingsandrecommendationsfrompreviousauditsthat
couldaffectthefinancialstatementaudit.Theyshoulddothistodeterminewhethertheauditeehastaken
timelyandappropriatecorrectiveactions.Auditorsshouldreportthestatusofuncorrectedmaterialfindings
andrecommendationsfrompriorauditsthataffectthefinancialstatementaudit.

4.11 Muchofthebenefitfromauditworkisnotinthefindingsreportedortherecommendationsmade,but
intheireffectiveresolution.Auditeemanagementisresponsibleforresolvingauditfindingsand
recommendations,andhavingaprocesstotracktheirstatuscanhelpitfulfillthisresponsibility.If
managementdoesnothavesuchaprocess,auditorsmaywishtoestablishtheirown.Continuedattentionto
materialfindingsandrecommendationscanhelpauditorsassurethatthebenefitsoftheirworkarerealized.

Fraud, Illegal Acts, and Other Noncompliance

RevisedJuly1999

4.12AICPAstandardsandGAGASrequirethefollowing:
a.Auditorsshoulddesigntheaudittoprovidereasonableassuranceofdetectingfraudthatismaterial
tothefinancialstatements.

[NOTE2:Twotypesofmisstatementsarerelevanttotheauditors'considerationoffraudinafinancial
statementauditmisstatementsarisingfromfraudulentfinancialstatementsandmisstatementsarisingfrom
misappropriationofassets.Theprimaryfactorthatdistinguishesfraudfromerroriswhethertheunderlying
actionthatresultsinthemisstatementinthefinancialstatementsisintentionalorunintentional.]
b.Auditorsshoulddesigntheaudittoprovidereasonableassuranceofdetectingmaterial
misstatementsresultingfromdirectandmaterialillegalacts.

[NOTE3:Directandmaterialillegalactsareviolationsoflawsandregulationshavingadirectandmaterial
effectonthedeterminationoffinancialstatementamounts.]
4

c.Auditorsshouldbeawareofthepossibilitythatindirectillegalactsmayhaveoccurred. Ifspecific
informationcomestotheauditors'attentionthatprovidesevidenceconcerningtheexistenceofpossible
illegalactsthatcouldhaveamaterialindirecteffectonthefinancialstatements,theauditorsshouldapply

auditproceduresspecificallydirectedtoascertainingwhetheranillegalacthasoccurred.

20

Government Auditing Standards

[NOTE4:Indirectillegalactsareviolationsoflawsandregulationshavingmaterialbutindirecteffectson
thefinancialstatements.]
4.13Theadditionalcompliancestandardforfinancialstatementauditsis:
Auditorsshoulddesigntheaudittoprovidereasonableassuranceofdetectingmaterialmisstatements
resultingfromnoncompliancewithprovisionsofcontractsorgrantagreementsthathaveadirectand
materialeffectontheonthedeterminationoffinancialstatementamounts.Ifspecificinformation
comestotheauditors'attentionthatprovidesevidenceconcerningtheexistenceofpossible
noncompliancethatcouldhaveamaterialindirecteffectonthefinancialstatements,auditorsshould
applyauditproceduresspecificallydirectedtoascertainingwhetherthatnoncompliancehasoccurred.

Auditors' Understanding of Possible Fraud and of Laws and Regulations

4.14 Auditorsareresponsibleforbeingawareofthecharacteristicsandtypesofpotentiallymaterialfraud
thatcouldbeassociatedwiththeareabeingauditedsothattheycanplantheaudittoprovidereasonable
assuranceofdetectingmaterialfraud.

4.15 Auditorsshouldobtainanunderstandingofthepossibleeffectsonfinancialstatementsoflawsand
regulationsthataregenerallyrecognizedbyauditorstohaveadirectandmaterialeffectonthedeterminationof
amountsinthefinancialstatements.Auditorsmayfinditnecessarytousetheworkoflegalcounselin(1)
determiningwhichlawsandregulationsmighthaveadirectandmaterialeffectonthefinancialstatements,
5

(2)designingtestsofcompliancewithlawsandregulations,and(3)evaluatingtheresultsofthosetests.
Auditorsalsomayfinditnecessarytousetheworkoflegalcounselwhenanauditrequirestesting
compliancewithprovisionsofcontractsorgrantagreements.Dependingonthecircumstancesoftheaudit,
auditorsmayfinditnecessarytoobtaininformationoncompliancemattersfromothers,suchasinvestigative
staff,auditofficialsofgovernmententitiesthatprovidedassistancetotheauditee,and/ortheapplicablelaw
enforcementauthority.
[NOTE5:AICPAstandardsprovideguidanceforauditorswhousetheworkofaspecialistwhoisnota
memberoftheirstaff.]

Due Care Concerning Possible Fraud and Illegal Acts

4.16 Auditorsshouldexercisedueprofessionalcareinpursuingindicationsofpossiblefraudandillegalacts
soasnottointerferewithpotentialfutureinvestigations,legalproceedings,orboth.Undersome
circumstances,laws,regulations,orpoliciesmayrequireauditorstoreportindicationsofcertaintypesof
fraudorillegalactstolawenforcementorinvestigatoryauthoritiesbeforeextendingauditstepsand
procedures.Auditorsmayalsoberequiredtowithdrawfromordeferfurtherworkontheauditoraportion
oftheauditinordernottointerferewithaninvestigation.

4.17 AnauditmadeinaccordancewithGAGASwillnotguaranteethediscoveryofillegalactsorcontingent
liabilitiesresultingfromthem.Nordoesthesubsequentdiscoveryofillegalactscommittedduringtheaudit
periodnecessarilymeanthattheauditors'performancewasinadequate,providedtheauditwasmadein
accordancewiththesestandards.

Noncompliance Other Than Illegal Acts

4.18Thetermnoncompliancehasabroadermeaningthanillegalacts.Noncomplianceincludesnotonly

illegalacts,butalsoviolationsofprovisionsofcontractsorgrantagreements.AICPAstandardsdonot
21

Government Auditing Standards

discussauditors'responsibilityfordetectingnoncomplianceotherthanillegalacts.But,underGAGAS,
auditorshavethesameresponsibilitiesfordetectingmaterialmisstatementsarisingfromothertypesof
noncomplianceastheydofordetectingthosearisingfromillegalacts.

4.19 Directandmaterialnoncomplianceisnoncompliancehavingadirectandmaterialeffectonthe
determinationoffinancialstatementamounts.Auditorsshoulddesigntheaudittoprovidereasonable
assuranceofdetectingmaterialmisstatementsresultingfromdirectandmaterialnoncompliancewith
provisionsofcontractsorgrantagreements.

4.20 Indirectnoncomplianceisnoncompliancehavingmaterialbutindirecteffectsonthefinancial
statements.Afinancialstatementauditprovidesnoassurancethatindirectnoncompliancewithprovisionsof
contractsorgrantagreementswillbedetected.However,ifspecificinformationcomestotheauditors'
attentionthatprovidesevidenceconcerningtheexistenceofpossiblenoncompliancethatcouldhavea
materialindirecteffectonthefinancialstatements,auditorsshouldapplyauditproceduresspecifically
directedtoascertainingwhetherthatnoncompliancehasoccurred.

Internal Control
RevisedMay1999

4.21AICPAstandardsandGAGASrequirethefollowing:
Auditorsshouldobtainasufficientunderstandingofinternalcontroltoplantheauditanddetermine
thenature,timing,andextentofteststobeperformed.
4.21.1AICPAstandardsandGAGASrequirethat,inallaudits,auditorsobtainanunderstandingofinternal
controlsufficienttoplantheauditbyperformingprocedurestounderstand(1)thedesignofcontrolsrelevant
toanauditoffinancialstatementsand(2)whetherthecontrolshavebeenplacedinoperation.This
understandingshouldincludeaconsiderationofthemethodsanentityusestoprocessaccountinginformation
becausesuchmethodsinfluencethedesignofinternalcontrol.Theextenttowhichcomputerizedinformation
5.1

systemsareusedinsignificantaccountingapplications, aswellasthecomplexityofthatprocessing,may
alsoinfluencethenature,timing,andextentofauditprocedures.Accordingly,inplanningtheauditandin
obtaininganunderstandingofinternalcontroloveranentity'scomputerprocessing,auditorsshouldconsider,
amongotherthings,suchmattersas

1. theextenttowhichcomputerprocessingisusedineachsignificantaccountingapplication; 5.2
2. thecomplexityoftheentity'scomputeroperations;
3. theorganizationalstructureofthecomputerprocessingactivities;and
4. thekindsandcompetenceofavailableevidentialmatter,inelectronicandinpaperformats,toachieve
auditobjectives.
[NOTE5.1:Significantaccountingapplicationsarethosewhichrelatetoaccountinginformationthatcan
materiallyaffectthefinancialstatementstheauditorisauditing.Significantaccountingapplicationscould
includefinancialaswellasothersystems,suchasmanagementinformationsystemsorsystemsthatmonitor
compliance,iftheyprovidedataformaterialaccountbalances,transactionclasses,anddisclosure
componentsoffinancialstatements.]

22

Government Auditing Standards

[NOTE5.2:Obtaininganunderstandingoftheseelementswouldincludeconsiderationofinternalcontrol
relatedtosecurityovercomputerizedinformationsystems.]

4.21.2 AICPAstandardsandGAGASrequireauditorstodocumenttheirunderstandingofthecomponentsof
anentity'sinternalcontrolrelatedtocomputerapplicationsthatprocessinformationusedinpreparingan
entity'sfinancialstatementsand,basedonthatunderstanding,todevelopaplannedauditapproachin
sufficientdetailtodemonstrateitseffectivenessinreducingauditrisk.Indoingso,underAICPAstandards
andGAGAS,auditorsshouldconsiderwhetherspecializedskillsareneededforconsideringtheeffectof
computerizedinformationsystemsontheaudit,understandinginternalcontrol,ordesigningandperforming
auditprocedures,includingtestsofinternalcontrol.Iftheuseofaprofessionalwithspecializedskillsis
planned,auditorsshouldhavesufficientcomputerrelatedknowledgetocommunicatetheobjectivesofthe
otherprofessional'swork;toevaluatewhetherthespecifiedprocedureswillmeettheauditors'objectives;and
toevaluatetheresultsoftheproceduresappliedastheyrelatetothenature,timing,andextentofother
plannedauditprocedures.

4.21.3 Theadditionalinternalcontrolstandardforfinancialstatementauditsis
Inplanningtheaudit,auditorsshoulddocumentintheworkingpapers(1)thebasisforassessing
controlriskatthemaximumlevelforassertionsrelatedtomaterialaccountbalances,transaction
classes,anddisclosurecomponentsoffinancialstatementswhensuchassertionsaresignificantly
dependentuponcomputerizedinformationsystems,and(2)considerationthattheplannedaudit
proceduresaredesignedtoachieveauditobjectivesandtoreduceauditrisktoanacceptablelevel.
4.21.4ThisadditionalGAGASstandarddoesnotincreasetheauditorsresponsibilityfortestingcontrols,but
ratherrequiresthat,iftheauditorassessescontrolriskatthemaximumlevelforassertionsrelatedtomaterial
accountbalances,transactionclasses,anddisclosurecomponentsoffinancialstatementswhensuchassertions
aresignificantlydependentuponcomputerizedinformationsystems,theauditorshoulddocumentinthe
5.3

workingpapers thebasisforthatconclusionbyaddressing(1)theineffectivenessofthedesignand/or
operationofthecontrols,or(2)thereasonswhyitwouldbeinefficienttotestthecontrols.Insuch
circumstances,GAGASalsorequiretheauditortodocumentintheworkingpaperstheconsiderationthatthe
plannedauditproceduresaredesignedtoachievespecificauditobjectivesand,accordingly,toreduceaudit
risktoanacceptablelevel.Thisdocumentationshouldaddress

1. therationalefordeterminingthenature,timing,andextentofplannedauditprocedures;
2. thekindsandcompetenceofavailableevidentialmatterproducedoutsideacomputerizedinformation
system;and

3. theeffectontheauditopinionorreportifevidentialmattertobegatheredduringtheauditdoesnotafford
1 reasonablebasisfortheauditorsopiniononthefinancialstatements.
[NOTE5.3:Seeparagraphs4.34through4.38foradiscussionoftheworkingpaperstandards.]
4.22Safeguardingofassetsandcompliancewithlawsandregulationsareinternalcontrolobjectivesthatare
especiallyimportantinconductingfinancialstatementauditsinaccordancewithGAGASofgovernmental
entitiesorothersreceivinggovernmentfunds.Giventhepublicaccountabilityforstewardshipofresources,
safeguardingofassetspermeatescontrolobjectivesandcomponentsasdefinedbytheAICPAstandardsand
GAGAS.Also,theoperationofgovernmentprogramsandtherelatedtransactionsthatmateriallyaffectthe
entity'sfinancialstatementsaregenerallygovernedbylawsandregulations.AlthoughGAGASarenot
prescribingadditionalinternalcontrolstandardsintheseareas,thischapterprovidesadiscussionthatauditors
mayfindusefulinassessingauditriskandinobtainingevidenceneededtosupporttheiropiniononthe

23

Government Auditing Standards

financialstatementsinagovernmentalenvironment.

4.23 Deleted
4.24 Deleted

Safeguarding of Assets
4.25 Asappliedtofinancialstatementaudits,internalcontroloversafeguardingofassetsconstitutes
aprocess,effectedbyanentity'sgoverningbody,management,andotherdetectionofunauthorized
acquisition,use,ordispositionoftheentity'sassetsthatcouldhaveamaterialeffectonthefinancial
statements.

4.26 Internalcontroloverthesafeguardingofassetsrelatestothepreventionortimelydetectionof
unauthorizedtransactionsandunauthorizedaccesstoassetsthatcouldresultinlossesthatarematerialtothe
financialstatements;forexample,whenunauthorizedexpendituresorinvestmentsaremade,unauthorized
liabilitiesareincurred,inventoryisstolen,orassetsareconvertedtopersonaluse.Suchcontrolsaredesigned
tohelpensuretheuseofandaccesstoassetsareinaccordancewithmanagement'sauthorization.
Authorizationincludesapprovaloftransactionsinaccordancewithcontrolactivitiesestablishedby
managementtosafeguardassets,suchasestablishingandcomplyingwithrequirementsforextendingand
monitoringcreditormakinginvestmentdecisions,andrelateddocumentation.Controloversafeguardingof
assetsisnotdesignedtoprotectagainstlossofassetsarisingfrominefficiencyorfrommanagement's
operatingdecisions,suchasincurringexpendituresforequipmentormaterialthatprovestobeunnecessary
orunsatisfactory.

4.27 AICPAstandardsandGAGASrequireauditorstoobtainasufficientunderstandingofinternalcontrolto
plantheaudit.Theyalsorequireauditorstoplantheaudittoprovidereasonableassuranceofdetecting
materialfraud,includingmaterialmisappropriationofassets.Becausepreventingordetectingmaterial
misappropriationsisanobjectiveofcontroloversafeguardingofassets,understandingthistypeofcontrol
canbeessentialtoplanningtheaudit.

4.28 Controloversafeguardingofassetsisnotlimitedtopreventingordetectingmisappropriations,
however.Italsohelpspreventordetectothermateriallossesthatcouldresultfromunauthorizedacquisition,
use,ordispositionofassets.Suchcontrolsinclude,forexample,theprocessofassessingtheriskof
unauthorizedacquisition,use,ordispositionofassetsandestablishingcontrolactivitiestohelpensurethat
managementdirectivestoaddresstheriskarecarriedout.Suchcontrolactivitieswouldincludepermitting
acquisition,use,ordispositionofassetsonlyinaccordancewithmanagement'sgeneralorspecific
authorization,includingcompliancewithestablishedcontrolactivitiesforsuchacquisition,use,or
disposition.Theywouldalsoincludecomparingexistingassetswiththerelatedrecordsatreasonable
intervalsandtakingappropriateactionwithrespecttoanydifferences.Finally,controlsoversafeguardingof
assetsagainstunauthorizedacquisition,use,ordispositionalsorelatetomakingavailabletomanagement
informationitneedstocarryoutitsresponsibilitiesrelatedtopreventionortimelydetectionofsuch
unauthorizedactivities,aswellasmechanismstoenablemanagementtomonitorthecontinuedeffective
operationofsuchcontrols.

4.29 Understandingthecontroloversafeguardingofassetscanhelpauditorsassesstheriskthatfinancial
statementscouldbemateriallymisstated.Forexample,anunderstandingofanauditee'scontroloverthe
safeguardingofassetscanhelpauditorsrecognizeriskfactorssuchas
a.failuretoadequatelymonitordecentralizedoperations;

24

Government Auditing Standards

2. lackofcontroloveractivities,suchaslackofdocumentationformajortransactions;
3. lackofcontrolovercomputerizedinformationsystems,suchasalackofcontroloveraccesstoapplications
thatinitiateorcontrolthemovementofassets;

4. failuretodeveloporcommunicateadequatecontrolactivitiesforsecurityofdataorassets,such
asallowingunauthorizedpersonneltohavereadyaccesstodataorassets;and

5. failuretoinvestigatesignificantunreconcileddifferencesbetweenreconciliationsofacontrolaccountand
subsidiaryrecords.

Control Over Compliance With Laws and Regulations

4.29.1Governmentalentitiesaresubjecttoavarietyoflawsandregulationsthataffecttheirfinancial
statements,whichisamajorfactordistinguishinggovernmentalaccountingfromcommercialaccounting.
Forexample,suchlawsandregulationsmayaddresstherequiredfundstructure,procurementordebt
limitations,orauthorityfortransactions.Accordingly,compliancewithsuchlawsandregulationsmayhave
adirectandmaterialeffectonthedeterminationofamountsinthefinancialstatementsofgovernmental
entities.Likewise,organizationsthatreceivegovernmentassistance,suchascontractors,nonprofit
organizations,andothernongovernmentalorganizations,arealsosubjecttoregulations,contractprovisions,
orgrantagreementsthatcouldhaveadirectandmaterialeffectontheirfinancialstatements.Management,
ofbothgovernmentalentitiesandothersreceivinggovernmentalassistance,isresponsibleforensuringthat
theentitycomplieswiththelawsandregulationsapplicabletoitsactivities.Thatresponsibilityencompasses
theidentificationofapplicablelawsandregulationsandtheestablishmentofcontrolsdesignedtoprovide
reasonableassurancethattheentitycomplieswiththoselawsandregulations.
4.30AICPAstandardsandGAGASrequireauditorstodesigntheaudittoprovidereasonableassurancethat
thefinancialstatementsarefreeofmaterialmisstatementsresultingfromviolationsoflawsandregulations
thathaveadirectandmaterialeffectonthedeterminationoffinancialstatementamounts.Tomeetthat
requirement,auditorsshouldhaveanunderstandingofinternalcontrolrelevanttofinancialstatement
assertionsaffectedbythoselawsandregulations.Auditorsshouldusethatunderstandingtoidentifytypesof
potentialmisstatements,considerfactorsthataffecttheriskofmaterialmisstatement,anddesignsubstantive
tests.Forexample,thefollowingfactorsmayinfluencetheauditors'assessmentofcontrolrisk:

1. management'sawarenessorlackofawarenessofapplicablelawsandregulations;
2. auditeepolicyregardingsuchmattersasacceptableoperatingpracticesandcodesofconduct;and
3. assignmentofresponsibilityanddelegationofauthoritytodealwithsuchmattersasorganizational
goalsandobjectives,operatingfunctions,andregulatoryrequirements.

4.31 Deleted
4.32 Deleted
4.33 Deleted

25

Government Auditing Standards

Working Papers
4.34AICPAstandardsandGAGASrequirethefollowing:
Arecordoftheauditors'workshouldberetainedintheformofworkingpapers.
4.35Theadditionalworkingpaperstandardforfinancialstatementauditsis:
Workingpapersshouldcontainsufficientinformationtoenableanexperiencedauditorhavingno
previousconnectionwiththeaudittoascertainfromthemtheevidencethatsupportstheauditors'
significantconclusionsandjudgments.

4.36 AuditsdoneinaccordancewithGAGASaresubjecttoreviewbyotherauditorsandbyoversight
officialsmorefrequentlythanauditsdoneinaccordancewithAICPAstandards.Thus,whereasAICPA
standardscitetwomainpurposesofworkingpapersprovidingtheprincipalsupportfortheauditreportand
aidingauditorsintheconductandsupervisionoftheauditworkingpapersserveanadditionalpurposein
auditsperformedinaccordancewithGAGAS.Workingpapersallowforthereviewofauditqualityby
providingthereviewerwrittendocumentationoftheevidencesupportingtheauditors'significantconclusions
andjudgments.

4.37 Workingpapersshouldcontain
1. theobjectives,scope,andmethodology,includinganysamplingcriteriaused;
2. documentationoftheworkperformedtosupportsignificantconclusionsandjudgments,including
descriptionsoftransactionsandrecordsexaminedthatwouldenableanexperiencedauditortoexaminethe
6

sametransactionsandrecords ;and

3. evidenceofsupervisoryreviewsoftheworkperformed.
[NOTE6:Auditorsmaymeetthisrequirementbylistingvouchernumbers,checknumbers,orothermeans
ofidentifyingspecificdocumentstheyexamined.Theyarenotrequiredtoincludeintheworkingpapers
copiesofdocumentstheyexaminednoraretheyrequiredtolistdetailedinformationfromthosedocuments.]
4.38OnefactorunderlyingGAGASauditsisthatfederal,state,andlocalgovernmentsandotherorganizations
cooperateinauditingprogramsofcommoninterestsothatauditorsmayuseothers'workandavoidduplicate
auditefforts.Arrangementsshouldbemadesothatworkingpaperswillbemadeavailable,uponrequest,to
otherauditors.Tofacilitatereviewsofauditqualityandreliancebyotherauditorsontheauditors'work,
contractualarrangementsforGAGASauditsshouldprovideforaccesstoworkingpapers.

Financial Related Audits

RevisedJuly1999

4.39CertainAICPAstandardsaddressspecifictypesoffinancialrelatedaudits,andGAGASincorporate
thosestandards,asdiscussedbelow:

a.SASNo.75,EngagementstoApplyAgreedUponProcedurestoSpecificElements,Accounts,orItemsof

aFinancialStatement;
26

Government Auditing Standards

2. SASNo.62,SpecialReports,forauditingspecifiedelements,accounts,oritemsofafinancialstatement;
3. SASNo.74,ComplianceAuditingConsiderationsinAuditsofGovernmentalEntitiesandRecipientsof
GovernmentalFinancialAssistance,fortestingcompliancewithlawsandregulationsapplicabletofederal
financialassistanceprograms;

4. SASNo.70,ReportsontheProcessingofTransactionsbyServiceOrganizations,forexamining
descriptionsofinternalcontrolofserviceorganizationsthatprocesstransactionsforothers;

5. StatementonStandardsforAttestationEngagements(SSAE)No.1,AttestationStandards,asamended
bySSAENo.9,AmendmentstoStatementonStandardsforAttestationEngagementsNos.1,2,and3,for
examiningorreviewinganentity'sassertionsaboutfinancialrelatedmattersnotspecificallyaddressedin
otherAICPAstandards;

6.SSAENo.2,ReportingonanEntity'sInternalControlOverFinancialReporting,asamendedbySSAENo.
9, AmendmentstoStatementonStandardsforAttestationEngagementsNos.1,2,and3,forexaminingan
entity'sassertionsaboutitsinternalcontroloverfinancialreportingand/orsafeguardingassets;

7. SSAENo.3,ComplianceAttestation,asamendedbySSAENo.9,AmendmentstoStatementonStandardsfor
AttestationEngagementsNos.1,2,and3,for(1)examiningorapplyingagreeduponprocedurestoanentity's
assertionsaboutcompliancewithspecifiedrequirementsor(2)applyingagreeduponprocedurestoanentity's
assertionsaboutinternalcontrolovercompliancewithlawsandregulations;and

8. SSAENo.4,AgreedUponProceduresEngagements,forapplyingagreeduponproceduresto(1)an
entitysassertionsaboutinternalcontroloverfinancialreportingand/orsafeguardingofassetsor(2)an
entitysassertionsaboutfinancialrelatedmattersnotspecificallyaddressedinotherAICPAstandards.
[NOTE7:GAGASincorporateanynewAICPAfieldworkstandardsrelevanttofinancialrelatedaudits
unlessGAOexcludesthembyformalannouncement.]
4.40BesidesfollowingapplicableAICPAstandards,auditorsshouldfollowthischapter'sauditfollowup
andworkingpaperstandards.Theyshouldapplyoradapttheotherstandardsandguidanceinthischapteras
appropriateinthecircumstances.Forfinancialrelatedauditsnotdescribedabove,auditorsshouldfollowthe
fieldworkstandardsforperformanceauditsinchapter6.

[NOTE8:Chapter2providesexamplesofothertypesoffinancialrelatedaudits.]

IfyouhavequestionsaboutGovernmentAuditingStandards,
sendemailto yellowbook@gao.gov.
Updated8/13/99

27

Chapter 5: Reporting Standards for Financial Audits

(RevisedthroughAmendment2)

Purpose
5.1Thischapterprescribesstandardsofreportingforfinancialaudits,whichincludefinancial
statementauditsandfinancialrelatedaudits

Relation to AICPA Standards

RevisedJuly1999

5.2Forfinancialstatementaudits,generallyacceptedgovernmentauditingstandards(GAGAS)incorporate
theAmericanInstituteofCertifiedPublicAccountants'(AICPA)fourgenerallyacceptedstandardsof
reporting,whichare:

1. Thereportshallstatewhetherthefinancialstatementsarepresentedinaccordancewithgenerallyaccepted
accountingprinciples.

2. Thereportshallidentifythosecircumstancesinwhichsuchprincipleshavenotbeenconsistentlyobserved
inthecurrentperiodinrelationtotheprecedingperiod.

3. Informativedisclosuresinthefinancialstatementsaretoberegardedasreasonablyadequateunless
otherwisestatedinthereport.

4. Thereportshalleithercontainanexpressionofopinionregardingthefinancialstatements,takenasa
whole,oranassertiontotheeffectthatanopinioncannotbeexpressed.Whenanoverallopinioncannotbe
expressed,thereasonsthereforshouldbestated.Inallcaseswhereanauditor'snameisassociatedwith
financialstatements,thereportshouldcontainaclearcutindicationofthecharacteroftheauditor'swork,
ifany,andthedegreeofresponsibilitytheauditoristaking.
5.3TheAICPAhasissuedstatementsonauditingstandards(SAS)thatinterpretitsstandardsofreporting.
ThischapterincorporatestheseSASsandprescribesadditionalstandardson

1. reportingcompliancewithGAGAS(seeparagraphs5.11through5.14),
2. reportingoncompliancewithlawsandregulationsandoninternalcontroloverfinancialreporting
(seeparagraphs5.15through5.28),

3. privilegedandconfidentialinformation(seeparagraphs5.29through5.31),and
4. reportdistribution.(Seeparagraphs5.32through5.35.)

28

Government Auditing Standards

[NOTE1:GAGASincorporateanynewAICPAreportingstandardsrelevanttofinancialstatementaudits
unlesstheGeneralAccountingOffice(GAO)excludesthembyformalannouncement.]

5.4 Thischapterconcludesbyexplainingwhichstandardsauditorsshouldfollowinreportingtheresultsof
financialrelatedaudits

5.5 Deleted
5.6 Deleted
5.7 Deleted
5.8 Deleted
5.9 Deleted
5.10 Deleted(Note2deleted)

Reporting Compliance with Generally Accepted

Government Standards
RevisedJuly1999

5.11Thefirstadditionalreportingstandardforfinancialstatementauditsis
Auditreportsshouldstatethattheauditwasmadeinaccordancewithgenerallyacceptedgovernment
auditingstandards.

5.12 Theabovestatementreferstoalltheapplicablestandardsthattheauditorsshouldhavefollowedduring
theiraudit.Thestatementshouldbequalifiedinsituationswheretheauditorsdidnotfollowanapplicable
standard.Inthesesituations,theauditorsshoulddisclosetheapplicablestandardthatwasnotfollowed,the
reasonstherefor,andhownotfollowingthestandardaffectedtheresultsoftheaudit.

5.13 Whenthereportonthefinancialstatementsissubmittedtocomplywithalegal,regulatory,or
contractualrequirementforaGAGASaudit,itshouldspecificallyciteGAGAS.Thereportonthefinancial
statementsmayciteAICPAstandardsaswellasGAGAS.

5.14 Theauditeemayneedafinancialstatementauditforpurposesotherthantocomplywithrequirements
callingforaGAGASaudit.Forexample,itmayneedafinancialstatementaudittoissuebonds.GAGASdo
notprohibitauditorsfromissuingaseparatereportonthefinancialstatementsconformingonlytothe
requirementsofAICPAstandards.However,itmaybeadvantageoustouseareportissuedinaccordance
withGAGASfortheseotherpurposesbecauseitprovidesinformationoncompliancewithlawsand
regulationsandinternalcontrols(asdiscussedbelow)thatisnotcontainedinareportissuedinaccordance
withAICPAstandards.
29

Government Auditing Standards

Reporting on Compliance with Laws and Regulations and

on Internal Control Over Financial Reporting
RevisedJuly1999

5.15Thesecondadditionalreportingstandardforfinancialstatementauditsis
Thereportonthefinancialstatementsshouldeither(1)describethescopeoftheauditors'testingof
compliancewithlawsandregulationsandinternalcontroloverfinancialreportingandpresentthe
resultsofthosetestsor(2)refertotheseparatereport(s)containingthatinformation.Inpresenting
theresultsofthosetests,auditorsshouldreportfraud,illegalacts,othermaterialnoncompliance,and
3

reportableconditionsininternalcontroloverfinancialreporting. Insomecircumstances,auditors
shouldreportfraudandillegalactsdirectlytopartiesexternaltotheauditedentity.
[NOTE3:TheseresponsibilitiesareinadditiontoanddonotmodifyauditorsresponsibilitiesunderAICPA
standardsto(1)addresstheeffectfraudorillegalactsmayhaveonthereportonthefinancialstatementsand
(2)determinethattheauditcommitteeorotherswithequivalentauthorityandresponsibilityareadequately
informedaboutfraud,illegalacts,andreportableconditions.]

5.16Auditorsmayreportoncompliancewithlawsandregulationsandinternalcontroloverfinancial
reportinginthereportonthefinancialstatementsorinseparatereport(s).Whenauditorsreporton
complianceandinternalcontroloverfinancialreportinginthereportonthefinancialstatements,theyshould
includeanintroductionsummarizingkeyfindingsintheauditofthefinancialstatementsandtherelated
complianceandinternalcontrolwork.Auditorsshouldnotissuethisintroductionasastandalonereport.
5.16.1Whenauditorsreportseparately(includingseparatereportsboundinthesamedocument)on
compliancewithlawsandregulationsandinternalcontroloverfinancialreporting,thereportonthefinancial
statementsshouldstatethattheyareissuingthoseadditionalreports.Thereportonthefinancialstatements
shouldalsostatethatthereportsoncompliancewithlawsandregulationsandinternalcontroloverfinancial
reportingareanintegralpartofaGAGASaudit,andinconsideringtheresultsoftheaudit,thesereports
shouldbereadalongwiththeauditors'reportonthefinancialstatements.

Scope of Compliance and Internal Control Work

5.17Auditorsshouldreportthescopeoftheirtestingofcompliancewithlawsandregulationsandofinternal
controloverfinancialreporting,includingwhetherornottheteststheyperformedprovidedsufficient
evidencetosupportanopiniononcomplianceorinternalcontroloverfinancialreportingandwhetherthe
auditorsareprovidingsuchopinions.

Fraud, Illegal Acts, and Other Noncompliance

5.18Whenauditorsconclude,basedonevidenceobtained,thatfraudoranillegalacteitherhasoccurredoris
4

likelytohaveoccurred, theyshouldreportrelevantinformation.Auditorsneednotreportinformationabout
fraudoranillegalactthatisclearlyinconsequential.Thus,auditorsshouldpresentinareportthesamefraud
andillegalactsthattheyreporttoauditcommitteesunderAICPAstandards.Auditorsshouldalsoreport
othernoncompliance(forexample,aviolationofacontractprovision)thatismaterialtothefinancial
statements.

[NOTE4:Whetheraparticularactis,infact,illegalmayhavetoawaitfinaldeterminationbyacourtoflaw.
30

Government Auditing Standards

Thus,whenauditorsdisclosemattersthathaveledthemtoconcludethatanillegalactislikelytohave
occurred,theyshouldtakecarenottoimplythattheyhavemadeadeterminationofillegality.]
5.19Inreportingmaterialfraud,illegalacts,orothernoncompliance,theauditorsshouldplacetheirfindings
inproperperspective.Togivethereaderabasisforjudgingtheprevalenceandconsequencesofthese
conditions,theinstancesidentifiedshouldberelatedtotheuniverseorthenumberofcasesexaminedandbe
5

quantifiedintermsofdollarvalue,ifappropriate. Inpresentingmaterialfraud,illegalacts,orother
noncompliance,auditorsshouldfollowchapter7'sreportcontentsstandardsforobjectives,scope,and
methodology;auditresults;viewsofresponsibleofficials;anditsreportpresentationstandards,as
appropriate.Auditorsmayprovidelessextensivedisclosureoffraudandillegalactsthatarenotmaterialin
eitheraquantitativeorqualitativesense.

[NOTE5:Auditfindingshaveoftenbeenregardedascontainingtheelementsofcriteria,condition,and
effect,pluscausewhenproblemsarefound.However,theelementsneededforafindingdependentirelyon
theobjectivesoftheaudit.Reportableconditionsandnoncompliancefoundbytheauditormaynotalways
havealloftheseelementsfullydeveloped,giventhescopeandobjectivesofthespecificfinancialaudit.
However,auditorsshouldidentifyatleastthecondition,criteria,andpossibleassertedeffecttoprovide
sufficientinformationtofederal,state,andlocalofficialstopermitthemtodeterminetheeffectandcause
inordertotakepromptandpropercorrectiveaction.]
[NOTE6:Chapter4providesguidanceonfactorsthatmayinfluenceauditors'materialityjudgmentsin
auditsofgovernmententitiesorentitiesreceivinggovernmentassistance.AICPAstandardsprovideguidance
ontheinteractionofquantitativeandqualitativeconsiderationsinmaterialityjudgments.]
5.20Whenauditorsdetectfraud,illegalacts,orothernoncompliancethatdonotmeetparagraph5.18's
criteriaforreporting,theyshouldcommunicatethosefindingstotheauditee,preferablyinwriting.If
auditorshavecommunicatedthosefindingsinamanagementlettertotopmanagement,theyshouldreferto
thatmanagementletterwhentheyreportoncompliance.Auditorsshoulddocumentintheirworkingpapers
allcommunicationstotheauditeeaboutfraud,illegalacts,andothernoncompliance.

Direct Reporting of Fraud and Illegal Acts

5.21GAGASrequireauditorstoreportfraudorillegalactsdirectlytopartiesoutsidetheauditeeintwo
circumstances,asdiscussedbelow.Theserequirementsareinadditiontoanylegalrequirementsfordirect
reportingoffraudorillegalacts.Auditorsshouldmeettheserequirementseveniftheyhaveresignedorbeen
dismissedfromtheaudit.

[NOTE7:Internalauditorsauditingwithintheentitythatemploysthemdonothaveadutytoreportoutside
thatentity.]

5.22 Theauditeemayberequiredbylaworregulationtoreportcertainfraudorillegalactstospecified
externalparties(forexample,toafederalinspectorgeneralorastateattorneygeneral).Ifauditorshave
communicatedsuchfraudorillegalactstotheauditee,anditfailstoreportthem,thentheauditorsshould
communicatetheirawarenessofthatfailuretotheauditee'sgoverningbody.Iftheauditeedoesnotmakethe
requiredreportassoonaspracticableaftertheauditors'communicationwithitsgoverningbody,thenthe
auditorsshouldreportthefraudorillegalactsdirectlytotheexternalpartyspecifiedinthelaworregulation.

5.23 Managementisresponsiblefortakingtimelyandappropriatestepstoremedyfraudorillegalactsthat
auditorsreporttoit.Whenfraudoranillegalactinvolvesassistancereceiveddirectlyorindirectlyfroma
governmentagency,auditorsmayhaveadutytoreportitdirectlyifmanagementfailstotakeremedialsteps.

31

Government Auditing Standards

Ifauditorsconcludethatsuchfailureislikelytocausethemtodepartfromthestandardreportonthe
financialstatementsorresignfromtheaudit,thentheyshouldcommunicatethatconclusiontothe
auditee'sgoverningbody.Then,iftheauditeedoesnotreportthefraudorillegalactassoonaspracticable
totheentitythatprovidedthegovernmentassistance,theauditorsshouldreportthefraudorillegalact
directlytothatentity.

5.24 Inbothofthesesituations,auditorsshouldobtainsufficient,competent,andrelevantevidence(for
example,byconfirmationwithoutsideparties)tocorroborateassertionsbymanagementthatithas
reportedfraudorillegalacts.Iftheyareunabletodoso,thentheauditorsshouldreportthefraudorillegal
actsdirectlyasdiscussedabove.

5.25 Chapter4remindsauditorsthatundersomecircumstances,laws,regulations,orpoliciesmayrequire
themtoreportpromptlyindicationsofcertaintypesoffraudorillegalactstolawenforcementor
investigatoryauthorities.Whenauditorsconcludethatthistypeoffraudorillegalacteitherhasoccurredor
islikelytohaveoccurred,theyshouldaskthoseauthoritiesand/orlegalcounselifreportingcertain
informationaboutthatfraudorillegalactwouldcompromiseinvestigativeorlegalproceedings.Auditors
shouldlimittheirreportingtomattersthatwouldnotcompromisethoseproceedings,suchasinformationthat
isalreadyapartofthepublicrecord.

Deficiencies in Internal Control

5.26Auditorsshouldreportdeficienciesininternalcontrolthattheyconsidertobe"reportableconditions"as
definedinAICPAstandards.Thefollowingareexamplesofmattersthatmaybereportableconditions:

1. absenceofappropriatesegregationofdutiesconsistentwithappropriatecontrolobjectives;
2. absenceofappropriatereviewsandapprovalsoftransactions,accountingentries,orsystemsoutput;
3. inadequateprovisionsforthesafeguardingofassets;
4. evidenceoffailuretosafeguardassetsfromloss,damage,ormisappropriation;
5. evidencethatasystemfailstoprovidecompleteandaccurateoutputconsistentwiththeauditee'scontrol
objectivesbecauseofthemisapplicationofcontrolprocedures;

6.evidenceofintentionaloverrideofinternalcontrolbythoseinauthoritytothedetrimentoftheoverall
objectivesofthesystem;

7. evidenceoffailuretoperformtasksthatarepartofinternalcontrol,suchasreconciliationsnotpreparedor
nottimelyprepared;

8. absenceofasufficientlevelofcontrolconsciousnesswithintheorganization;
9.

significantdeficienciesinthedesignoroperationofinternalcontrolthatcouldresultinviolations
oflawsandregulationshavingadirectandmaterialeffectonthefinancialstatements;and

10.

failuretofollowupandcorrectpreviouslyidentifieddeficienciesininternalcontrol.

[NOTE8:Chapter4'sauditfollowupstandardrequiresauditorstoreportthestatusofuncorrected
materialfindingsandrecommendationsfrompriorauditsthataffectthefinancialstatementaudit.]

32

Government Auditing Standards

5.27Inreportingreportableconditions,auditorsshouldidentifythosethatareindividuallyorcumulatively
9
materialweaknesses. Auditorsshouldfollowchapter7'sreportcontentsstandardsforobjectives,scope,
andmethodology;auditresults;andviewsofresponsibleofficials;anditsreportpresentationstandards,as
appropriate.
[NOTE9:Seefootnote5.]
5.28Whenauditorsdetectdeficienciesininternalcontrolthatarenotreportableconditions,theyshould
communicatethosedeficienciestotheauditee,preferablyinwriting.Iftheauditorshavecommunicated
otherdeficienciesininternalcontrolinamanagementlettertotopmanagement,theyshouldreferto
thatmanagementletterwhentheyreportoninternalcontrol.Allcommunicationstotheauditeeabout
deficienciesininternalcontrolshouldbedocumentedintheworkingpapers.

Privileged and Confidential Information

RevisedJuly1999

5.29Thethirdadditionalreportingstandardforfinancialstatementauditsis
Ifcertaininformationisprohibitedfromgeneraldisclosure,theauditreportshouldstatethenature
oftheinformationomittedandtherequirementthatmakestheomissionnecessary.

5.30 Certaininformationmaybeprohibitedfromgeneraldisclosurebyfederal,state,orlocallawsor
regulations.Suchinformationmaybeprovidedonaneedtoknowbasisonlytopersonsauthorizedbylawor
regulationtoreceiveit.

5.31 Ifsuchrequirementsprohibitauditorsfromincludingpertinentdatainthereport,theyshouldstatethe
natureoftheinformationomittedandtherequirementthatmakestheomissionnecessary.Theauditors
shouldobtainassurancethatavalidrequirementfortheomissionexistsand,whenappropriate,consultwith
legalcounsel.

Report Distribution
RevisedJuly1999

5.32Thefourthadditionalreportingstandardforfinancialstatementauditsis
Writtenauditreportsaretobesubmittedbytheauditorganizationtotheappropriateofficialsofthe
auditeeandtotheappropriateofficialsoftheorganizationsrequiringorarrangingfortheaudits,
includingexternalfundingorganizations,unlesslegalrestrictionspreventit.Copiesofthereports
shouldalsobesenttootherofficialswhohavelegaloversightauthorityorwhomayberesponsiblefor
actingonauditfindingsandrecommendationsandtoothersauthorizedtoreceivesuchreports.Unless
restrictedbylaworregulation,copiesshouldbemadeavailableforpublicinspection.

10

[NOTE10:SeetheSingleAuditActAmendmentsof1996andOfficeofManagementandBudget(OMB)
CircularA133forthedistributionofreportsonsingleauditsofstateandlocalgovernmentalentitiesand
nonprofitorganizationsthatreceivefederalawards.]

33

Government Auditing Standards

5.33 Auditreportsshouldbedistributedinatimelymannertoofficialsinterestedintheresults.Suchofficials
includethosedesignatedbylaworregulationtoreceivesuchreports,thoseresponsibleforactingonthe
findingsandrecommendations,thoseofotherlevelsofgovernmentthathaveprovidedassistancetothe
auditee,andlegislators.However,ifthesubjectoftheauditinvolvesmaterialthatisclassifiedforsecurity
purposesornotreleasabletoparticularpartiesorthepublicforothervalidreasons,auditorsmaylimitthe
reportdistribution.

5.34 Whenpublicaccountantsareengaged,theengagingorganizationshouldensurethatthereportis
distributedappropriately.Ifthepublicaccountantsaretomakethedistribution,theengagementagreement
shouldindicatewhichofficialsororganizationsshouldreceivethereport.

5.35 Internalauditorsshouldfollowtheirentity'sownarrangementsandstatutoryrequirementsfor
distribution.Usually,theyreporttotheirentity'stopmanagers,whoareresponsiblefordistributionofthe
report.

Financial Related Audits

RevisedJuly1999

5.36CertainAICPAstandardsaddressspecifictypesoffinancialrelatedaudits,andGAGASincorporate
thosestandards,asdiscussedbelow:

11

1. SASNo.75,EngagementstoApplyAgreedUponProcedurestoSpecificElements,Accounts,orItemsof
a
FinancialStatement;

2. SASNo.62,SpecialReports,forauditingspecifiedelements,accounts,oritemsofafinancialstatement;
3. SASNo.74,ComplianceAuditingConsiderationsinAuditsofGovernmentalEntitiesandRecipientsof
GovernmentalFinancialAssistance,fortestingcompliancewithlawsandregulationsapplicabletofederal
financialassistanceprograms;

4. SASNo.70,ReportsontheProcessingofTransactionsbyServiceOrganizations,forexamining
descriptionsofinternalcontrolofserviceorganizationsthatprocesstransactionsforothers;

5. StatementonStandardsforAttestationEngagements(SSAE)No.1,AttestationStandards,asamended
bySSAENo.9,AmendmentstoStatementonStandardsforAttestationEngagementsNos.1,2,and3,for
examiningorreviewinganentity'sassertionsaboutfinancialrelatedmattersnotspecificallyaddressedin
otherAICPAstandards;

6.SSAENo.2,ReportingonanEntity'sInternalControlOverFinancialReporting,asamendedbySSAENo.
9, AmendmentstoStatementonStandardsforAttestationEngagementsNos.1,2,and3,forexaminingan
entity'sassertionsaboutitsinternalcontroloverfinancialreportingand/orsafeguardingassets;

7. SSAENo.3,ComplianceAttestation,asamendedbySSAENo.9,AmendmentstoStatementonStandardsfor
AttestationEngagementsNos.1,2,and3,for(1)examiningorapplyingagreeduponprocedurestoanentity's
assertionsaboutcompliancewithspecifiedrequirementsor(2)applyingagreeduponprocedurestoanentity's
assertionsaboutinternalcontrolovercompliancewithlawsandregulations;and

8. SSAENo.4,AgreedUponProceduresEngagements,forapplyingagreeduponproceduresto(1)an

34

Government Auditing Standards

entitysassertionsaboutinternalcontroloverfinancialreportingand/orsafeguardingofassetsor(2)an
entitysassertionsaboutfinancialrelatedmattersnotspecificallyaddressedinotherAICPAstandards.
[NOTE11:GAGASincorporateanynewAICPAreportingstandardsrelevanttofinancialrelatedaudits
unlessGAOexcludesthembyformalannouncement.]
5.37BesidesfollowingapplicableAICPAstandards,auditorsshouldfollowthischapter'sfirst(GAGAS
reference),third(privilegedandconfidentialinformation),andfourth(reportdistribution)additional
standardsofreporting.Theyshouldapplyoradapttheotherstandardsandguidanceinthischapteras
appropriateinthecircumstances.Forfinancialrelatedauditsnotdescribedabove,auditorsshouldfollowthe
reportingstandardsforperformanceauditsinchapter7.

12

[NOTE12:Chapter2providesexamplesofothertypesoffinancialrelatedaudits.]

IfyouhavequestionsaboutGovernmentAuditingStandards,
sendemailto yellowbook@gao.gov.
Updated8/13/99

35

Chapter 6: Field Work Standards for Performance

Audits
Purpose
6.1Thischapterprescribesfieldworkstandardsforperformanceaudits.Thesestandardsalsoapplytosome
financialrelatedaudits,asdiscussedinchapter4.

Planning
6.2Thefirstfieldworkstandardforperformanceauditsis:
Workistobeadequatelyplanned.
6.3Inplanning,auditorsshoulddefinetheaudit'sobjectivesandthescopeandmethodologytoachievethose
objectives.Theobjectivesarewhattheauditistoaccomplish.Theyidentifytheauditsubjectsand
performanceaspectstobeincluded,aswellasthepotentialfindingandreportingelementsthattheauditors
1
2
expecttodevelop. Auditobjectivescanbethoughtofasquestionsabouttheprogram thatauditorsseekto
answer.Scopeistheboundaryoftheaudit.Itaddressessuchthingsastheperiodandnumberoflocationsto
becovered.Themethodologycomprisestheworkindatagatheringandinanalyticalmethodsauditorswill
dotoachievetheobjectives.
[NOTE1:Seediscussionoftheelementsofafindinginparagraphs6.49through6.52.]
[NOTE2:Generallyacceptedgovernmentauditingstandards(GAGAS)arestandardsforauditof
governmentorganizations,programs,activities,andfunctions.Thischapterusesonlytheterm"program";
however,theconceptspresentedalsoapplytoauditsoforganizations,activities,andfunctions.]

6.4 Auditorsshoulddesignthemethodologytoprovidesufficient,competent,andrelevantevidenceto
achievetheobjectivesoftheaudit.Methodologyincludesnotonlythenatureoftheauditors'procedures,but
alsotheirextent(forexample,samplesize).

6.5 Inplanningaperformanceaudit,auditorsshould:
1. Considersignificanceandtheneedsofpotentialusersoftheauditreport.(Seeparagraphs6.7and6.8.)
2. Obtainanunderstandingoftheprogramtobeaudited.(Seeparagraphs6.9and6.10.)
3. Considerlegalandregulatoryrequirements.(Seeparagraphs6.26through6.38.)
4. Considermanagementcontrols.(Seeparagraphs6.39through6.45.)
5. Identifycriterianeededtoevaluatematterssubjecttoaudit.(Seeparagraph6.11.)

36

Government Auditing Standards

6.Identifysignificantfindingsandrecommendationsfrompreviousauditsthatcouldaffectthecurrentaudit
objectives.Auditorsshoulddetermineifmanagementhascorrectedtheconditionscausingthosefindingsand
implementedthoserecommendations.(Seeparagraphs6.12and6.13.)

7. Identifypotentialsourcesofdatathatcouldbeusedasauditevidenceandconsiderthevalidityand
reliabilityofthesedata,includingdatacollectedbytheauditedentity,datageneratedbytheauditors,ordata
providedbythirdparties.(Seeparagraphs6.53through6.62.)

8. Consider whether the work of other auditors and experts may be used to satisfy some of the
auditors'objectives.(Seeparagraphs6.14through6.16.)

9.

Providesufficientstaffandotherresourcestodotheaudit.(Seeparagraphs6.17and6.18.)

10.

Prepareawrittenauditplan.(Seeparagraphs6.19through6.21.)

6.6Planningshouldcontinuethroughouttheaudit.Auditobjectives,scope,andmethodologiesarenot
determinedinisolation.Auditorsdeterminethesethreeelementsoftheauditplantogether,asthe
considerationsindeterminingeachoftenoverlap.

Significance and User Needs

6.7Auditorsshouldconsidersignificanceinplanning,performing,andreportingonperformanceaudits.The
significanceofamatterisitsrelativeimportancetotheauditobjectivesandpotentialusersoftheaudit
report.Qualitative,aswellasquantitative,factorsareimportantindeterminingsignificance.Qualitative
factorscaninclude

1. visibilityandsensitivityoftheprogramunderaudit,
2. newnessoftheprogramorchangesinitsconditions,
3. roleoftheauditinprovidinginformationthatcanimprovepublicaccountabilityanddecisionmaking,and
4. levelandextentofrevieworotherformsofindependentoversight.
6.8Onegroupofusersoftheauditors'reportisgovernmentofficialswhomayhaveauthorizedorrequested
theaudit.Anotherimportantuseroftheauditors'reportistheauditee,whichisresponsibleforactingonthe
auditors'recommendations.Otherpotentialusersoftheauditors'reportincludegovernmentofficials(other
thanthosewhomayhaveauthorizedorrequestedtheaudit),themedia,interestgroups,andindividual
citizens.Theseotherpotentialusersmayhave,inadditiontoaninterestintheprogram,anabilityto
influencetheconductoftheprogram.Thus,anawarenessofthesepotentialusers'interestsandinfluencecan
helpauditorsunderstandwhytheprogramoperatesthewayitdoes.Thisawarenesscanalsohelpauditors
judgewhetherpossiblefindingscouldbesignificanttotheseotherusers.

Understanding the Program

6.9AAuditorsshouldobtainanunderstandingoftheprogramtobeauditedtohelpassess,amongother
matters,thesignificanceofpossibleauditobjectivesandthefeasibilityofachievingthem.Theauditors'
understandingmaycomefromknowledgetheyalreadyhaveabouttheprogramandknowledgetheygain
frominquiriesandobservationstheymakeinplanningtheaudit.Theextentandbreadthofthoseinquiries

andobservationswillvaryamongaudits,aswilltheneedtounderstandindividualaspectsoftheprogram,
37

Government Auditing Standards

suchasthefollowing.

1. Lawsandregulations:Governmentprogramsusuallyarecreatedbylawandaresubjecttomorespecific
lawsandregulationsthantheprivatesector.Forexample,lawsandregulationsusuallysetforthwhatistobe
done,whoistodoit,thepurposetobeachieved,thepopulationtobeserved,andhowmuchcanbespenton
what.Thus,understandingthelawsestablishingaprogramcanbeessentialtounderstandingtheprogram
itself.Obtainingthatunderstandingmayalsobeanecessarystepinidentifyingprovisionsoflawsand
regulationssignificanttoauditobjectives.

2. Purposeandgoals:Purposeistheresultoreffectthatisintendedordesired,andcanexistwithoutbeing
expresslystated.Goalsquantifythelevelofperformanceintendedordesired.Legislaturessettheprogram
purposewhentheyestablishaprogram;however,managementisexpectedtosetgoalsforprogramefforts,
operations,outputs,andoutcomes.Auditorsmayusethepurposeandgoalsascriteriaforassessingprogram
performance.

3. Efforts:Effortsaretheamountofresources(intermsofmoney,material,personnel,andsoforth)thatare
putintoaprogram.Theseresourcesmaycomefromwithinoroutsidetheentityoperatingtheprogram.
Measuresofeffortscanhaveanumberofdimensions,suchascost,timing,andquality.Examplesof
measuresofeffortsaredollars,employeehours,andsquarefeetofbuildingspace.

4. Programoperations:Programoperationsarethestrategies,processes,andactivitiestheauditeeusesto
converteffortsintooutputs.Programoperationsaresubjecttomanagementcontrols,whicharediscussed
laterinthischapter.

5. Outputs:Outputsarethequantityofgoodsandservicesprovided.Examplesofmeasuresofoutputaretons
ofsolidwasteprocessed,numberofstudentsgraduated,andnumberofstudentsgraduatedwhohavemet
1 specifiedstandardofachievement.

6.Outcomes:Outcomesareaccomplishmentsorresultsthatoccur(atleastpartially)becauseofservices
provided.Outcomescanbeviewedasrangingfromimmediateoutcomestolongtermoutcomes.For
example,animmediateoutcomeofajobtrainingprogramandanindicatorofitseffectivenessmightbethe
numberofprogramgraduatesplacedinjobs.Thatprogram'sultimateoutcomeandtestofitseffectiveness
dependsonwhetherprogramgraduatesaremorelikelytoremainemployedthansimilarpersonsnotinthe
program.Outcomesmaybeintendedorunintended,andtheymaybeinfluencedbycultural,economic,
physical,ortechnologicalfactorsexternaltotheprogram.Auditorsmayuseapproachesdrawnfromthefield
ofprogramevaluationtoisolatetheeffectsoftheprogramfromthoseofotherinfluences.
6.10Oneapproachtosettingauditobjectivesistorelatetheelementsofaprogramtothetypesof
performanceauditsdiscussedinchapter2.Forexample,auditsconcernedwitheconomycouldfocuson
efforts:Wereresourcesobtainedatanoptimalcostandatanappropriatelevelofquality?Auditsconcerned
withefficiencycouldfocusontheprogramoperationsortherelationshipbetweenefforts(resourcesused)
andeitheroutputsoroutcomestodeterminethecostperunitofoutputoroutcome.Programauditscouldbe
concernedwithdeterminingwhetherprogramoutcomesmetspecifiedgoalsorwhetheroutcomeswerebetter
thantheywouldhavebeenwithouttheprogram.Anytypeofperformanceauditcouldencompassprogram
operationsifauditorsarelookingforreasonswhytheprogramwassuccessfulornot.

Criteria
6.11Criteriaarethestandardsusedtodeterminewhetheraprogrammeetsorexceedsexpectations.Criteria
provideacontextforunderstandingtheresultsoftheaudit.Theauditplan,wherepossible,shouldstatethe

38

Government Auditing Standards

criteriatobeused.Inselectingcriteria,auditorshavearesponsibilitytousecriteriathatarereasonable,
attainable,andrelevanttothemattersbeingaudited.Thefollowingaresomeexamplesofpossiblecriteria:

1. purposeorgoalsprescribedbylaworregulationorsetbymanagement,
2. technicallydevelopedstandardsornorms,
3. expertopinions,
4. prioryears'performance,
5. performanceofsimilarentities,and
6.

performanceintheprivatesector.

Audit Follow-Up
6.12 Auditorsshouldfollowuponsignificantfindingsandrecommendationsfrompreviousauditsthat
couldaffecttheauditobjectives.Theyshoulddothistodeterminewhethertimelyandappropriatecorrective
actionshavebeentakenbyauditeeofficials.Theauditreportshoulddisclosethestatusofuncorrected
significantfindingsandrecommendationsfrompriorauditsthataffecttheauditobjectives.

6.13 Muchofthebenefitfromauditworkisnotinthefindingsreportedortherecommendationsmade,butin
theireffectiveresolution.Auditeemanagementisresponsibleforresolvingauditfindingsand
recommendations,andhavingaprocesstotracktheirstatuscanhelpitfulfillthisresponsibility.If
managementdoesnothavesuchaprocess,auditorsmaywishtoestablishtheirown.Continuedattentionto
significantfindingsandrecommendationscanhelpauditorsassurethatthebenefitsoftheirworkarerealized.

Considering Others' Work

6.14 Auditorsshoulddetermineifotherauditorshavepreviouslydone,oraredoing,auditsoftheprogramor
theentitythatoperatesit.Whetherotherauditorshavedoneperformanceauditsorfinancialaudits,theymay
beusefulsourcesofinformationforplanningandperformingtheaudit.Ifotherauditorshaveidentifiedareas
thatwarrantfurtherstudy,theirworkmayinfluencetheauditors'selectionofobjectives.Theavailabilityof
otherauditors'workmayalsoinfluencetheselectionofmethodology,astheauditorsmaybeabletorelyon
thatworktolimittheextentoftheirowntesting.

6.15 Ifauditorsintendtorelyontheworkofotherauditors,theyshouldperformproceduresthatprovidea
3

sufficientbasisforthatreliance.Auditorscanobtainevidenceofotherauditors'qualifications and
independencethroughpriorexperience,inquiry,and/orreviewoftheotherauditors'externalqualitycontrol
reviewreport.Auditorscandeterminethesufficiency,relevance,andcompetenceofotherauditors'evidence
byreviewingtheirreport,auditprogram,orworkingpapers,and/ormakingsupplementaltestsoftheirwork.
Thenatureandextentofevidenceneededwilldependonthesignificanceoftheotherauditors'workandon
whethertheauditorswillrefertothatworkintheirreport.
[NOTE3:Auditorsfromanothercountryengagedtoconductauditsintheircountryshouldmeetthe
professionalqualificationstopracticeunderthatcountry'slawsandregulationsorotheracceptablestandards,
suchasthoseissuedbytheInternationalOrganizationofSupremeAuditInstitutions.Alsoseethe
InternationalFederationofAccountants'InternationalStandardsonAuditing.]

39

Government Auditing Standards

6.16Auditorsfacesimilarconsiderationswhenrelyingontheworkofnonauditors(consultants,experts,
specialists,andsoforth).Inaddition,auditorsshouldobtainanunderstandingofthemethodsandsignificant
assumptionsusedbythenonauditors.

Staff and Other Resources

6.17Staffplanningshouldinclude:

1. Assigningstaffwiththeappropriateskillsandknowledgeforthejob.
2. Assigninganadequatenumberofexperiencedstaffandsupervisorstotheaudit.Consultantsshouldbe
usedwhennecessary.

3. Providingforonthejobtrainingofstaff.
6.18Theavailabilityofstaffandotherresourcesisanimportantconsiderationinestablishingtheobjectives,
scope,andmethodology.Forexample,limitationsontravelfundsmayprecludeauditorsfromvisiting
certainlocations,orlackofexpertiseinaparticularmethodologymayprecludeauditorsfromundertaking
certainobjectives.Auditorsmaybeabletoovercomesuchlimitationsbyuseofstafffromlocalofficesorby
engagingconsultantswiththenecessaryexpertise.

Written Audit Plan

6.19 Awrittenauditplanshouldbepreparedforeachaudit.Theformandcontentofthewrittenauditplan
willvaryamongaudits.Theplanshouldincludeanauditprogramoramemorandumorotherappropriate
documentationofkeydecisionsabouttheauditobjectives,scope,andmethodologyandoftheauditors'basis
forthosedecisions.Itshouldbeupdated,asnecessary,toreflectanysignificantchangestotheplanmade
duringtheaudit.

6.20 Documentingtheauditplanisanopportunityfortheauditorstoreviewtheworkdoneinplanningthe
audittodeterminewhether

1. theproposedauditobjectivesarelikelytoresultinausefulreport,
2. theproposedauditscopeandmethodologyareadequatetosatisfytheauditobjectives,and
3. sufficientstaffandotherresourceshavebeenmadeavailabletoperformtheaudit.
6.21Writtenauditplansmayinclude:

1. Informationaboutthelegalauthorityfortheauditedprogram,itshistoryandcurrentobjectives,its
principallocations,andotherbackgroundthatcanhelpauditorsunderstandandcarryouttheauditplan.

2. Informationabouttheresponsibilitiesofeachauditteam(suchaspreparingauditprograms,conducting
auditwork,supervisingauditwork,draftingreports,handlingauditeecomments,andprocessingthefinal
report),whichcanhelpauditorswhentheworkisconductedatseveraldifferentlocations.Intheseaudits,
useofcomparableauditmethodsandprocedurescanhelpmakethedataobtainedfromparticipating
locationscomparable.

3. Auditprogramsdescribingprocedurestoaccomplishtheauditobjectivesandprovidingasystematicbasis

40

Government Auditing Standards

forassigningworktostaffandforsummarizingtheworkperformed.
d.Thegeneralformatoftheauditreportandthetypesofinformationtobeincluded,whichcanhelpauditors
focustheirfieldworkontheinformationtobereported.

Supervision
6.22Thesecondfieldworkstandardforperformanceauditsis:
Staffaretobeproperlysupervised.
4

6.23Supervisioninvolvesdirectingtheeffortsofauditorsandothers whoareinvolvedintheauditto
determinewhethertheauditobjectivesarebeingaccomplished.Elementsofsupervisionincludeinstructing
staffmembers,keepinginformedofsignificantproblemsencountered,reviewingtheworkperformed,and
providingeffectiveonthejobtraining.
[NOTE4:Othersinvolvedinaccomplishingtheobjectivesoftheauditincludeexternalconsultants
andspecialists.]

6.24 Supervisorsshouldsatisfythemselvesthatstaffmembersclearlyunderstandwhatworktheyaretodo,
whytheworkistobeconducted,andwhatitisexpectedtoaccomplish.Withexperiencedstaff,supervisors
mayoutlinethescopeoftheworkandleavedetailstoassistants.Withalessexperiencedstaff,supervisors
mayhavetospecifynotonlytechniquesforanalyzingdatabutalsohowtogatherit.

6.25 Thenatureofthereviewofauditworkmayvarydependingonthesignificanceoftheworkorthe
experienceofthestaff.Forexample,itmaybeappropriatetohaveexperiencedstaffauditorsreviewmuchof
theworkofotherstaffwithsimilarexperience.

Compliance with Laws and Regulations

6.26Thethirdfieldworkstandardforperformanceauditsis:
Whenlaws,regulations,andothercompliancerequirementsaresignificanttoauditobjectives,
auditorsshoulddesigntheaudittoprovidereasonableassuranceaboutcompliancewiththem.Inall
performanceaudits,auditorsshouldbealerttosituationsortransactionsthatcouldbeindicativeof
illegalactsorabuse.
6.27Thefollowingparagraphselaborateontherequirementsofthisstandard.Theyalsodiscussways
auditorsobtaininformationaboutlaws,regulations,andothercompliancerequirements;andthelimitations
ofperformanceauditingindetectingillegalactsandabuse.

Illegal Acts and Other Noncompliance

6.28Auditorsshoulddesigntheaudittoprovidereasonableassuranceaboutcompliancewithlawsand
regulationsthataresignificanttoauditobjectives.Thisrequiresdeterminingiflawsandregulationsare
5
significanttotheauditobjectivesand,iftheyare,assessingtheriskthatsignificantillegalactscouldoccur.
Basedonthatriskassessment,theauditorsdesignandperformprocedurestoprovidereasonableassuranceof

detectingsignificantillegalacts.

41

Government Auditing Standards

[NOTE5:Illegalactsareviolationsoflawsorregulations.]
6.29Itisnotpracticaltosetprecisestandardsfordeterminingiflawsandregulationsaresignificanttoaudit
objectivesbecausegovernmentprogramsaresubjecttosomanylawsandregulations,andauditobjectivesvary
widely.However,auditorsmayfindthefollowingapproachhelpfulinmakingthatdetermination:

1. Reduceeachauditobjectivetoquestionsaboutspecificaspectsoftheprogrambeingaudited(thatis,
purposeandgoals,efforts,programoperations,outputs,andoutcomes,asdiscussedinparagraph6.9).

2. Identifylawsandregulationsthatdirectlyaddressspecificaspectsoftheprogramincludedinthe
auditobjectives'questions.

3. Determineifviolationsofthoselawsandregulationscouldsignificantlyaffecttheauditors'answerstothe
questionsencompassedintheauditobjectives.Iftheycould,thenthoselawsandregulationsarelikelytobe
significanttotheauditobjectives.
6.30Thefollowingareexamplesoftypesoflawsandregulationsthatcanbesignificanttotheobjectives
ofeconomyandefficiencyauditsandofprogramaudits.
a.Economyandefficiency:Lawsandregulationsthatcouldsignificantlyaffecttheacquisition,protection,
anduseoftheentity'sresources,andthequantity,quality,timeliness,andcostoftheproductsandservicesit
producesanddelivers.
b.Program:Lawsandregulationspertainingtothepurposeoftheprogram,themannerinwhichitistobe
delivered,andthepopulationitistoserve.

6.31 Inplanningtestsofcompliancewithsignificantlawsandregulations,auditorsassesstheriskthatillegal
actscouldoccur.Thatriskmaybeaffectedbysuchfactorsasthecomplexityofthelawsandregulationsor
theirnewness.Theauditors'assessmentofriskincludesconsiderationofwhethertheentityhascontrolsthat
areeffectiveinpreventingordetectingillegalacts.Managementisresponsibleforestablishingeffective
controlstoensurecompliancewithlawsandregulations.Ifauditorsobtainsufficientevidenceofthe
effectivenessofthesecontrols,theycanreducetheextentoftheirtestsofcompliance.

6.32 Auditorsshouldbealerttosituationsortransactionsthatcouldbeindicativeofillegalacts.When
informationcomestotheauditors'attention(throughauditprocedures,tips,orothermeans)indicatingthat
illegalactsmayhaveoccurred,auditorsshouldconsiderwhetherthepossibleillegalactscouldsignificantly
affecttheauditresults.Iftheycould,theauditorsshouldextendtheauditstepsandprocedures,asnecessary,
(1)todetermineiftheillegalactshaveorarelikelytohaveoccurredand(2)ifso,todeterminetheireffecton
theauditresults.

6.33 Auditorsshouldexercisedueprofessionalcareinpursuingindicationsofpossibleillegalactssoasnot
tointerferewithpotentialinvestigations,legalproceedings,orboth.Undersomecircumstances,laws,
regulations,orpoliciesrequireauditorstoreportindicationsofcertaintypesofillegalactstolawenforcement
orinvestigatoryauthoritiesbeforeextendingauditstepsandprocedures.Auditorsmayalsoberequiredto
withdrawfromordeferfurtherworkontheauditoraportionoftheauditinordernottointerferewithan
investigation.

6.34 Thetermnoncompliancehasabroadermeaningthanillegalacts.Noncomplianceincludesnotonlyillegal
acts,butalsoviolationsofprovisionsofcontractsorgrantagreements.Likeillegalacts,theseothertypesof
noncompliancecanbesignificanttoauditobjectives.Theauditors'considerationsinplanningandperformingtests
ofcompliancewithprovisionsofcontractsorgrantagreementsaresimilartothosediscussed

42

Government Auditing Standards

inparagraphs6.28through6.33.

Abuse
6.35Abuseisdistinctfromillegalactsandothernoncompliance.Whenabuseoccurs,nolaw,regulation,
contractprovision,orgrantagreementisviolated.Rather,theconductofagovernmentprogramfallsfar
shortofsocietalexpectationsforprudentbehavior.Auditorsshouldbealerttosituationsortransactionsthat
couldbeindicativeofabuse.Wheninformationcomestotheauditors'attention(throughauditprocedures,
tips,orothermeans)indicatingthatabusemayhaveoccurred,auditorsshouldconsiderwhetherthepossible
abusecouldsignificantlyaffecttheauditresults.Ifitcould,theauditorsshouldextendtheauditstepsand
procedures,asnecessary,(1)todetermineiftheabuseoccurredand(2)ifso,todetermineitseffectonthe
auditresults.However,becausethedeterminationofabuseissosubjective,auditorsarenotexpectedto
providereasonableassuranceofdetectingit.

Obtaining Information About Laws, Regulations, and Other Compliance

Requirements
6.36Auditors'training,experience,andunderstandingoftheprogrambeingauditedmayprovideabasisfor
recognitionthatsomeactscomingtotheirattentionmaybeillegal.Whetheranact,infact,isillegalisa
determinationnormallybeyondauditors'professionalcapacity.However,auditorsareresponsibleforbeing
6
awareofvulnerabilitiestofraud associatedwiththeareabeingauditedinordertobeabletoidentify
indicationsthatfraudmayhaveoccurred.Insomecircumstances,conditionssuchasthefollowingmight
indicateaheightenedriskoffraud:

1. Auditeesofferunreasonableexplanationstotheauditors'inquiries.
2. Auditeesareannoyedatreasonablequestionsbyauditors.
3. Auditeesrefusetoproviderecords.
4. Auditeesrefusetotakevacationsoracceptpromotions.
[NOTE6:Fraudisatypeofillegalactinvolvingtheobtainingofsomethingofvaluethrough
willfulmisrepresentation.]
6.37Auditorsmayfinditnecessarytorelyontheworkoflegalcounselin(1)determiningthoselawsand
regulationsthataresignificanttotheauditobjectives,(2)designingtestsofcompliancewithlawsand
7
regulations,and(3)evaluatingtheresultsofthosetests. Auditorsalsomayfinditnecessarytorelyonthe
workoflegalcounselwhenauditobjectivesrequiretestingcompliancewithprovisionsofcontractsorgrant
agreements.Dependingonthecircumstancesoftheaudit,auditorsmayfinditnecessarytoobtain
informationoncompliancemattersfromothers,suchasinvestigativestaff,auditofficialsofother
governmententitiesthatprovidedassistancetotheauditee,ortheapplicablelawenforcementauthority.
[NOTE7:Paragraphs6.14through6.16discussrelyingontheworkofothers.]

Limitations of An Audit
6.38Anauditmadeinaccordancewiththesestandardsprovidesreasonableassurancethatitsobjectives
havebeenachieved;itdoesnotguaranteethediscoveryofillegalactsorabuse.Nordoesthesubsequent

43

Government Auditing Standards

discoveryofillegalactsorabusecommittedduringtheauditperiodnecessarilymeanthattheauditors'
performancewasinadequate,providedtheauditwasmadeinaccordancewiththesestandards.

Management Controls
6.39Thefourthfieldworkstandardforperformanceauditsis:
Auditorsshouldobtainanunderstandingofmanagementcontrolsthatarerelevanttotheaudit.When
managementcontrolsaresignificanttoauditobjectives,auditorsshouldobtainsufficientevidenceto
supporttheirjudgmentsaboutthosecontrols.

6.40 Managementisresponsibleforestablishingeffectivemanagementcontrols.Thelackofadministrative
continuityingovernmentunitsbecauseofcontinuingchangesinelectedlegislativebodiesandin
administrativeorganizationsincreasestheneedforeffectivemanagementcontrols.

6.41 Managementcontrols,inthebroadestsense,includetheplanoforganization,methods,andprocedures
adoptedbymanagementtoensurethatitsgoalsaremet.Managementcontrolsincludetheprocessesfor
planning,organizing,directing,andcontrollingprogramoperations.Theyincludethesystemsformeasuring,
reporting,andmonitoringprogramperformance.Thefollowingclassificationofmanagementcontrolsis
intendedtohelpauditorsfocusonunderstandingmanagementcontrolsandindeterminingtheirsignificance
totheauditobjectives.
a.Programoperations:Controlsoverprogramoperationsincludepoliciesandproceduresthatmanagement
hasimplementedtoreasonablyensurethataprogrammeetsitsobjectives.Understandingthesecontrolscan
helpauditorsunderstandtheprogramoperationsthatconverteffortstooutputs.
b.Validityandreliabilityofdata:Controlsoverthevalidityandreliabilityofdataincludepoliciesand
proceduresthatmanagementhasimplementedtoreasonablyensurethatvalidandreliabledataareobtained,
maintained,andfairlydisclosedinreports.Thesecontrolshelpassuremanagementthatitisgettingvalidand
reliableinformationaboutwhetherprogramsareoperatingproperly.Understandingthesecontrolscanhelp
auditors(1)assesstheriskthatthedatagatheredbytheentitymaynotbevalidandreliableand(2)design
appropriatetestsofthedata.
c.Compliancewithlawsandregulations:Controlsovercompliancewithlawsandregulationsinclude
policiesandproceduresthatmanagementhasimplementedtoreasonablyensurethatresourceuseis
consistentwithlawsandregulations.Understandingthecontrolsrelevanttocompliancewiththoselawsand
regulationsthattheauditorshavedeterminedaresignificantcanhelpauditorsassesstheriskofillegalacts.
d.Safeguardingresources:Controlsoverthesafeguardingofresourcesincludepoliciesandproceduresthat
managementhasimplementedtoreasonablyensurethatresourcesaresafeguardedagainstwaste,loss,and
misuse.Understandingthesecontrolscanhelpauditorsplaneconomyandefficiencyaudits.
6.42Auditorscanobtainanunderstandingofmanagementcontrolsthroughinquiries,observations,
inspectionofdocumentsandrecords,orreviewofotherauditors'reports.Theproceduresauditorsperformto
obtainanunderstandingofmanagementcontrolswillvaryamongaudits.Onefactorinfluencingtheextentof
theseproceduresistheauditors'knowledgeaboutmanagementcontrolsgainedinprioraudits.Also,theneed
tounderstandmanagementcontrolswilldependontheparticularaspectsoftheprogramtheauditorsconsider
insettingobjectives,scope,andmethodology.Thefollowingareexamplesofhowtheauditors'
understandingofmanagementcontrolscaninfluencetheauditplan.

44

Government Auditing Standards

a.Objectives:Poorlycontrolledaspectsofaprogramhavehigherriskoffailure,sotheymaybemore
significantthanothersintermsofwhereauditorswouldwanttofocustheirefforts.
b.Scope:Poorcontrolsinacertainlocationmayleadauditorstotargettheireffortsthere.
c.Methodology:Effectivecontrolsovercollecting,summarizing,andreportingdatamayenableauditorsto
limittheextentoftheirdirecttestingofdatavalidityandreliability.Incontrast,poorcontrolsmaylead
auditorstoperformmoredirecttestingofthedata,lookfordatafromoutsidetheentity,ordeveloptheirown
data.
6.43Theneedtotestmanagementcontrolsdependsontheirsignificancetotheauditobjectives.The
followingareexamplesofcircumstanceswheremanagementcontrolscanbesignificanttoauditobjectives:

1. Indeterminingthecauseofunsatisfactoryperformanceifthatunsatisfactoryperformancecouldresultfrom
weaknessesinspecificmanagementcontrols.

2. Whenassessingthevalidityandreliabilityofperformancemeasuresdevelopedbytheauditedentity.
Effectivemanagementcontrolsovercollecting,summarizing,andreportingdatawillhelpensurevalidand
reliableperformancemeasures.

6.44 Internalauditingisanimportantpartofmanagementcontrol.Whenanassessmentofmanagement
controlsiscalledfor,theworkoftheinternalauditorscanbeusedtohelpprovidereasonableassurancethat
managementcontrolsarefunctioningproperlyandtopreventduplicationofeffort.

6.45 Consideringthewidevarietyofgovernmentprograms,nosinglepatternforinternalauditactivitiescan
bespecified.Manygovernmententitieshavetheseactivitiesidentifiedbyothernames,suchasinspection,
appraisal,investigation,organizationandmethods,ormanagementanalysis.Theseactivitiesassist
managementbyreviewingselectedfunctions.

Evidence
6.46Thefifthfieldworkstandardforperformanceauditsis:
Sufficient,competent,andrelevantevidenceistobeobtainedtoaffordareasonablebasisfortheauditors'
findingsandconclusions.Arecordoftheauditors'workshouldberetainedintheformofworkingpapers.
Workingpapersshouldcontainsufficientinformationtoenableanexperiencedauditorhavingnoprevious
connectionwiththeaudittoascertainfromthemtheevidencethatsupportstheauditors'significant
conclusionsandjudgments.

[NOTE8:Thenatureofthisdocumentationwillvarywiththenatureoftheworkperformed.Forexample,
whenthisworkincludesexaminationofauditeerecords,theworkingpapersshoulddescribethoserecordsso
thatanexperiencedauditorwouldbeabletoexaminethosesamerecords.Auditorsmaymeetthis
requirementbylistingfilenumbers,casenumbers,orothermeansofidentifyingspecificdocumentsthey
examined.Theyarenotrequiredtoincludeintheworkingpaperscopiesofdocumentstheyexamined,nor
aretheyrequiredtolistdetailedinformationfromthosedocuments.]
6.47Evidencemaybecategorizedasphysical,documentary,testimonial,andanalytical.Physicalevidenceis
obtainedbyauditors'directinspectionorobservationofpeople,property,orevents.Suchevidencemaybe
documentedinmemoranda,photographs,drawings,charts,maps,orphysicalsamples.Documentary

45

Government Auditing Standards

evidenceconsistsofcreatedinformationsuchasletters,contracts,accountingrecords,invoices,and
managementinformationonperformance.Testimonialevidenceisobtainedthroughinquiries,interviews,or
questionnaires.Analyticalevidenceincludescomputations,comparisons,separationofinformationinto
components,andrationalarguments.
6.48Theguidanceinthefollowingparagraphsisintendedtohelpauditorsjudgethequalityandquantityof
evidenceneededtosatisfyauditobjectives.Paragraphs6.49through6.52describetheelementsofanaudit
finding.Paragraphs6.53through6.62provideguidancetohelpauditorsdeterminewhatconstitutes
sufficient,competent,andrelevantevidencetosupporttheirfindingsandconclusions.Finally,paragraphs
6.63through6.65provideguidanceonhowtodocumentthatevidence.

Audit Findings
6.49Auditfindingsoftenhavebeenregardedascontainingtheelementsofcriteria,condition,andeffect,
pluscausewhenproblemsarefound.However,theelementsneededforafindingdependentirelyonthe
objectivesoftheaudit.Thus,afindingorsetoffindingsiscompletetotheextentthattheauditobjectivesare
satisfiedandthereportclearlyrelatesthoseobjectivestothefinding'selements.Criteriaarediscussedin
paragraph6.11;theotherelementsofafindingcondition,effect,andcausearediscussedinthefollowing
paragraphs.
6.50Conditionisasituationthatexists.Ithasbeendeterminedanddocumentedduringtheaudit.
6.51Effectastwomeanings,whichdependontheauditobjectives.Whentheauditors'objectivesinclude
identifyingtheactualorpotentialconsequencesofaconditionthatvaries(eitherpositivelyornegatively)
fromthecriteriaidentifiedintheaudit,"effect"isameasureofthoseconsequences.Auditorsoftenuseeffect
inthissensetodemonstratetheneedforcorrectiveactioninresponsetoidentifiedproblems.Whenthe
auditors'objectivesincludeestimatingtheextenttowhichaprogramhascausedchangesinphysical,social,
oreconomicconditions,"effect"isameasureoftheimpactachievedbytheprogram.Here,effectisthe
extenttowhichpositiveornegativechangesinactualphysical,social,oreconomicconditionscanbe
identifiedandattributedtoprogramoperations.
6.52Likeeffect,causealsohastwomeanings,whichdependontheauditobjectives.Whentheauditors'
objectivesincludeexplainingwhythepoor(orgood)performancedeterminedintheaudithappened,the
reasonsforthatperformancearereferredtoas"cause."Identifyingthecauseofproblemscanassistauditors
inmakingconstructiverecommendationsforcorrection.Becauseproblemscanresultfromanumberof
plausiblefactors,therecommendationcanbemorepersuasiveifauditorscanclearlydemonstrateand
explainwithevidenceandreasoningthelinkbetweentheproblemsandthefactororfactorstheyidentified
asthecause.Whentheauditors'objectivesincludeestimatingtheprogram'seffectonchangesinphysical,
social,oreconomicconditions,theyseekevidenceoftheextenttowhichtheprogramitselfisthe"cause"of
thosechanges.

Tests of Evidence
6.53Evidenceshouldbesufficient,competent,andrelevant.Evidenceissufficientifthereisenoughofitto
supporttheauditors'findings.Indeterminingthesufficiencyofevidenceitmaybehelpfultoasksuch
questionsas:Isthereenoughevidencetopersuadeareasonablepersonofthevalidityofthefindings?When
appropriate,statisticalmethodsmaybeusedtoestablishsufficiency.Evidenceusedtosupportafindingis
relevantifithasalogical,sensiblerelationshiptothatfinding.Evidenceiscompetenttotheextentthatitis
consistentwithfact(thatis,evidenceiscompetentifitisvalid).

46

Government Auditing Standards

6.54Thefollowingpresumptionsareusefulinjudgingthecompetenceofevidence.However,these
presumptionsarenottobeconsideredsufficientinthemselvestodeterminecompetence.

1. Evidenceobtainedfromacrediblethirdpartyismorecompetentthanthatsecuredfromtheauditee.
2. Evidencedevelopedunderaneffectivesystemofmanagementcontrolsismorecompetentthanthat
obtainedwheresuchcontrolsareweakornonexistent.

3. Evidenceobtainedthroughtheauditors'directphysicalexamination,observation,computation,
andinspectionismorecompetentthanevidenceobtainedindirectly.

4. Originaldocumentsprovidemorecompetentevidencethandocopies.
5. Testimonialevidenceobtainedunderconditionswherepersonsmayspeakfreelyismorecompetent
thantestimonialevidenceobtainedundercompromisingconditions(forexample,wherethepersonsmay
beintimidated).

6.Testimonialevidenceobtainedfromanindividualwhoisnotbiasedorhascompleteknowledgeaboutthe
areaismorecompetentthantestimonialevidenceobtainedfromanindividualwhoisbiasedorhasonly
partialknowledgeaboutthearea.

6.55 Auditorsmayfinditusefultoobtainfromofficialsoftheauditeewrittenrepresentationsconcerning
thecompetenceoftheevidencetheyobtain.Writtenrepresentationsordinarilyconfirmoralrepresentations
giventoauditors,indicateanddocumentthecontinuingappropriatenessofsuchrepresentations,andreduce
thepossibilityofmisunderstandingconcerningthemattersthatarethesubjectoftherepresentations.

6.56 Theauditors'approachtodeterminingthesufficiency,competence,andrelevanceofevidencedepends
onthesourceoftheinformationthatconstitutestheevidence.Informationsourcesincludeoriginaldata
gatheredbyauditorsandexistingdatagatheredbyeithertheauditeeorathirdparty.Datafromanyofthese
sourcesmaybeobtainedfromcomputerbasedsystems.
6.57DataGatheredbyAuditors.Datagatheredbyauditorsincludetheauditors'ownobservationsand
measurements.Amongthemethodsforgatheringthistypeofdataarequestionnaires,structuredinterviews,
directobservations,andcomputations.Thedesignofthesemethodsandtheskilloftheauditorsapplying
themarethekeystoensuringthatthesedataconstitutesufficient,competent,andrelevantevidence.When
thesemethodsareappliedtodeterminecause,auditorsareconcernedwitheliminatingrivalexplanations.
6.58DataGatheredbytheAuditee.Auditorscanusedatagatheredbytheauditeeaspartoftheirevidence.
Auditorsmaydeterminethevalidityandreliabilityofthesedatabydirecttestsofthedata.Auditorscan
reducethedirecttestsofthedataiftheytesttheeffectivenessoftheentity'scontrolsoverthevalidityand
reliabilityofthedata,andthesetestssupporttheconclusionthatthecontrolsareeffective.Thenatureand
extentoftestingofthedatawilldependonthesignificanceofthedatatosupportauditors'findings.
6.59Whentheauditors'testsofdatadiscloseerrorsinthedata,orwhentheyareunabletoobtainsufficient,
competent,andrelevantevidenceaboutthevalidityandreliabilityofthedata,theymayfinditnecessaryto

1. seekevidencefromothersources,
2. redefinetheaudit'sobjectivestoeliminatetheneedtousethedata,or
3. usethedata,butclearlyindicateintheirreportthedata'slimitationsandrefrainfrommakingunwarranted

47

Government Auditing Standards

conclusionsorrecommendations.
6.60DataGatheredbyThirdParties.Theauditors'evidencemayalsoincludedatagatheredbythirdparties.
Insomecases,thesedatamayhavebeenauditedbyothers,ortheauditorsmaybeabletoauditthedata
themselves.Inothercases,however,itwillnotbepracticaltoobtainevidenceofthedata'svalidityand
reliability.

6.61 How the use of unaudited thirdparty data affects the auditors' report depends on the data's
significancetotheauditors'findings.

6.62 ValidityandReliabilityofDataFromComputerBasedSystems.Auditorsshouldobtainsufficient,

competent,andrelevantevidencethatcomputerprocesseddataarevalidandreliablewhenthosedataare
9
significanttotheauditors'findings. Thisworkisnecessaryregardlessofwhetherthedataareprovidedto
10

auditorsorauditorsindependentlyextractthem. Auditorsshoulddetermineifotherauditorshaveworked
toestablishthevalidityandreliabilityofthedataortheeffectivenessofthecontrolsoverthesystemthat
producedthedata.Iftheyhave,auditorsmaybeabletousethatwork.Ifnot,auditorsmaydeterminethe
validityandreliabilityofcomputerprocesseddatabydirecttestsofthedata.Auditorscanreducethedirect
testsofthedataiftheytesttheeffectivenessofgeneralandapplicationcontrolsovercomputerprocessed
11
data,andthesetestssupporttheconclusionthatthecontrolsareeffective.
[NOTE9:Whenthereliabilityofacomputerbasedsystemistheprimaryobjectiveoftheaudit,theauditors
shouldconductareviewofthesystem'sgeneralandapplicationcontrols.]
[NOTE10:Whencomputerprocesseddataareusedbytheauditor,orincludedinthereport,forbackground
orinformationalpurposesandarenotsignificanttotheauditors'findings,citingthesourceofthedataand
statingthattheywerenotverifiedwillsatisfythereportingstandardsforaccuracyandcompletenesssetforth
inthisstatement.]
[NOTE11:AGAOguide,AssessingtheReliabilityofComputerBasedData(GAO/OP8.1.3,September
1990),providesguidanceonthefollowingkeysteps:1)determininghowcomputerbaseddatawillbeused
andhowtheywillaffecttheauditobjectives,(2)findingoutwhatisknownaboutthedataandthesystemthat
producedthem,(3)obtaininganunderstandingofrelevantsystemcontrols,whichcanreducerisktoan
acceptablelevel,(4)testingthedataforreliability,and(5)disclosingthedatasourceandhowdatareliability
wasestablishedorqualifyingthereportifdatareliabilitycouldnotbeestablished.]

Working Papers
6.63 Workingpapersservethreepurposes.Theyprovidetheprincipalsupportfortheauditors'report,aidthe
auditorsinconductingandsupervisingtheaudit,andallowotherstoreviewtheaudit'squality.Thisthird
purposeisimportantbecauseauditsdoneinaccordancewithGAGASoftenaresubjecttoreviewbyother
auditorsandbyoversightofficials.Workingpapersallowforthereviewofauditqualitybyprovidingthe
reviewerwrittendocumentationoftheevidencesupportingtheauditors'significantconclusionsand
judgments.

6.64 Workingpapersshouldcontain
1. theobjectives,scope,andmethodology,includinganysamplingcriteriaused;
2. documentationoftheworkperformedtosupportsignificantconclusionsandjudgments;and
48

Government Auditing Standards

c.evidenceofsupervisoryreviewoftheworkperformed.
6.65OnefactorunderlyingGAGASauditsisthatfederal,state,andlocalgovernmentsandother
organizationscooperateinauditingprogramsofcommoninterestsothatauditorsmayuseothers'workand
avoidduplicateauditefforts.Arrangementsshouldbemadesothatworkingpaperswillbemadeavailable,
uponrequest,tootherauditors.Tofacilitatereviewsofauditqualityandreliancebyotherauditorsonthe
auditors'work,contractualarrangementsforGAGASauditsshouldprovideforaccesstoworkingpapers.
Auditorganizationsshouldalsoestablishreasonablepoliciesandproceduresforthesafecustodyand
retentionofworkingpapersforatimesufficienttosatisfylegalandadministrativerequirements.

IfyouhavequestionsaboutGovernmentAuditingStandards,
sendemailto yellowbook@gao.gov.
Updated8/13/99

49

Chapter 7: Reporting Standards for Performance

Audits
Purpose
7.1Thischapterprescribesstandardsofreportingforperformanceaudits.Thereport"contents"and
"presentation"standardsalsoapplytosomefinancialrelatedaudits,asdiscussedinchapter5.

Form
7.2Thefirstreportingstandardforperformanceauditsis:
Auditorsshouldpreparewrittenauditreportscommunicatingtheresultsofeachaudit.
7.3Writtenreports(1)communicatetheresultsofauditstoofficialsatalllevelsofgovernment,(2)makethe
resultslesssusceptibletomisunderstanding,(3)maketheresultsavailableforpublicinspection,and(4)
facilitatefollowuptodeterminewhetherappropriatecorrectiveactionshavebeentaken.Theneedto
maintainpublicaccountabilityforgovernmentprogramsdemandsthatauditreportsbewritten.

[NOTE1:Auditreportsmaybepresentedonothermediathatareretrievablebyreportusersandtheaudit
organization.Retrievableauditreportsincludethosewhichareinelectronicorvideoformats.]

7.4 Thisstandardisnotintendedtolimitorpreventdiscussionoffindings,judgments,conclusions,and
recommendationswithpersonswhohaveresponsibilitiesinvolvingtheareabeingaudited.Onthecontrary,
suchdiscussionsareencouraged.

7.5 Whenanauditisterminatedpriortocompletion,auditorsshouldcommunicatetheterminationtothe
auditeeandotherappropriateofficials,preferablyinwriting.Auditorsshouldalsowriteamemorandumfor
therecord,summarizingtheresultsoftheworkandexplainingwhytheauditwasterminated.

Timeliness
7.6Thesecondreportingstandardforperformanceauditsis:
Auditorsshouldappropriatelyissuethereportstomaketheinformationavailablefortimelyuseby
management,legislativeofficials,andotherinterestedparties.

7.7 Tobeofmaximumuse,thereportmustbetimely.Acarefullypreparedreportmaybeoflittlevalueto
decisionmakersifitarrivestoolate.Therefore,auditorsshouldplanfortheappropriateissuanceoftheaudit
reportandconducttheauditwiththisgoalinmind.

7.8 Theauditorsshouldconsiderinterimreporting,duringtheaudit,ofsignificantmatterstoappropriate

50

Government Auditing Standards

officials.Suchcommunication,whichmaybeoralorwritten,isnotasubstituteforafinalreport,butitdoes
alertofficialstomattersneedingimmediateattentionandpermitsthemtocorrectthembeforethefinalreport
iscompleted.

Report Contents
7.9Thethirdreportingstandardforperformanceauditscoversthereportcontents.

Objectives, Scope, and Methodology

7.10Auditorsshouldreporttheauditobjectivesandtheauditscopeandmethodology.
7.11Knowledgeoftheobjectivesoftheaudit,aswellasoftheauditscopeandmethodologyforachieving
theobjectives,isneededbyreaderstounderstandthepurposeoftheaudit,judgethemeritsoftheaudit
workandwhatisreported,andunderstandsignificantlimitations.
Objectives

7.12 Inreportingtheaudit'sobjectives,auditorsshouldexplainwhytheauditwasmadeandstatewhatthe
reportistoaccomplish.Articulatingwhatthereportistoaccomplishnormallyinvolvesidentifyingtheaudit
subjectandtheaspectofperformanceexamined,andbecausewhatisreporteddependsontheobjectives,
communicatingwhatfindingelementsarediscussedandwhetherconclusionsandrecommendationsare
given.

7.13 Toprecludemisunderstandingincaseswheretheobjectivesareparticularlylimitedandbroader
objectivescanbeinferred,itmaybenecessarytostateobjectivesthatwerenotpursued.
Scope and Methodology

7.14 Inreportingthescopeoftheaudit,auditorsshoulddescribethedepthandcoverageofworkconducted
toaccomplishtheaudit'sobjectives.Auditorsshould,asapplicable,explaintherelationshipbetweenthe
universeandwhatwasaudited;identifyorganizations,geographiclocations,andtheperiodcovered;report
thekindsandsourcesofevidence;andexplainanyqualityorotherproblemswiththeevidence.Auditors
shouldalsoreportsignificantconstraintsimposedontheauditapproachbydatalimitationsorscope
impairments.

7.15 Toreportthemethodologyused,auditorsshouldclearlyexplaintheevidencegatheringandanalysis
techniquesused.Thisexplanationshouldidentifyanysignificantassumptionsmadeinconductingtheaudit;
describeanycomparativetechniquesapplied;describethecriteriaused;andwhensamplingsignificantly
supportsauditors'findings,describethesampledesignandstatewhyitwaschosen.

7.16 Auditorsshouldattempttoavoidmisunderstandingbythereaderconcerningtheworkthatwasandwas
notdonetoachievetheauditobjectives,particularlywhentheworkwaslimitedbecauseofconstraintson
timeorresources.

Audit Results

7.17Auditorsshouldreportsignificantauditfindings,andwhereapplicable,auditors'conclusions.
51

Government Auditing Standards

Findings
2

7.18Auditorsshouldreportthesignificantfindingsdevelopedinresponsetoeachauditobjective. In
reportingthefindings,auditorsshouldincludesufficient,competent,andrelevantinformationtopromote
adequateunderstandingofthemattersreportedandtoprovideconvincingbutfairpresentationsinproper
perspective.Auditorsshouldalsoreportappropriatebackgroundinformationthatreadersneedtounderstand
thefindings.
[NOTE2:Auditfindingsnotincludedintheauditreport,becauseofinsignificance,shouldbeseparately
communicatedtotheauditee,preferablyinwriting.Suchfindings,whencommunicatedinamanagement
lettertotopmanagement,shouldbereferredtointheauditreport.Allcommunicationsofauditfindings
shouldbedocumentedintheworkingpapers.]
7.19Auditfindingsoftenhavebeenregardedascontainingtheelementsofcriteria,condition,andeffect,
3
pluscausewhenproblemsarefound. However,theelementsneededforafindingdependentirelyonthe
objectivesoftheaudit.Thus,afindingorsetoffindingsiscompletetotheextentthattheauditobjectives
aresatisfiedandthereportclearlyrelatesthoseobjectivestothefinding'selements.
[NOTE3:Seedescriptionoftheelementsofafindinginparagraphs6.49through6.52.]
Conclusions
7.20Auditorsshouldreportconclusionswhencalledforbytheauditobjectives.Conclusionsarelogical
inferencesabouttheprogrambasedontheauditors'findings.Conclusionsshouldbespecifiedandnotleftto
beinferredbyreaders.Thestrengthoftheauditors'conclusionsdependsonthepersuasivenessofthe
evidencesupportingthefindingsandtheconvincingnessofthelogicusedtoformulatetheconclusions.

Recommendations
7.21Auditorsshouldreportrecommendationsforactionstocorrectproblemareasandtoimprove
operations.

7.22 Auditorsshouldreportrecommendationswhenthepotentialforsignificantimprovementinoperations
andperformanceissubstantiatedbythereportedfindings.Recommendationstoeffectcompliancewithlaws
andregulationsandimprovemanagementcontrolsshouldalsobemadewhensignificantinstancesof
noncompliancearenotedorsignificantweaknessesincontrolsarefound.Auditorsshouldalsoreportthe
statusofuncorrectedsignificantfindingsandrecommendationsfrompriorauditsthataffecttheobjectivesof
thecurrentaudit.

7.23 Constructiverecommendationscanencourageimprovementsintheconductofgovernmentprograms.
Recommendationsaremostconstructivewhentheyaredirectedatresolvingthecauseofidentified
problems,areactionorientedandspecific,areaddressedtopartiesthathavetheauthoritytoact,arefeasible,
and,totheextentpractical,arecosteffective.

Statement on Auditing Standards

7.24Auditorsshouldreportthattheauditwasmadeinaccordancewithgenerallyacceptedgovernment
auditingstandards.
7.25Thestatementofcompliancewithgenerallyacceptedgovernmentauditingstandardsreferstoallthe

52

Government Auditing Standards

applicablestandardsthattheauditorsshouldhavefollowedduringtheaudit.Thestatementshouldbe
qualifiedinsituationsinwhichtheauditorsdidnotfollowanapplicablestandard.Inthesesituations,auditors
shouldreportinthescopesectiontheapplicablestandardthatwasnotfollowed,thereasonstherefor,and
hownotfollowingthestandardaffectedtheresultsoftheaudit.

Compliance With Laws and Regulations

7.26Auditorsshouldreportallsignificantinstancesofnoncomplianceandallsignificantinstancesof
abusethatwerefoundduringorinconnectionwiththeaudit.Insomecircumstances,auditorsshould
reportillegalactsdirectlytopartiesexternaltotheauditedentity.
Noncompliance and Abuse
7.27Whenauditorsconclude,basedonevidenceobtained,thatsignificantnoncomplianceorabuseeitherhas
occurredorislikelytohaveoccurred,theyshouldreportrelevantinformation.Theterm"noncompliance"
4
comprisesillegalacts(violationsoflawsandregulations) andviolationsofprovisionsofcontractsorgrant
agreements.Abuseoccurswhentheconductofagovernmentorganization,program,activity,orfunction
fallsfarshortofsocietalexpectationsforprudentbehavior.
[NOTE4:Whetheraparticularactis,infact,illegalmayhavetoawaitfinaldeterminationbyacourtof
law.Thus,whenauditorsdisclosemattersthathaveledthemtoconcludethatanillegalactislikelytohave
occurred,theyshouldtakecarenottoimplythattheyhavemadeadeterminationofillegality.]

7.28 Inreportingsignificantinstancesofnoncompliance,auditorsshouldplacetheirfindingsinperspective.
Togivethereaderabasisforjudgingtheprevalenceandconsequencesofnoncompliance,theinstancesof
noncomplianceshouldberelatedtotheuniverseorthenumberofcasesexaminedandbequantifiedinterms
ofdollarvalue,ifappropriate.

7.29 Whenauditorsdetectnonsignificantinstancesofnoncompliancetheyshouldcommunicatethemtothe
auditee,preferablyinwriting.Iftheauditorshavecommunicatedsuchinstancesofnoncomplianceina
managementlettertotopmanagement,theyshouldrefertothatmanagementletterintheauditreport.
Auditorsshoulddocumentintheirworkingpapersallcommunicationstotheauditeeaboutnoncompliance.
Direct Reporting of Illegal Acts
7.30Auditorsareresponsibleforreportingillegalactsdirectlytopartiesoutsidetheauditeeincertain
circumstances,asdiscussedinthefollowingparagraphs.Auditorsshouldfulfilltheseresponsibilitiesevenif
theyhaveresignedorbeendismissedfromtheaudit.

[NOTE5:Internalauditorsauditingwithintheentitythatemploysthemdonothaveadutytoreportoutside
thatentity.]

7.31 Theauditeemayberequiredbylaworregulationtoreportcertainillegalactstospecifiedexternal
parties(forexample,toafederalinspectorgeneralorastateattorneygeneral).Ifauditorshave
communicatedsuchillegalactstotheauditee,anditfailstoreportthem,thentheauditorsshould
communicatetheirawarenessofthatfailuretotheauditee'sgoverningbody.Iftheauditeedoesnotmakethe
requiredreportassoonaspracticalaftertheauditors'communicationwithitsgoverningbody,thenthe
auditorsshouldreporttheillegalactsdirectlytotheexternalpartyspecifiedinthelaworregulation.

7.32 Auditorsshouldobtainsufficient,competent,andrelevantevidence(forexample,byconfirmationwith

53

Government Auditing Standards

outsideparties)tocorroborateassertionsbymanagementthatithasreportedillegalacts.Iftheyareunableto
doso,thentheauditorsshouldreporttheillegalactsdirectlyasdiscussedabove.
7.33Chapter6remindsauditorsthatundersomecircumstances,laws,regulations,orpoliciesmayrequire
themtoreportpromptlyindicationsofcertaintypesofillegalactstolawenforcementorinvestigatory
authorities.Whenauditorsconcludethatthistypeofillegalacteitherhasoccurredorislikelytohave
occurred,theyshouldaskthoseauthoritiesand/orlegalcounselifreportingcertaininformationaboutthat
illegalactwouldcompromiseinvestigativeorlegalproceedings.Auditorsshouldlimittheirreportingto
mattersthatwouldnotcompromisethoseproceedings,suchasinformationthatisalreadyapartofthepublic
record.

Management Controls
7.34Auditorsshouldreportthescopeoftheirworkonmanagementcontrolsandanysignificant
weaknessesfoundduringtheaudit.

7.35 Reportingonmanagementcontrolswillvarydependingonthesignificanceofanyweaknessesfound
andtherelationshipofthoseweaknessestotheauditobjectives.

7.36 Inauditswherethesoleobjectiveistoauditthemanagementcontrols,weaknessesfoundofsignificance
towarrantreportingwouldbeconsidereddeficienciesandbesoidentifiedintheauditreport.The
managementcontrolsthatwereassessedshouldbeidentifiedtotheextentnecessarytoclearlypresentthe
objectives,scope,andmethodologyoftheaudit.

7.37 Inaperformanceaudit,auditorsmayidentifysignificantweaknessesinmanagementcontrolsasacause
ofdeficientperformance.Inreportingthistypeoffinding,thecontrolweaknesseswouldbedescribedasthe
"cause."

Views of Responsible Officials

7.38 Auditorsshouldreporttheviewsofresponsibleofficialsoftheauditedprogramconcerning
auditors'findings,conclusions,andrecommendations,aswellascorrectionsplanned.

7.39 Oneofthemosteffectivewaystoensurethatareportisfair,complete,andobjectiveistoobtain
advancereviewandcommentsbyresponsibleauditeeofficialsandothers,asmaybeappropriate.Including
theviewsofresponsibleofficialsproducesareportthatshowsnotonlywhatwasfoundandwhattheauditors
thinkaboutitbutalsowhattheresponsiblepersonsthinkaboutitandwhattheyplantodoaboutit.

7.40 Auditorsshouldnormallyrequestthattheresponsibleofficials'viewsonsignificantfindings,
conclusions,andrecommendationsbesubmittedinwriting.When,inthesecases,writtencommentsarenot
obtained,oralcommentsshouldberequested.

7.41 Advancecommentsshouldbeobjectivelyevaluatedandrecognized,asappropriate,inthereport.
Advancecomments,suchasapromiseorplanforcorrectiveaction,shouldbenotedbutshouldnotbe
acceptedasjustificationfordroppingasignificantfindingorarelatedrecommendation.

7.42 Whenthecommentsopposethereport'sfindings,conclusions,orrecommendations,andarenot,inthe
auditors'opinion,valid,theauditorsmaychoosetostatetheirreasonsforrejectingthem.Conversely,the
auditorsshouldmodifytheirreportiftheyfindthecommentsvalid.

54

Government Auditing Standards

Noteworthy Accomplishments
7.43 Auditorsshouldreportnoteworthyaccomplishments,particularlywhenmanagement
improvementsinoneareamaybeapplicableelsewhere.

7.44 Noteworthymanagementaccomplishmentsidentifiedduringtheaudit,whichwerewithinthescopeof
theaudit,shouldbeincludedintheauditreportalongwithdeficiencies.Suchinformationprovidesamore
fairpresentationofthesituationbyprovidingappropriatebalancetothereport.Inaddition,inclusionofsuch
accomplishmentsmayleadtoimprovedperformancebyothergovernmentorganizationsthatreadthereport.

Issues Needing Further Study

7.45 Auditorsshouldrefersignificantissuesneedingfurtherauditworktotheauditorsresponsible
forplanningfutureauditwork.

7.46 If,duringtheaudit,auditorsidentifysignificantissuesthatwarrantfurtherwork,buttheissuesarenot
directlyrelatedtotheauditobjectivesortheauditorsdonothavethetimeorresourcestoexpandtheauditto
pursuethem,theyshouldrefertheissuestotheauditorswithintheauditorganizationwhoareresponsiblefor
planningfutureauditwork.Whenappropriate,auditorsshouldalsodisclosetheissuesinthereportandthe
reasonstheissuesneedfurtherstudy.

Privileged and Confidential Information

7.47 Ifcertaininformationisprohibitedfromgeneraldisclosure,auditorsshouldreportthenatureof
theinformationomittedandtherequirementthatmakestheomissionnecessary.

7.48 Certaininformationmaybeprohibitedfromgeneraldisclosurebyfederal,state,orlocallawsor
regulations.Suchinformationmaybeprovidedonaneedtoknowbasisonlytopersonsauthorizedbylawor
regulationtoreceiveit.

7.49 Ifsuchrequirementsprohibitauditorsfromincludingpertinentinformationinthereport,theyshould
statethenatureoftheinformationomittedandtherequirementthatmakestheomissionnecessary.The
auditorsshouldobtainassurancethatavalidrequirementfortheomissionexists,and,whenappropriate,
consultwithlegalcounsel.

Report Presentation
7.50Thefourthreportingstandardforperformanceauditsis:
Thereportshouldbecomplete,accurate,objective,convincing,andasclearandconciseasthesubject
permits.

Complete
7.51Beingcompleterequiresthatthereportcontainallinformationneededtosatisfytheauditobjectives,
promoteanadequateandcorrectunderstandingofthemattersreported,andmeetthereportcontent

requirements.Italsomeansincludingappropriatebackgroundinformation.
55

Government Auditing Standards

7.52 Givingreadersanadequateandcorrectunderstandingmeansprovidingperspectiveontheextent
andsignificanceofreportedfindings,suchasthefrequencyofoccurrencerelativetothenumberofcases
ortransactionstestedandtherelationshipofthefindingstotheentity'soperations.

7.53 Inmostcases,asingleexampleofadeficiencyisnotsufficienttosupportabroadconclusionora
relatedrecommendation.Allthatitsupportsisthatadeviation,anerror,oraweaknessexisted.However,
exceptasnecessarytomakeconvincingpresentations,detailedsupportingdataneednotbeincluded.

Accurate
7.54 Accuracyrequiresthattheevidencepresentedbetrueandthatfindingsbecorrectlyportrayed.Theneed
foraccuracyisbasedontheneedtoassurereadersthatwhatisreportediscredibleandreliable.One
inaccuracyinareportcancastdoubtonthevalidityofanentirereportandcandivertattentionfromthe
substanceofthereport.Also,inaccuratereportscandamagethecredibilityoftheissuingauditorganization
andreducetheeffectivenessofitsreports.

7.55 Thereportshouldincludeonlyinformation,findings,andconclusionsthataresupportedbycompetent
andrelevantevidenceintheauditors'workingpapers.Ifdataaresignificanttotheauditfindingsand
conclusions,butarenotaudited,theauditorsshouldclearlyindicateintheirreportthedata'slimitations
andnotmakeunwarrantedconclusionsorrecommendationsbasedonthosedata.

7.56 Reportedevidenceshoulddemonstratethecorrectnessandreasonablenessofthemattersreported.
Correctportrayalmeansdescribingaccuratelytheauditscopeandmethodology,andpresentingfindings
andconclusionsinamannerconsistentwiththescopeofauditwork.

Objective
7.57 Objectivityrequiresthatthepresentationoftheentirereportbebalancedincontentandtone.Areport's
credibilityissignificantlyenhancedwhenitpresentsevidenceinanunbiasedmannersothatreaderscanbe
persuadedbythefacts.

7.58 Theauditreportshouldbefairandnotmisleading,andshouldplacetheauditresultsinperspective.
Thismeanspresentingtheauditresultsimpartiallyandguardingagainstthetendencytoexaggerateor
overemphasizedeficientperformance.Indescribingshortcomingsinperformance,auditorsshouldpresent
theexplanationofresponsibleofficialsincludingtheconsiderationofanyunusualdifficultiesor
circumstancestheyfaced.

7.59 Thetoneofreportsshouldencouragedecisionmakerstoactontheauditors'findingsand
recommendations.Althoughfindingsshouldbepresentedclearlyandforthrightly,theauditorsshouldkeepin
mindthatoneoftheirobjectivesistopersuade,andthatthiscanbestbedonebyavoidinglanguagethat
generatesdefensivenessandopposition.Althoughcriticismofpastperformanceisoftennecessary,thereport
shouldemphasizeneededimprovements.

Convincing
7.60Beingconvincingrequiresthattheauditresultsberesponsivetotheauditobjectives,thefindingsbe
presentedpersuasively,andtheconclusionsandrecommendationsfollowlogicallyfromthefactspresented.
Theinformationpresentedshouldbesufficienttoconvincethereaderstorecognizethevalidityofthe
findings,thereasonablenessoftheconclusions,andthebenefitofimplementingtherecommendations.

Reportsdesignedinthiswaycanhelpfocustheattentionofresponsibleofficialsonthemattersthatwarrant
56

Government Auditing Standards

attentionandcanhelpstimulatecorrection.

Clear
7.61 Clarityrequiresthatthereportbeeasytoreadandunderstand.Reportsshouldbewritteninlanguageas
clearandsimpleasthesubjectpermits.

7.62 Useofstraightforward,nontechnicallanguageisessentialtosimplicityofpresentation.Iftechnical
termsandunfamiliarabbreviationsandacronymsareused,theyshouldbeclearlydefined.Acronymsshould
beusedsparingly.

7.63 Logicalorganizationofmaterial,andaccuracyandprecisioninstatingfactsandindrawingconclusions,
areessentialtoclarityandunderstanding.Effectiveuseoftitlesandcaptionsandtopicsentencesmakethe
reporteasiertoreadandunderstand.Visualaids(suchaspictures,charts,graphs,andmaps)shouldbeused
whenappropriatetoclarifyandsummarizecomplexmaterial.

Concise
7.64 Beingconciserequiresthatthereportbenolongerthannecessarytoconveyandsupportthemessage.
Toomuchdetaildetractsfromareport,mayevenconcealtherealmessage,andmayconfuseordiscourage
readers.Also,needlessrepetitionshouldbeavoided.

7.65 Althoughroomexistsforconsiderablejudgmentindeterminingthecontentofreports,thosethat
arecomplete,butstillconcise,arelikelytoachievegreaterresults.

Report Distribution
7.66Thefifthreportingstandardforperformanceauditsis:
Writtenauditreportsaretobesubmittedbytheauditorganizationtotheappropriateofficialsofthe
auditeeandtotheappropriateofficialsoftheorganizationsrequiringorarrangingfortheaudits,
includingexternalfundingorganizations,unlesslegalrestrictionspreventit.Copiesofthereports
shouldalsobesenttootherofficialswhohavelegaloversightauthorityorwhomayberesponsiblefor
actingonauditfindingsandrecommendationsandtoothersauthorizedtoreceivesuchreports.Unless
restrictedbylaworregulation,copiesshouldbemadeavailableforpublicinspection.

7.67 Auditreportsshouldbedistributedinatimelymannertoofficialsinterestedintheresults.Such
officialsincludethosedesignatedbylaworregulationtoreceivesuchreports,thoseresponsibleforactingon
thefindingsandrecommendations,thoseofotherlevelsofgovernmentwhohaveprovidedassistancetothe
auditee,andlegislators.However,ifthesubjectoftheauditinvolvesmaterialthatisclassifiedforsecurity
purposesorisnotreleasabletoparticularpartiesorthepublicforothervalidreasons,auditorsmaylimitthe
reportdistribution.

7.68 Whennongovernmentauditorganizationsareengaged,theengaginggovernmentorganizationshould
ensurethatthereportisdistributedappropriately.Ifthenongovernmentauditorganizationistomakethe
distribution,theengagementagreementshouldindicatewhatofficialsororganizationsshouldreceivethe
report.

57

Government Auditing Standards

7.69Internalauditorsshouldfollowtheirentity'sownarrangementsandstatutoryrequirementsfor
distribution.Usually,theyreporttotheirentity'stopmanagers,whoareresponsiblefordistributionofthe
report.

IfyouhavequestionsaboutGovernmentAuditingStandards,
sendemailto yellowbook@gao.gov.
Updated8/13/99

58