8-1

Module A

Assurance and Other Public Accounting

Services

“There’s no business like show business, but there are several businesses like accounting.”

– David Letterman

8-2

Module Topics

Assurance EngagementsAttestation EngagementsUnaudited Financial Statements

ReviewsCompilations

Interim Financial InformationSpecial Reports

8-3

The Relationships Among Auditing, Attestation, and Assurance Services

Assurance ServicesAny Information

Attestation ServicesApply Attestation Standards

AuditingFinancial

Statements

8-4

Levels of ServiceLevels of ServiceReports on Historical Financial Statements

Audit (Positive assurance) (AU Standards)

Review (Negative assurance) (AR Standards)

Compilation (Disclaimer of opinion -- No assurance) (AR Standards)

Attestation Standards on Other InformationExamination (Positive assurance) (AT Standards)

Review (Negative assurance) (AT Standards)

Agreed-upon Procedures (Results) (AT Standards)

8-5

Assurance ServicesAssurance Services Assurance Services are independent

professional services that improve the quality of information, or its context, for decision makers.

What factors are driving the demand for Assurance Services?

Information technologyCompetitionGlobalizationEducationCorporate structure changesAging of U.S. population

8-6

CPA TrustCPA Trust ServicesServices WebTrust – Reduces concerns of Internet users.

The company exists

Reliability of information regarding key business practices

SysTrust – Assurance of a client’s computer system.

Both provide assurance concerning the Principles of

Security over information

Processing Integrity

Privacy of information

Confidentiality of information

System availability

8-7

CPA Trust ServicesCPA Trust ServicesTrust Service Principles Security. Website must disclose and adhere to specific security practices

Availability. Website must disclose

Its hours of operation and establish effective controls to provide

reasonable assurance that it is available. Processing Integrity.

Completeness,

Accuracy,

Timeliness, and

Authorization of system processing Privacy. Website must disclose and adhere to its privacy practices. Confidentiality. Information is safeguarded from unauthorized users.

(http://www.cpawebtrust.org)

8-8

Attestation Engagements

Practitioner reports on subject matter that is the responsibility of another party.

Types of Attestation EngagementsAgreed Upon Procedures Engagements (AT 201)Financial Forecasts and Projections (AT 301)Reporting on Proforma Financial Information (AT 401)Reporting on an Entity’s Internal Control over Financial Reporting (AT 501)Compliance Attestation (AT 601)Management’s Discussion and Analysis (AT 701)

8-9

Types of Attestation EngagementsTypes of Attestation Engagements

ExaminationSimilar to an auditHigh level of assurance

ReviewModerate level of assuranceNot allowed on certain engagements

Agreed upon proceduresNo assurance but results of procedures

8-10

Audit and Attestation Standards: General Standards

1. Adequate technical training

2. Adequate domain knowledge

3. Verifiable assertion

4. Independence

5. Due professional care

1. Adequate technical training

2. [Implied by CPA]

3. [Implied by GAAP]

4. Independence

5. Due professional care

Attestation Audit

8-11

Audit and Attestation Standards:Standards of Fieldwork

1. Planning and supervision

2. [Not applicable]

3. Sufficient competent evidence

Attestation Audit

1. Planning and supervision

2. Internal control

3. Sufficient competent evidence

8-12

Audit and Attestation Standards:Reporting Standards

1. Identify assertion

2. State conclusion in accordance with criteria

3. [Not applicable]

4. [Not applicable]

5. State reservations

6. Extent of use

1. [Implied by GAAP]

2. State conclusion in accordance with GAAP

3. Consistency

4. Adequate disclosures

5. State an opinion of the “whole” or nature of problems.

6. [Not applicable]

Attestation Audit

8-13

Agreed Upon Procedures Engagements(AT 201)

Consists of performing procedures normally associated with an audit

Inventory observationConfirmation of receivables

Scope less than in an auditAccountant reports procedures and findings

No opinion or negative assurance providedMust restrict use of report to users who

established scope of engagement (Limited use report)

8-14

Financial Forecasts and Projections (AT 301)

PROSPECTIVE FINANCIAL INFORMATION (PFI)Financial information representing the financial position, results of operations, and cash flows for some period of time in the future.

Types of PFIFINANCIAL PROJECTION: PFI based on the occurrence of one or more hypothetical events that change existing business structure FINANCIAL FORECAST: PFI based on expected conditions and courses of action.

No Review Engagements for PFIs. Limited vs General Use (Only Examination of

Financial Forecast is General Use).

8-15

Reporting on Proforma Financial Information (AT 401)

PROFORMA FINANCIAL INFORMATION

"AS IF" a transaction had occurred by a specific date.

Any service can be performed (Examination, Review, or Agreed Upon Procedures)

8-16

Reporting on an Entity’s Internal Control over Financial Reporting

(AT 501, new ED and AS # 2)Presentation of Management's Assertion A separate report (Statement) that will

accompany the accountant's report. A representation letter addressed to the

accountant.

Types of Assertions Suitability of design of internal control Operating effectiveness of internal control

8-17

Criteria for engagement performanceManagement accepts responsibility for

the effectiveness of its internal controlManagement evaluates its internal

control using reasonable criteria (control criteria)

Sufficient evidence can be obtainedManagement presents its written

assertion based upon the control criteria

Reporting on an Entity’s Internal Control over Financial Reporting

8-18

Basic Content of ReportsAccountant has examined

management's assertion/AICPA or PCAOB Standards

Scope of auditor’s procedures Inherent limitations of internal controls Internal control conditions can changeOpinion (Adverse if material weakness)

Reporting on an Entity’s Internal Control over Financial Reporting

8-19

1) A control deficiency a control does notallow management or employees to prevent or

detect misstatements on a timely basis.2) A significant deficiency is control deficiency that

adversely affects the company’s ability to initiate, authorize, record, process, or report external financial data reliably in accordance with GAAP.

3) A material weakness is a significant deficiency that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected.

Reporting on an Entity’s Internal Control over Financial Reporting

8-20

Compliance Attestation (AT 601)

EXAMPLES: Dividend limitations, loan limitations, prescribed debt/equity ratios, limitations on geographic operations

Effect on financial statements (Will long-term debt need to be reclassified?)

Cannot do Review Engagement

8-21

Management Discussion and Analysis (AT 701)

Management Discussion and Analysis (MD&A) accompanies audited financial statements in the annual report

Auditors are required to read the MD&A to ensure that information is consistent with the audited financial statements

Auditors may accept an engagement to perform an audit or review of the MD&A

8-22

Review of Financial Statements(SSARS 1)

Review engagements are performed according to Statements on Standards for Accounting and Review Services

Must have an understanding of the client’s business

Work is limited to inquiry and analytical procedures

8-23

EXAMPLE REVIEW REPORT

8-24

Reporting for Compilation Engagements

Compilation engagements - performed according to Statements of Standards for Accounting and Review Services (SSARs) issued by the AICPA (AICPA GUIDELINES)

Does not have to include footnotes Accountant does not have to be independent Level of assurance -- the CPA does not provide any

assurance. The date of completion should be used as the date of the

accountant's report. Each page of the Financial Statements compiled by the

accountant should include:"UNAUDITED -- SEE ACCOUNTANT'S COMPILATION REPORT".

8-25

EXAMPLE COMPILATION REPORT

8-26

Review of Interim Financial Information (SAS 100)

Financial information that covers a period ending on a date other than the entities fiscal year end

SEC companies are required to have a review of the interim financial information filed with the SEC

Need to gain sufficient knowledge of the entity’s business and internal control

May have a report on interim financial information separate from the audit financial statementsPresented as a supplement to audited financial statements

8-27

Special Reports

Special Reports refers to auditors' reports issued in connection with the following:

Specified elements, accounts, or items of a financial statementFinancial statements that are prepared in conformity with a comprehensive basis of accounting other than generally accepted accounting principles

8-28

Specified Elements, Accounts or Items

GAAS audit is performedReport based on GAAPIf financial statements receive

disclaimer or adverse opinion—may not report on element.

8-29

Other Comprehensive Basis of Accounting (OCBOA)

Types of Bases that may be usedBasis used to comply with regulatory

requirementsBasis used for income tax purposesCash receipts and disbursements basisModified cash basisAny basis having "definite set of criteria"

and "substantial support”

A GAAS audit is still performed.

8-30

Other Comprehensive Bases of Accounting: Reporting

Report Modifications Introductory Paragraph

Names of financial statements may differResponsibilities are unchanged

Scope ParagraphNo changes necessaryGAAS audit still performed

Middle Paragraph (since GAAP Departure)Identify basis of accounting used by clientIndicate that basis of accounting is not GAAP

Opinion ParagraphInformation from financial statements may differDiscuss correspondence of financial statements with other basis

Limited distribution

8-31

Service Organizations

Third-parties that process transactions for other entitiesMany companies use third-parties to Process payroll Handle dividend distribution Banks or brokerages to handle investments

The controls exist at the third-party provider The auditors for the users of these services must

ensure that those controls at the service provider are adequate

Providers engage auditors to issue a special report concerning the controls

8-32GOVERNMENTAL AUDITING

(AU 801 - SAS 74)

Government Accountability Office (GAO) establishes auditing standards and issues Government Auditing Standards (The Yellow Book)

Types of AuditsFinancial audits - Financial statement and financial related

Financial statement must include written:Opinion on the financial statementsReport on compliance with laws and regulationsReport on I/C (Reportable conditions)

Attestation engagements - examinations, reviews and agreed-upon procedures.

Performance audits - Economy and efficiency and program results

In general, the auditor accepts a greater scope and more responsibility for a governmental audit

8-33

GAS - Basically the same as GAAS with additional“Independence” - Personal, External, & Organizational“Professional Judgment” - Use it“Competence” - Audit team should be competent“Quality Control” - Quality review every 3 years“Auditor Communication” - To necessary parties“Follow Up” - On results of previous engagements“Detecting Contract Violations and Abuse” - Required“Audit Documentation” - Allow another auditor to judge evidence“Compliance with GAGAS” - State in report“Reporting” - Internal control & compliance with laws & regs“Views of Officials” - Report“Privileged Information” - State if there was any“Report Issuance” - Distribute to appropriate officials

8-34

Single Audit Act (amended 1996) Prior to 1984, federal agencies that provided financial assistance to state and local governments audited specific grants, contracts, subsidies, etc.

The Act requires a “single audit” for entities expending federal dollars of (Old $300,000) $500,000 or more. OMB Circular 133 and Compliance Supplements define the required auditing.

• Audit “Major Programs” based on risk• Provide I/C and compliance tests of at least 50%• Test both “common” and “programmatic” laws and regs• Report to cognizant agency and send reports to clearing

house