Update on New Interpretations and Challenges in Government Auditing Standards
Yellow Book
Update
Page 1
DM # 6192169H
G
o
v
e
r
n
m
e
n
t
A
u
d
i
t
i
n
g
S
t
a
n
d
a
r
d
s
2
Y
e
l
l
o
w
B
o
o
k
U
p
d
a
t
e
N
e
w
i
n
t
e
r
p
r
e
t
a
t
i
o
n
s
1.
Same authority as Yellow Book
2.
Presented to Advisory Council
3.
Addressed with key stakeholders
4.
Posted to GAO website once finalized
3
Two new interpretations (draft-pending)
1.
Peer Reviews
2.
Performance/Attest Independence
4
5
I
n
t
e
r
p
r
e
t
a
t
i
o
n
1
-
P
e
e
r
R
e
v
i
e
w
s
The peer review team uses professional judgment
in deciding the type of peer
review report
Types of peer review ratings:
5
6
I
n
t
e
r
p
r
e
t
a
t
i
o
n
1
-
P
e
e
r
R
e
v
i
e
w
s
GAO is developing interpretive guidance on
assessing and reporting on the results of peer
reviews in government environment:
•
New report ratings do not change the thresholds
for deficiency reporting
•
Matters identified during peer review that are not
included in report may be communicated orally
or in writing
6
7
I
n
t
e
r
p
r
e
t
a
t
i
o
n
2
–
P
e
r
f
o
r
m
a
n
c
e
/
A
t
t
e
s
t
I
n
d
e
p
e
n
d
e
n
c
e
Nonaudit
Services and Limited-Scope Audits
•
GAO is developing interpretive guidance on GAGAS
paragraph 3.47:
•
Allows – Auditors to perform some otherwise-prohibited
nonaudit services
•
Prohibits -
•
Clarifies – Attest and Performance Audit independence
requirements parallel
•
Does not apply to financial statement audits
•
Auditors always still required to assess
independence using the Conceptual Framework
8
1.
Identify threats to independence
2.
Evaluate the significance of the threats identified, both
individually and in the aggregate
3.
Apply safeguards as necessary to eliminate the threats or
reduce them to an acceptable level
4.
Evaluate whether the safeguard is effective
Documentation Requirement:
Para 3.24: When threats are not at an acceptable level and
require application of safeguards, auditors should document
the safeguards applied
8
9
Applying The Framework
Threats
could
impair independence
•
Do
not
necessarily result in an independence
impairment
Safeguards could
mitigate threats
•
Eliminate or reduce to an acceptable level
10
10
A
p
p
l
y
i
n
g
t
h
e
F
r
a
m
e
w
o
r
k
:
C
a
t
e
g
o
r
i
e
s
o
f
T
h
r
e
a
t
s
1.
Management participation threat
2.
Self-review threat
3.
Bias threat
4.
Familiarity threat
5.
Undue influence threat
6.
Self-interest threat
7.
Structural threat
11
G
A
G
A
S
C
o
n
c
e
p
t
u
a
l
F
r
a
m
e
w
o
r
k
f
o
r
I
n
d
e
p
e
n
d
e
n
c
e
A
d
d
i
t
i
o
n
a
l
D
o
c
u
m
e
n
t
a
t
i
o
n
R
e
q
u
i
r
e
m
e
n
t
s
1.
Auditors
must document assessment of SKE
2.
Auditors must document application of
safeguards in place
•
Nonaudit services
Assessment of SKE (Skill, Knowledge and Experience
)
•
SKE is assessed before conceptual framework
14
R
e
m
i
n
d
e
r
-
C
o
n
t
i
n
u
i
n
g
P
r
o
f
e
s
s
i
o
n
a
l
E
d
u
c
a
t
i
o
n
(
C
P
E
)
No revision to overall requirements
•
Minimum of 24 hours of CPE every 2 years
•
Government
•
Specific or unique environment
•
Auditing standards and applicable accounting principles
•
Additional 56 hours of CPE for auditors involved in
•
Planning, directing, or reporting on GAGAS
assignments; or
•
Charge 20 percent or more of time annually to GAGAS
assignments
•
Minimum of 20 hours of CPE each year
15
W
h
e
r
e
t
o
F
i
n
d
t
h
e
Y
e
l
l
o
w
B
o
o
k
•
The Yellow Book is available on GAO
’
s
website at:
www.gao.gov/yellowbook
•
For technical assistance, contact us at:
yellowbook@gao.gov
or call (202) 512-9535
15
S
t
a
n
d
a
r
d
s
f
o
r
I
n
t
e
r
n
a
l
C
o
n
t
r
o
l
i
n
t
h
e
G
o
v
e
r
n
m
e
n
t
Going
Green
S
t
a
n
d
a
r
d
s
f
o
r
I
n
t
e
r
n
a
l
C
o
n
t
r
o
l
i
n
t
h
e
F
e
d
e
r
a
l
G
o
v
e
r
n
m
e
n
t
S
e
s
s
i
o
n
O
b
j
e
c
t
i
v
e
:
G
o
i
n
g
G
r
e
e
n
•
To discuss GAO’s plan to update the
Standards
for Internal Control in the Federal Government,
(Green Book)
•
To discuss why internal controls are a key tool
government managers use to
•
Produce reliable financial reports
•
Maintain compliance
•
Achieve operational objectives and mitigate risks
•
To demonstrate …
17
I
m
p
l
i
c
a
t
i
o
n
s
o
f
I
n
e
f
f
e
c
t
i
v
e
I
n
t
e
r
n
a
l
C
o
n
t
r
o
l
s
More than $154 Million in Questioned and
Unsupported Costs in [Grant Recipients]
Proposed Budget
More than $6.3 Million of
Questioned Costs at the
University of [Green’s Higher
Education]
Internal Controls Over
[Entity’s] Staff Retreats Could
Be Improved
Additional Audit Work Confirms
$88 Million of Unallowable
Contingency Costs in
Construction Budget
Improper Release of Personally
Identifiable Information
18
R
e
a
s
o
n
s
f
o
r
G
r
e
e
n
B
o
o
k
R
e
v
i
s
i
o
n
•
Last issued in November 1999
•
Adapt to a m
ore global, complex, and technological
landscape
•
M
aintain relevancy to changing standards
•
Harmonize federal standards with the updated
Committee of Sponsoring Organizations of the Treadway
Commission (
COSO)
F
ramework
19
W
h
a
t
’
s
i
n
G
r
e
e
n
B
o
o
k
f
o
r
t
h
e
F
e
d
e
r
a
l
G
o
v
e
r
n
m
e
n
t
?
•
Reflects federal internal control standards
required per Federal Managers’ Financial
Integrity Act (FMFIA)
•
Serves as a base for OMB Circular A-123
•
Written for government
•
Leverages the COSO Framework
•
Uses government terms
20
W
h
a
t
’
s
i
n
G
r
e
e
n
B
o
o
k
f
o
r
S
t
a
t
e
a
n
d
L
o
c
a
l
G
o
v
e
r
n
m
e
n
t
s
?
•
May be an acceptable framework for internal
control on the state and local government level
under proposed OMB Uniform Guidance for
Federal Awards
•
Written for government
•
Leverages the COSO Framework
•
Uses government terms
21
W
h
a
t
’
s
i
n
G
r
e
e
n
B
o
o
k
f
o
r
M
a
n
a
g
e
m
e
n
t
a
n
d
A
u
d
i
t
o
r
s
?
•
Provides a framework for management
•
Provides criteria for auditors
•
Can be used in conjunction with other standards,
e.g. Yellow Book
22
U
p
d
a
t
e
d
C
O
S
O
F
r
a
m
e
w
o
r
k
Released
May 14, 2013
23
I
n
t
e
r
n
a
l
C
o
n
t
r
o
l
:
C
O
S
O
F
r
a
m
e
w
o
r
k
•
Published by COSO
•
COSO is sponsored by
•
American Accounting Association (AAA)
•
American Institute of Certified Public Accountants (AICPA)
•
Financial Executives International (FEI)
•
Institute of Management Accountants (IMA)
•
Institute of Internal Auditors (IIA)
•
Established:
•
Common internal control definitions
•
Internal control components
24
T
h
e
C
O
S
O
F
r
a
m
e
w
o
r
k
•
Relationship of Objectives and Components
•
Direct relationship between objectives (which are what an entity
strives to achieve) and the components (which represent what is
needed to achieve the objectives)
•
COSO depicts the relationship
in the form of a cube:
•
The three objectives are represented
by the columns
•
The five components are represented
by the rows
•
The entity’s organization structure is
represented by the third dimension
25
Source: COSO
U
p
d
a
t
e
d
C
O
S
O
F
r
a
m
e
w
o
r
k
•
Retains the five components and adds principles
and points of focus
•
Sets out 17 principles
•
Fundamental concepts associated with the components
•
Each principle is supported by related points of
focus
•
Represent characteristics associated with the principles
26
U
p
d
a
t
e
d
C
O
S
O
F
r
a
m
e
w
o
r
k
:
C
o
m
p
o
n
e
n
t
s
o
f
I
n
t
e
r
n
a
l
C
o
n
t
r
o
l
Control Environment
Risk Assessment
Control Activities
Information &
Communication
Monitoring Activities
1.
Demonstrates commitment to integrity and ethical values
2.
Exercises oversight responsibility
3.
Establishes structure, authority and responsibility
4.
Demonstrates commitment to competence
5.
Enforces accountability
6.
Specifies
suitable
objectives
7.
Identifies and analyzes risk
8.
Assesses fraud risk
9.
Identifies and analyzes significant change
10.
Selects and develops control activities
11. Selects and develops general controls over technology
12.
Deploys through policies and procedures
13.
Uses relevant information
14.
Communicates internally
15.
Communicates externally
16.
Conducts ongoing and/or separate evaluations
17.
Evaluates and communicates deficiencies
27
F
r
o
m
C
O
S
O
t
o
G
r
e
e
n
B
o
o
k
:
H
a
r
m
o
n
i
z
a
t
i
o
n
28
G
r
e
e
n
B
o
o
k
R
e
v
i
s
i
o
n
P
r
o
c
e
s
s
•
Retained five original COSO components
•
Adapted COSO Framework’s language
to make it appropriate for a federal
government standard
•
Adapted the concepts for a government
environment where appropriate
•
Considered clarity drafting conventions
•
Considered INTOSAI internal control
guidance
29
R
e
v
i
s
e
d
G
r
e
e
n
B
o
o
k
:
S
t
a
n
d
a
r
d
s
f
o
r
I
n
t
e
r
n
a
l
C
o
n
t
r
o
l
i
n
t
h
e
F
e
d
e
r
a
l
G
o
v
e
r
n
m
e
n
t
30
R
e
v
i
s
e
d
G
r
e
e
n
B
o
o
k
:
O
v
e
r
v
i
e
w
•
Explains fundamental concepts of
internal control
•
Addresses how components, principles, and
attributes relate to an entity’s objectives
•
Discusses management evaluation of internal
control
31
O
v
e
r
v
i
e
w
:
C
o
m
p
o
n
e
n
t
s
,
P
r
i
n
c
i
p
l
e
s
,
a
n
d
A
t
t
r
i
b
u
t
e
s
32
O
v
e
r
v
i
e
w
:
P
r
i
n
c
i
p
l
e
s
a
n
d
A
t
t
r
i
b
u
t
e
s
33
•
In general, all components, principles,
and attributes are required for an
effective internal control system
•
Principles and Attributes
•
Entity should implement relevant principles and attributes
•
If a principle or attribute is not relevant, document the
rationale of how, in the absence of that principle or
attribute, the associated component could be designed,
implemented, and operated effectively
O
v
e
r
v
i
e
w
:
M
a
n
a
g
e
m
e
n
t
E
v
a
l
u
a
t
i
o
n
An effective internal control system requires
that each of the five components are:
•
Effectively designed, implemented, and operating
•
Operating together in an integrated manner
Management evaluates the effect of deficiencies on
the internal control system
A component is not likely to be effective if related
principles and attributes are not effective
34
Overview
Standards
R
e
v
i
s
e
d
G
r
e
e
n
B
o
o
k
:
S
t
a
n
d
a
r
d
s
•
Control Environment
•
Risk Assessment
•
Control Activities
•
Information and Communication
•
Monitoring
35
R
e
v
i
s
e
d
G
r
e
e
n
B
o
o
k
:
S
t
a
n
d
a
r
d
s
•
Discusses requirements of each
component
•
Explains principles and attributes for each
component
•
Includes application material for each attribute
36
S
t
a
n
d
a
r
d
s
:
C
O
S
O
v
s
.
G
r
e
e
n
B
o
o
k
Note: GAO combined COSO’s points of focus into attributes
37
S
t
a
n
d
a
r
d
s
:
H
a
r
m
o
n
i
z
a
t
i
o
n
f
r
o
m
C
O
S
O
t
o
G
r
e
e
n
B
o
o
k
38
•
Board of Directors
•
Investors
•
Oversight Body
•
Stakeholders
S
t
a
n
d
a
r
d
s
:
H
a
r
m
o
n
i
z
a
t
i
o
n
E
x
a
m
p
l
e
COSO (Principle 2)
The board of directors demonstrates
independence from management and exercises
oversight of the development and performance of
internal control.
Green Book (Principle 2)
The oversight body should oversee the entity’s
internal control system.
39
G
r
e
e
n
B
o
o
k
R
e
v
i
s
i
o
n
P
r
o
p
o
s
e
d
T
i
m
e
l
i
n
e
Outreach to User
Community
Green
Book
Advisory
Council
Public
Exposure (90
day comment
period)
Finalize
Ongoing
May 20,
2013
Summer
2013
2014
40
G
r
e
e
n
B
o
o
k
A
d
v
i
s
o
r
y
C
o
u
n
c
i
l
Representation from:
•
Federal agency management (nominated by OMB)
•
Inspector General
•
State and local government
•
Academia
•
COSO
•
Independent public accounting firms
•
At large
41
W
h
e
r
e
t
o
F
i
n
d
t
h
e
G
r
e
e
n
B
o
o
k
•
Once exposed, the Green Book will be on
GAO
’
s website at:
www.gao.gov
•
For technical assistance, contact us at:
greenbook@gao.gov
42
This update covers the new interpretations related to the Yellow Book in government auditing standards. It includes details on conceptual framework implementation challenges, peer reviews, and performance/attest independence. The GAO is developing interpretive guidance on assessing and reporting peer review results and addressing nonaudit services and limited-scope audits. The need to identify threats to independence, evaluate their significance, apply safeguards, and document these procedures is also emphasized.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
DM # 6192169H Government Auditing Standards Yellow Book Update Page 1
Yellow Book Update New Interpretations Conceptual Framework Implementation Challenges 2
New Interpretations New interpretations 1. Same authority as Yellow Book 2. Presented to Advisory Council 3. Addressed with key stakeholders 4. Posted to GAO website once finalized 3
New interpretations Two new interpretations (draft-pending) 1. Peer Reviews 2. Performance/Attest Independence 4
Interpretation 1 - Peer Reviews The peer review team uses professional judgment in deciding the type of peer review report Types of peer review ratings: 5 5
Interpretation 1 - Peer Reviews GAO is developing interpretive guidance on assessing and reporting on the results of peer reviews in government environment: New report ratings do not change the thresholds for deficiency reporting Matters identified during peer review that are not included in report may be communicated orally or in writing 6 6
Interpretation 2 Performance/ Attest Independence Nonaudit Services and Limited-Scope Audits GAO is developing interpretive guidance on GAGAS paragraph 3.47: Allows Auditors to perform some otherwise-prohibited nonaudit services Prohibits - Clarifies Attest and Performance Audit independence requirements parallel Does not apply to financial statement audits Auditors always still required to assess independence using the Conceptual Framework 7
Conceptual Framework 1. Identify threats to independence 2. Evaluate the significance of the threats identified, both individually and in the aggregate 3. Apply safeguards as necessary to eliminate the threats or reduce them to an acceptable level 4. Evaluate whether the safeguard is effective Documentation Requirement: Para 3.24: When threats are not at an acceptable level and require application of safeguards, auditors should document the safeguards applied 8 8
Conceptual Framework Applying The Framework Threatscould impair independence Do not necessarily result in an independence impairment Safeguards could mitigate threats Eliminate or reduce to an acceptable level 9
Applying the Framework: Categories of Threats 1. Management participation threat 2. Self-review threat 3. Bias threat 4. Familiarity threat 5. Undue influence threat 6. Self-interest threat 7. Structural threat 10 10
GAGAS Conceptual Framework for Independence Assess condition or activity for threats to independence No Threat identified? Proceed Yes Is the nonaudit service specifically prohibited in GAGAS paragraphs 3.36 or 3.49 through 3.58? Yes Yes Is threat related to a nonaudit service? No No Assess threat for significance No Is threat significant? Proceed Yes Identify and apply safeguard(s) Assess safeguard(s) effectiveness Is threat eliminated or reduced to an acceptable level? No Yes Document nature of threat and any safeguards applied Independence impairment; do not proceed Proceed 11
Additional Documentation Requirements 1. Auditors must document assessment of SKE 2. Auditors must document application of safeguards in place
Implementation Challenges Nonaudit services Assessment of SKE (Skill, Knowledge and Experience) SKE is assessed before conceptual framework
Reminder - Continuing Professional Education (CPE) No revision to overall requirements Minimum of 24 hours of CPE every 2 years Government Specific or unique environment Auditing standards and applicable accounting principles Additional 56 hours of CPE for auditors involved in Planning, directing, or reporting on GAGAS assignments; or Charge 20 percent or more of time annually to GAGAS assignments Minimum of 20 hours of CPE each year 14
Where to Find the Yellow Book The Yellow Book is available on GAO s website at: www.gao.gov/yellowbook For technical assistance, contact us at: yellowbook@gao.gov or call (202) 512-9535 15 15
Standardsfor Internal Control in the Federal Government Standards for Internal Control in the Government Going Green
Session Objective: Going Green To discuss GAO s plan to update the Standards for Internal Control in the Federal Government, (Green Book) To discuss why internal controls are a key tool government managers use to Produce reliable financial reports Maintain compliance Achieve operational objectives and mitigate risks To demonstrate 17
Implications of Ineffective Internal Controls 18
Reasons for Green Book Revision Last issued in November 1999 Adapt to a more global, complex, and technological landscape Maintain relevancy to changing standards Harmonize federal standards with the updated Committee of Sponsoring Organizations of the Treadway Commission (COSO) Framework 19
Whats in Green Book for the Federal Government? Reflects federal internal control standards required per Federal Managers Financial Integrity Act (FMFIA) Serves as a base for OMB Circular A-123 Written for government Leverages the COSO Framework Uses government terms 20
Whats in Green Book for State and Local Governments? May be an acceptable framework for internal control on the state and local government level under proposed OMB Uniform Guidance for Federal Awards Written for government Leverages the COSO Framework Uses government terms 21
Whats in Green Book for Management and Auditors? Provides a framework for management Provides criteria for auditors Can be used in conjunction with other standards, e.g. Yellow Book 22
Updated COSO Framework Released May 14, 2013 23
Internal Control: COSO Framework Published by COSO COSO is sponsored by American Accounting Association (AAA) American Institute of Certified Public Accountants (AICPA) Financial Executives International (FEI) Institute of Management Accountants (IMA) Institute of Internal Auditors (IIA) Established: Common internal control definitions Internal control components 24
The COSO Framework Relationship of Objectives and Components Direct relationship between objectives (which are what an entity strives to achieve) and the components (which represent what is needed to achieve the objectives) COSO depicts the relationship in the form of a cube: The three objectives are represented by the columns The five components are represented by the rows The entity s organization structure is represented by the third dimension Source: COSO 25
Updated COSO Framework Retains the five components and adds principles and points of focus Sets out 17 principles Fundamental concepts associated with the components Each principle is supported by related points of focus Represent characteristics associated with the principles 26
Updated COSO Framework: Components of Internal Control 1. 2. Exercises oversight responsibility 3. Establishes structure, authority and responsibility 4. Demonstrates commitment to competence 5. Enforces accountability Demonstrates commitment to integrity and ethical values Control Environment 6. Specifies suitable objectives 7. Identifies and analyzes risk 8. Assesses fraud risk 9. Identifies and analyzes significant change Risk Assessment 10. Selects and develops control activities 11. Selects and develops general controls over technology 12. Deploys through policies and procedures Control Activities Information & Communication 13. Uses relevant information 14. Communicates internally 15. Communicates externally 16. Conducts ongoing and/or separate evaluations 17. Evaluates and communicates deficiencies Monitoring Activities 27
From COSO to Green Book: Harmonization Green Book COSO 28
Green Book Revision Process Retained five original COSO components Adapted COSO Framework s language to make it appropriate for a federal government standard Adapted the concepts for a government environment where appropriate Considered clarity drafting conventions Considered INTOSAI internal control guidance 29
Revised Green Book: Standards for Internal Control in the Federal Government Overview Standards 30
Revised Green Book: Overview Explains fundamental concepts of internal control Overview Standards Addresses how components, principles, and attributes relate to an entity s objectives Discusses management evaluation of internal control 31
Overview: Components, Principles, and Attributes Overview Achieve Objectives Standards Components Principles Attributes 32
Overview: Principles and Attributes In general, all components, principles, and attributes are required for an effective internal control system Overview Standards Principles and Attributes Entity should implement relevant principles and attributes If a principle or attribute is not relevant, document the rationale of how, in the absence of that principle or attribute, the associated component could be designed, implemented, and operated effectively 33
Overview: Management Evaluation Overview Overview An effective internal control system requires that each of the five components are: Effectively designed, implemented, and operating Operating together in an integrated manner Standards Standards Management evaluates the effect of deficiencies on the internal control system A component is not likely to be effective if related principles and attributes are not effective 34
Revised Green Book: Standards Overview Control Environment Standards Risk Assessment Control Activities Information and Communication Monitoring 35
Revised Green Book: Standards Overview Discusses requirements of each component Standards Explains principles and attributes for each component Includes application material for each attribute 36
Standards: COSO vs. Green Book Overview Component COSO Green Book Standards Control Environment 5 Principles 20 Points of Focus 5 Principles 13 Attributes Risk Assessment 4 Principles 27 Points of Focus 4 Principles 10 Attributes Control Activities 3 Principles 16 Points of Focus 3 Principles 11 Attributes Information & Communication 3 Principles 14 Points of Focus 3 Principles 7 Attributes Monitoring 2 Principles 10 Points of Focus 2 Principles 6 Attributes Note: GAO combined COSO s points of focus into attributes 37
Standards: Harmonization from COSO to Green Book Overview Standards Commercial Concepts Government Concepts Board of Directors Investors Oversight Body Stakeholders 38
Standards: Harmonization Example Overview Standards COSO (Principle 2) The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control. Green Book (Principle 2) The oversight body should oversee the entity s internal control system. 39
Green Book Revision Proposed Timeline Green Book Advisory Council Public Outreach to User Community Exposure (90 day comment period) Finalize May 20, 2013 Summer 2013 Ongoing 2014 40
Green Book Advisory Council Representation from: Federal agency management (nominated by OMB) Inspector General State and local government Academia COSO Independent public accounting firms At large 41
Where to Find the Green Book Once exposed, the Green Book will be on GAO s website at: www.gao.gov For technical assistance, contact us at: greenbook@gao.gov 42
