By Allison M. Henry, CPA, CGMA, vice president – professional and technical standards

I firmly believe that the majority of practitioners are committed to high engagement quality. The issue, it seems, is that while they conceptually support high quality, they are not necessarily aware of the importance of supporting documentation in achieving quality and what the documentation should look like. For many well-meaning practitioners, this blind spot has resulted in numerous nonconforming audit engagements.

As noted on peer review oversights, many cases of practitioners’ audit documentation only included client reports with check marks on selected items and sign-offs on the checklists. Upon being questioned as to what procedures were performed, practitioners invariably point to the checklist. Given the unique systems, internal controls, procedures, contracts, and reports used by each client, a generic third-party checklist is not suitably tailored to meet the audit documentation requirement. Documentation beyond the third-party checklist is needed to complete the picture and comply with the standards.

In the past, a peer reviewer would talk with the practitioner to determine what work was performed, and then give credit for the work based on the firm’s verbal explanations. Regulatory bodies, however, stick to the standards. This has resulted in a significant gap between the findings of peer reviewers and the regulators.

As a part of AICPA’s Enhancing Audit Quality Initiative, the AICPA peer review board initiated an enhanced oversight program that uses subject matter experts to oversee the peer review of selected employee benefit plan and single audits. The enhanced oversight has identified a high rate of nonconformity. Specifically, in a 2015 pilot program, out of 90 engagements selected from peer reviews in progress, 40 (44 percent) were “materially nonconforming.” In 2016, 105 (55 percent) of the 190 engagements that were selected for enhanced oversight were found to be nonconforming.

The most significant issue identified is the lack of sufficient documentation. The AICPA estimates that the deficiency rate would be reduced by 50 percent if the documentation had been complete. The AICPA has identified the following misconceptions regarding audit documentation:

• The auditor can meet the overall audit objectives without documenting the work.
• Sign-offs on an audit program are sufficient documentation of a detail test.
• A verbal explanation can substitute for written documentation in meeting the requirements of the audit documentation standard.

AICPA’s AU-C 230, Audit Documentation, requires sufficient audit documentation to enable an experienced practitioner having no previous connection with the engagement to understand the nature, timing, and extent of the procedures performed, who performed them, and the conclusions reached. While practitioners have participated in many CPE sessions on this topic, they are not interpreting the standard as it is written. Peer reviewers, similarly, have not held firms to the intent of the standards.

The AICPA has developed a suite of free hands-on audit documentation resources, including sample workpapers and free staff training materials. There are sample workpapers for analytical procedures, detail substantive testing, dual-purpose testing for single audits, etc. The examples include documentation of the sample design, the purpose of the tests, details for each procedure performed, information on the timing of the work, who performed it, who reviewed it, and the conclusions reached. While nonauthoritative, the sample workpapers help to bridge the gap between what is being seen in connection with peer review oversight and what the profession would like to see.