A warning to CPAs on employee benefit plan audits.

A DOL report on an alarming number of mishandled audits.

What happens if employee benefit plan auditors and administrators fail to recognize these plans' uniqueness and the risks associated with them? They could risk failure to comply with established standards for these plans, as one report illustrates. A Department of Labor review of 1992 plan year audits found many of the plans did not comply with applicable generally accepted auditing standards and Employee Retirement Income Security Act requirements. This article discusses ways CPAs considering or performing such engagements can minimize the risks and steps the DOL and the American Institute of CPAs expect to take to improve the quality of these audits.

UNEVEN COMPLIANCE

The DOL's Pension and Welfare Benefit Administration examined a random sample of 267 employee benefit plan audits for the 1992 plan year. This review was a follow-up to one performed in 1987 by the DOL's Office of the Inspector General and aimed to ascertain the degree of compliance with applicable GAAS and selected ERISA reporting and disclosure requirements. While there has been some improvement in audit quality since 1987, it is clear that much remains to be done to raise the profession's overall performance in these areas to acceptable levels.

According to the DOL, 19% of the 1992 audits reviewed had one or more GAAS violations, down slightly from 23% in the 1987 review, and 33% had one or more ERISA reporting and disclosure violations, down significantly from 66% for 1987. Such exception rates mean there is a significant risk to plan administrators--who can face a $50,000 fine per audit--and for CPAs--who can be subject to disciplinary action by the AICPA and the state boards of accountancy. More important, these high exception rates pose a significant risk to and challenge for the accounting profession and the employee benefits industry since they can erode the level of public confidence in both and prompt increased government regulation.

GAAS VIOLATIONS

The DOL found that 50 (19%) of the plans had one or more GAAS violations, which ran the gamut. (See exhibit 1 on page 56.) Of the 86% that lacked adequate evidential matter, the most common deficiencies were in participant data, prohibited transactions, plan obligations, benefits payments and tax status. Unfortunately, a large number of these violations related to a failure to do or to document any audit work in the above areas. Lack of documentation was particularly prevalent regarding prohibited transactions, tax status, participant data, plan obligations, subsequent events, benefit payments and plan representations. Many of these failures may be due to a misunderstanding or misapplication of the ERISA limited-scope audit exception.

ERISA VIOLATIONS

The DOL found that 88 (33%) of the plans it reviewed had a variety of ERISA reporting and disclosure violations. (See exhibit 2 on page 56.) All of these violations related to application of certain ERISA requirements that apply to the vast majority of employee benefit plan audits.

The review results identified certain problems that resulted in poor audit quality irrespective of firm size, including failure to understand that employee benefit audits differ from other audits, viewing these audits as ancillary to the sponsor's audit, limited experience in performing employee benefit plan audits, engagements fees that don't reflect the applicable audit requirements and related risks and lack of adequate quality control processes and documentation standards.

A surprisingly large number of CPAs still view employee benefit plan audits as low-risk engagements--and many plan administrators see them as necessary evils. While generally there is less risk of financial statement misstatement in connection with such engagements than with many other types, the associated regulatory and business risks are higher. These plans must meet a number of specialized financial, operational and regulatory reporting requirements, and violation of applicable standards can result in substantial fines. In addition, there are increasing risks from government enforcement and private-party litigation for tax and fiduciary violations.

* Repeal the limited-scope audit exception.

* Explore the possibility of creating an ERISA specialization under existing AICPA procedures.

* Establish additional technical support services for auditors.

* Provide more technical training at the state level in conjunction with selected state CPA societies.

* Strengthen the peer review process and related reporting in connection with employee benefit plan audits.

* Collaborate on a booklet for plan administrators on factors to consider in selecting a plan auditor.

* Prepare additional practice aids, such as an audit manual and checklists.

AICPA AND DOL ACTIONS

The AICPA has been working to improve employee benefit plan audit quality since 1990, but many of its efforts would not have had a full effect on the 1992 plan audits the DOL reviewed. At the end of my term (October 1995) as chair of the AICPA employee benefit plans committee, the Institute made a commitment to the DOL to undertake or to assist the DOL in implementing additional actions. The AICPA promised to

* Strengthen the definition of"qualified public accountant" in ERISA to help ensure that only auditors who meet mandatory employee benefit-related continuing professional education and peer review requirements perform ERISA plan audits.

* Circulate a copy of the final DOL report to CPAs in public practice.

All of the above actions should enhance audit quality. However, the first two would require legislation; the Institute and the DOL should work together to achieve these goals.

BEST PRACTICES

Given the results of the most recent DOL review, it seems clear that any CPAs who perform this type of audit would benefit from knowing about certain best practices being used by certain firms in their employee benefit plan audit engagements. CPAs should

* To the extent practical, assign trained professionals--preferably at the manager or senior level--to employee benefit plan audits. This is especially important for higher-risk engagements (such as initial audits and those with significant related-party transactions, pending government reviews or private-party litigation).

* Perform second reviews on higher-risk engagements.

* Divide responsibility for employee benefit plan audits between audit and tax staff, so that qualified tax staff address the tax status review, related-party transactions review and form 5500 preparation and review.

* Ensure that engagement personnel have access to current Institute and other authoritative guidance, including the 1995 AICPA audit and accounting guide Audits of Employee Benefit Plans and annual AICPA risk alerts.

* Ensure that engagement personnel have adequate training in employee benefit plan audits and any other related matters.

* Use standardized engagement tools and documentation approaches, for example, work programs and checklists.

* Ensure that the firm's internal quality review programs address employee benefit plan audit engagements and that reviews are performed by qualified personnel.

* Use technical hotlines and support services provided by the AICPA and various state societies.

* Consider engaging the services of another CPA firm experienced in employee benefit plan accounting, audit and ERISA matters when necessary and appropriate.

Implementing these best practices can significantly improve audit quality and client service and reduce related enforcement and litigation risks.

TAKING STOCK

CPAs, plan administrators and the accounting profession need to address the issues raised in the DOL review. In many instances, CPAs will have to ask themselves whether they are truly qualified to perform these engagements and, if they are, whether doing so passes a cost-benefit test. Plan administrators need to recognize the additional risk associated with employee benefit plans in general and employee benefit plan audits in particular. The AICPA and the DOL also should continue to work with state societies and other interested parties to improve the quality of employee benefit plan audits. The time to act is now.

EXECUTIVE SUMMARY

* A DEPARTMENT OF LABOR REVIEW of 267 employee benefit plan audits revealed that 19% of them did not meet generally accepted auditing standards and 33% did not meet ERISA requirements.

* TO A GREAT EXTENT, THESE VIOLATIONS may occur when plan administrators and auditors underestimate the complexity of these audits and the risks associated with them.

* FAILURE TO MEET GAAS AND ERISA requirements can result in a $50,000 fine per audit for plan administrators and disciplinary action against auditors by the American Institute of CPAs or a state board of accountancy.

* MUCH CAN BE DONE TO IMPROVE audit quality. Steps can include assigning them to trained professionals, performing second reviews on higher-risk engagements, dividing responsibility between audit and tax staff, ensuring that engagement personnel have access to current authoritative guidance and considering engaging the services of another CPA firm.

Exhibit 1: GAAS Violations

50 plans had one or more violations.

                                                  Percentage
Violation                                         of plans

Lack of adequate evidential matter                      86%

Failure to exercise due professional care               44%

Auditor did not exhibit adequate technical
knowledge to perform the audit                          36%

Plan failed to meet applicable planning and
supervision, internal control review and
reporting standards                                     22%

Exhibit 2: ERISA Violations

The most frequently cited ERISA reporting and disclosure
violations in the 88 plans that had one or more.

                                                  Percentage
Violation                                         of plans

Failure to extend the auditor's report
to the required supplemental schedules                  56%

Failure to include all required information
in the supplemental schedules                           22%

Improper application of the ERISA
limited-scope audit exception                           12%

Failure to audit the plan rather than the
related trust                                            6%

The Department of Labors Pension and
Welfare Benefit Administration examined a
random sample of 1992 employee benefit
plan audits and found a disturbing
percentage did not meet standards.

Number of                  GAAS                  ERISA
audits reviewed            violations            violations
      267                    19%                   33%

DAVID M. WALKER, CPA, a partner of Arthur Andersen in Atlanta, is a former chair of the AICPA employee benefit plans committee and a former assistant secretary of labor for pension and welfare benefit programs.