Advancing the audit documentation standard: auditors must leave a clear record in private company audits.

EXECUTIVE SUMMARY

* SAS no. 103 establishes standards and provides guidance for auditors to follow when documenting their work during audits of private companies. It is effective for audits of financial statements of such companies for periods ending on or after December 15, 2006.

* The terms must, should and may as described in SAS no. 102, Defining Professional Requirements in Statements on Auditing Standards, are used in SAS no. 103.

* Documentation should be sufficiently detailed to give experienced auditors who were not previously involved in the audit a clear understanding of the work performed, the evidence obtained and the conclusions reached.

* The new standard says what should be documented and the characteristics of workpapers that should be retained.

* Oral explanations are not sufficient to document auditors' work or conclusions, but auditors may use them to clarify or explain information in the documentation.

* Auditors should document audit evidence that contradicts or is inconsistent with audit conclusions regarding significant findings or issues and also explain how they addressed the contradiction in forming the conclusion.

* Auditors should assemble audit documentation within 60 days from the audit report date. Subsequent deletions from the documentation are prohibited, and any additions should be documented in keeping with the standard. Audit documentation should be retained until at least five years after the report release date.

**********

Changes in the audit environment have recently led the Auditing Standards Board (ASB) to significantly revise guidance it had issued less than four years earlier. In January 2002, Statement on Auditing Standards (SAS) no. 96, Audit Documentation, made the most significant changes to audit workpaper guidance in more than three decades. But soon, major frauds and business failures focused attention on audit documentation. So in December 2005 the ASB tightened the requirements governing documentation by issuing SAS no. 103 (see Official Releases, JofA, Mar.06, page 95), which bears the same title as its predecessor.

The new guidance requires that engagement workpapers be sufficiently detailed to provide an experienced auditor a clear understanding of the procedures performed, the evidence obtained and the significant conclusions reached during audits of private companies. It is effective for audits of financial statements of private companies for periods ending on or after December 15, 2006. This article discusses crucial changes that the standard introduces and explains how they will affect auditing practice.

THE ROAD TO NEW GUIDANCE

When Enron collapsed and documents were destroyed, the profession, standard setters, regulators and state boards of accountancy became focused on audit documentation requirements and the issue of workpaper retention. In 2002 the Sarbanes-Oxley Act was passed, and it included provisions for increased audit documentation guidance for audits of public companies. Several state boards of accountancy adopted or proposed documentation regulations for all audits within their jurisdictions. Divergent rules started to emerge from the SEC, the state boards, the Government Accountability Office (GAO), the International Federation of Accountants (IFAC) and the Public Company Accounting Oversight Board (PCAOB). So the ASB set out to make its guidance not only more consistent with that of other standard setters, but also more responsive to the needs of U.S. auditors of nonpublic companies and the private company regulators overseeing their activities.

WHAT'S NEW?

SAS no. 103 amends several of SAS no. 96's provisions (see "How SAS No. 96 and SAS No. 103 Differ" on page 65, and "The New Audit Documentation Requirements," JofA, Apr.02, page 53). Specifically, the new SAS

* Revises SAS no. 96's guidance by requiring that audit documentation be sufficient for an experienced auditor to understand--among other things--the nature, timing, extent and results of auditing procedures the engagement auditors performed, the audit evidence they obtained and the conclusions they reached on significant matters.

* Clarifies that auditors cannot use oral explanations alone to support their work or conclusions.

* Provides new guidance for determining the date of the auditor's report.

* Establishes a time limit of 60 days for assembling the audit documentation.

* Establishes a minimum period for retaining the audit documentation.

Two of these topics relate to the actual documentation process and merit particular emphasis.

The experienced auditor. SAS no. 96 required auditors to prepare audit documentation with the needs of other members of the engagement team in mind. But SAS no. 103 specifies they should document their work in such a way that it is understandable to experienced auditors not previously involved in the audit. The standard defines an experienced auditor as one who "possesses competencies and skills that would have enabled him or her to perform the audit." SAS no. 103 also identifies areas in which such an auditor is proficient, including audit processes, applicable auditing, legal and regulatory requirements, the entity's business environment and relevant industry auditing and reporting issues. Audit documentation need not be understandable to individuals with only a basic knowledge of auditing.

Oral explanations. For more than 30 years, standards have permitted auditors to support their audit reports by means other than documentation, but did not specify these means. Some auditors may have thought this allowed them to support major aspects of their audit report with oral explanations instead of documentation, but we do not believe this was the standards' intent.

While developing SAS no. 96, the ASB decided to retain its earlier guidance from SAS no. 41, Working Papers, on this topic, as audit effectiveness would not necessarily be improved by documenting all information considered during an audit engagement, especially on matters that did not seem significant at the time.

However, concerns persisted that auditors might rely excessively on oral explanations to support major aspects of their work. So in SAS no. 103 the ASB clarified that oral explanations do not, by themselves, provide sufficient support for the auditor's work, though auditors may use them to further explain or clarify information that is contained in the workpapers.

AFTER THE AUDIT WORK IS FINISHED

SAS no. 103 includes expanded and more specific documentation guidance for the period following the date on which the auditor completes the audit fieldwork.

Report date. Until now (see SAS no. 1, AU section 530, "Dating of the Auditor's Report") auditors generally dated the audit report as of the day they completed their fieldwork. But under SAS no. 103 auditors should not date the audit report until they have sufficient, appropriate evidence to support the opinion. At that point audit documentation should have been reviewed, financial statements should have been prepared and management should have asserted its responsibility for them. In some cases, the report date will still coincide with the date fieldwork is completed. But in many others, the extent of remaining work auditors may have to perform will cause the auditor to use a date after the fieldwork completion date.

If the report is dated later than before, this increases the period that is subject to the auditor's subsequent events work. For example, management's representation letter and inquiries regarding subsequent events need to be updated to the date of the audit report.

Documentation completion date. This is the date by which SAS no. 103 requires auditors to assemble the final audit file, a process that should be completed within 60 days of delivering the audit report to the client. Before the documentation completion date, auditors can add information and replace, delete or discard superseded audit documentation. After that date, they can continue to add workpapers and explanations, but the SAS specifically prohibits deleting or discarding workpapers after the documentation completion date. Other standard setters, such as the GAO and the state boards, supported the ASB's establishment of these documentation requirements.

Retention period. Because of the Sarbanes-Oxley Act of 2002 and the subsequent changes to various state board rules, there now is more consistency in document retention periods among the various statutes, regulations and standards applicable to audits. This new consistency in the states' requirements made it feasible for the ASB to stipulate in SAS no. 103 that auditors should retain audit documentation for a specific period--at least five years---after the report release date.

WHAT FIRMS SHOULD DO

Some auditors already document their work and complete and retain their audit documentation in a manner consistent with SAS no. 103s requirements. Those who do not, however, will have to implement change to ensure their firms comply. Two new requirements have raised the threshold for the adequacy of audit documentation: that workpapers should be understandable to experienced auditors having no connection to the audit and that oral explanations may be used only to explain or clarify written documentation. An advantage that results from these requirements is that the documentation will enable firms' senior staff to review workpapers more effectively and give new auditors a better understanding of their firms' clients and related issues.

Because of the requirement to finalize the documentation file within 60 days, a best practice is for auditors to continually update documentation during the audit and discard superseded memos and files as the audit progresses, rather than only at its conclusion, where mistakes can cause confusion and an unclear record. Auditors also should determine whether states or regulators impose other, more stringent requirements than those in SAS no. 103. When establishing documentation retention policies for their firms, auditors should be mindful of all such requirements potentially applicable to their practices or to individual audits they perform. As an example, New York State requires auditors to finalize a copy of their documentation within 45 days of delivering the report to the client rather than within 60 days, as permitted in SAS no. 103. Ira state or regulator specifies a retention period exceeding SAS no. 103's five-year requirement, the auditor should retain the workpapers for the longer period.

The new provisions will strengthen the audit documentation process, and likely may require more documentation. But if implemented properly, they could result in more understandable documentation and enable firms to budget and bill for engagements more accurately and promptly, since engagements will be concluded on a more timely basis.

MANAGING PERMANENT FILES

It's important for all private companies to have a clear and effective strategy for archiving permanent files containing schedules, documents and charts carried forward from one audit to the next. SAS no. 103, Public Company Accounting Oversight Board (PCAOB) Auditing Standard (AS) 3, Audit Documentation, and the International Federation of Accountants' International Standard on Auditing (ISA) 230 (revised), Audit Documentation, do not directly address this issue, but certain best practices are emerging. For example, we suggest retaining a copy of the permanent files along with the annual workpapers because it creates a clear record of the audit documentation as of the date the audit was performed. While it is easier to do this with electronic files, it is equally important when the files are in paper format.

Because some schedules and documents--for example, analytical comparisons and ratios--may be located in permanent files, auditors should review permanent file contents each year to determine whether any of them should be in the annual audit file as a schedule or workpaper. A smaller permanent file is easier to update and archive with the annual audit workpapers. In some cases, such an evaluation has led to the conclusion that keeping a separate permanent file is unnecessary.

LOOKING AHEAD

The ASB's issuance of SAS no. 103 advances audit documentation guidance for U.S. auditors of private companies. Because they take into account recent events and the discussions and requirements of other standard-setting bodies, these new provisions may have a long life. But other issues may arise in a future environment, creating a need for revising the guidance. Auditors should stay abreast of any such changes.

Exhibit

How SAS No. 96 and SAS No. 103 Differ

SAS no. 96, Audit Documentation

Nature and extent of audit documentation

* Identifies six factors auditors should consider in determining the nature and extent of the documentation appropriate for a particular audit area or auditing procedure.

* The nature of the procedure.

* The identified risk of misstatement.

* The extent of judgment involved.

* The significance of the audit evidence.

* The nature and extent of exceptions.

* The need to document a conclusion not readily determinable from the documentation.

* Requires that audit documentation include abstracts or copies of significant contracts or agreements that auditors examined to evaluate the accounting for significant transactions.

* Requires that documentation identify the items tested-in tests of the effectiveness of controls and substantive tests-that involve inspection of documents or confirmation.

* Has no equivalent requirement.

Sufficiency of audit documentation

* States that audit documentation should be sufficient to enable members of the engagement team with supervision and review responsibilities to understand the evidence obtained and the nature, timing, extent and results of the auditing procedures performed.

* States that documentation should be sufficient to show

* Who performed and reviewed the work.

* The accounting records agree or reconcile with the financial statements or other information being reported on.

* The applicable standards of fieldwork have been observed.

Documentation of significant findings or issues

* States the auditor should document audit findings or issues that in his or her judgment are significant, actions taken to address them (including any additional evidence obtained) and the basis for the final conclusions reached.

* Lists four categories into which all significant findings may be classified.

* Significant matters involving the selection, application and consistency of accounting principles related to the financial statements.

* Results of audit procedures indicating the financial statements or disclosures could be materially misstated or a need to revise the auditing procedures.

* Circumstances causing the auditor difficulty in applying necessary auditing procedures.

* Findings that could necessitate modifying the audit report.

* No equivalent requirement.

Revisions to audit documentation

* No equivalent requirement.

Retention of audit documentation

* Requires auditors to adopt reasonable procedures for

* Retaining workpapers long enough to meet the needs of their practice and to satisfy any legal requirements relating to record retention.

* Maintaining the confidentiality of client information in audit documentation.

* Preventing unauthorized access to the audit documentation.

SAS no. 103, Audit Documentation

Nature and extent of audit documentation

* Retains the six factors.

* Requires retention of such documents if they are needed to enable an experienced auditor to understand the auditor's work and conclusions.

* Retains this requirement.

* Requires auditors to document the reasons for any departures from statements on auditing standards (SASs) and the sufficiency of alternative procedures used to achieve the objectives of the requirement.

Sufficiency of audit documentation

* Requires documentation be understandable to an experienced auditor having no previous connection to the audit. Additionally, SAS no. 103 expands the criteria for understandability to include conclusions

* Reached on significant matters.

* Not otherwise readily determinable from the documentation.

* Retains the essence of SAS no. 96 provisions, and modifies or expands them to require that documentation

* Show who performed the work, the date it was performed and when and by whom it was reviewed.

* Be the principal support for the auditor's representation that he or she followed generally accepted auditing standards (not just the standards of fieldwork) during the audit.

Documentation of significant findings or issues

* Retains this requirement.

* Retains the four categories, and adds a fifth category for audit misstatements identified by the auditor, whether or not corrected by management.

* Specifically requires auditors to document

* How they addressed contradictory or inconsistent information when forming a final conclusion on a significant matter.

* Oral discussions of significant matters with, among others, management and those overseeing the financial reporting process.

Revisions to audit documentation

* States that the auditor's report should be dated no earlier than the date the auditor has obtained sufficient audit evidence.

* Requires auditors to complete audit documentation by the documentation completion date (that is, no later than 60 days after the date on which the auditor delivers the report to the client).

* Specifically prohibits the auditor from deleting or discarding workpapers after the documentation completion date.

Retention of audit documentation

* Retains the SAS no, 96 guidance and modifies it as follows:

* Specifies that the retention period should be at least five years from the report release date.

* No change.

* Requires auditors to adopt controls to

* Clearly determine when and by whom audit documentation was created, changed or reviewed.

* Prevent unauthorized changes.

* Allow access by audit team and other authorized parties.

AICPA RESOURCES

CPE 

* Audit Workpapers: Avoid the Documentation Trap (text, # ?31862JA).

* InfoBytes, 2006 Quarterly Update--Government/Not for Profit: SAS nos. 102 & 103 (online, # BYTXX12JA).

Publications

* Statement on Auditing Standards no. 103, Audit Documentation (paperback, # 060706JA).

* Codification of Statements on Auditing Standards (paperback, # 057200JA).

For more information or to place an order, go to www.cpa2biz.com or call 800-777-7077.

Web site

* Auditing Standards Board technical activities and publications, www.aicpa.org/members/div/auditstd/technic.htm.

* "New SAS on Audit Documentation," In Our Opinion, Fall 2005, www.aicpa.org/download/auditstd/opinion/2005_fall.pdf.

In the Beginning

At roughly the same time SAS no. 96 appeared, documents to believed to be related to Enron were destroyed, focusing the attention of regulators and lawmakers on the contents and retention of audit documentation. Several months later Congress passed the Sarbanes-Oxley Act of 2002, directing the PCAOB to establish standards requiring audit firms to prepare audit documentation sufficiently detailed to support the conclusions reached in audits of their publicly held clients and to retain it for at least seven years.

Within months, several state boards of accountancy adopted or proposed regulations requiring firms in their jurisdictions to retain documentation of both their public company and private company audits. In January 2003 the SEC issued Rule 2-06, "Retention of Records Relevant to Audits and Reviews," which specified which types of records an audit firm should retain in connection with audits of public companies and for how long. Also in 2003, the PCAOB adopted SAS no. 96 as an interim auditing standard. However, in June 2004, it issued AS 3, Audit Documentation, which governs audits of public companies. This increased to five the number of standards and important rules the profession followed on various audits--SAS no. 96, AS 3, rule 2-06, the GAO's Yellow Book and IFAC's ISA 230--and whose guidance differed significantly.

Tips for Auditors

[] As a preparer of audit documentation, step back and read your work objectively. Would it be clear to another auditor? After preparers, reviewers are best qualified to ensure documentation is clear.

[] As a reviewer of documentation, if you have to ask the audit staff basic questions about the audit, the documentation probably does not contain the detail contemplated in SAS no. 103. The workpapers should contain all information and linkages that are necessary to ensure that all required procedures were performed, evidence was obtained and conclusions were reached by the auditors. Oral explanations may be used only to clarify or explain the documentation.

[] Document the audit clearly the first time to minimize the effort necessary to put the files in order before the documentation completion date--that is, within 60 days of your delivering the audit report to the client.

[] Continually update documentation during the audit, and discard superseded memos and files as the audit progresses, rather than at its conclusion.

[] Carefully determine whether more stringent state laws or other documentation requirements apply to your firm or certain of its audits.

[] Control your responsibility for subsequent events procedures by completing the audit on a timely basis.

[] Ensure staffing and review time is scheduled in time to meet the 60-day final file assembly deadline.

[] As an auditor, assess how SAS no. 103 requires you to change your current documentation approach and policies. Because it may be difficult to perform an objective self-assessment, you may want to consider engaging an objective third party to make specific recommendations.

[] Keep your workpapers safe and retrievable. Consider the standard's requirement that auditors be able to retrieve files five or more years old. Determine which of your current software programs will run in future environments, and plan to purchase new software or retain old software and hardware as necessary.

[] Determine whether you really need a permanent file. Reconsider its content and ensure that workpapers integral to the annual audit are filed in the annual audit file.

Ray Whittington, CPA, PhD, is director of the School of Accountancy and Management Information Systems at DePaul University; his e-mail address is [e-mail]. Lynford Graham, CPA, PhD, CFE, is a consultant, recent former member of the Auditing Standards Board and chair of the SAS no. 103 Task Force; his e-mail address is [e-mail].

Gretchen Fischbach, CPA, is a manager in the forensic & dispute services practice of Deloitte Financial Advisory Services LLP and a former technical manager on the AICPA audit and attest standards team. Her e-mail address is [e-mail]. The views in this article are hers and those of her coauthors and do not necessarily represent the views of Deloitte Financial Advisory Services LLP. John Ahern, CPA, is associate professor of accounting at DePaul University; his email address is [e-mail].