Changes in auditing practices affect nonprofit governance.

Q: Recent legislation and changes to auditors' standards and best practices have transformed board-auditor relations in the for-profit sector. How are these changes affecting governance of nonprofits?

[ILLUSTRATION OMITTED]

A: While legislative changes included in the 2002 Sarbanes-Oxley Act (SOX) primarily targeted publicly traded, for-profit enterprises, some of the act's requirements are becoming best practices for nonprofit organizations as well. These include having an audit committee of the nonprofit's board composed solely of outside directors.

These audit committees are often delegated the responsibility for hiring independent auditors. Also, meetings of audit committees with the auditors without staff present are becoming more common. In addition, SOX requires that publicly traded entities have reviews performed of their internal-control systems. While not yet common, some nonprofit organizations have commissioned internal-control studies, resulting in useful feedback and beneficial governance improvements.

On another front, the General Accounting Office updated its Government Auditing Standards (i.e., the Yellow Book) in 2003, effective for audits ending after January 1, 2004. Certified public accountants (CPAs) use Yellow Book standards, which in many respects anticipated the requirements of SOX, in auditing nonprofit organizations that accept government funding. As such, the Yellow Book provides best practices for other nonprofit audits as well. Included in the 2003 changes was heightened reporting of internal-control systems (a la Sox). A 2002 Yellow Book change caused affected nonprofits to cease using the firm that handles the nonprofit's book-keeping or performs consulting for the nonprofit to also audit its financial statements. This parallels a recent amendment in the CPA profession's ethics rules.

Finally, Statement on Auditing Standards (SAS) 99, "Consideration of Fraud in a Financial Statement Audit," issued in October 2002 by the American Institute of CPAs, changed auditors' responsibilities regarding fraud. Auditors must now assess the risk that fraud exists and to reach their conclusions they are interviewing not only upper management but also rank-and-file employees.

All these changes enable governing bodies to better understand the organizations they lead.

--James Woehlke, CAE, counsel, New York State Society of Certified Public Accountants, New York City, is a member of the ASAE Ask the Legal Section Committee and a former member of the Legal Section Council. The "Legal" item is not intended as legal advice but rather as an educational overview.