GAAS vs. GAGAS: how to report on internal controls; SAS no. 63 goes beyond SAS no. 60 and the yellow book in setting audit report requirements.

GAAS vs. GAGAS: HOW TO REPORT ON INTERNAL CONTROLS

SAS no. 63 goes beyond both SAS no. 60 and the yellow book in setting audit report requirements. The new director of finance for the Agency for Art Endowment was perplexed. "When I was chief financial officer of Trans-Global Enterprises, we always got a very simple one-page internal control report from our auditors. Now I'm in the public sector, and the equivalent report is twice as long. Is this because your firm is doing more work on internal controls than would be the case for a private enterprise?"

"Actually, no," replied the audit partner. "The procedures relating to the internal control structure for a generally accepted auditing standards (GAAS) audit are the same as those for an audit conducted under generally accepted government auditing standards, or GAGAS. Only the report is different."

"Why's that?" asked the finance director.

"It's largely a function of the different audience these reports are intended for. You see, government reports generally become part of the public record. As such, they may be read by those less knowledgeable about the audit process and the auditor's role and responsibilities than a private sector audit, which is read by members of management and the audit committee, who have direct knowledge about the audit engagement."

NEW STANDARDS FOR REPORTING ON INTERNAL CONTROLS

The finance director's uncertainty is understandable. At first glance, two such different-looking reports might reflect different levels of performance by the auditor--yet that's not the case. In this article, we'll try to clear up some of the mystery surrounding this subject and provide a working knowledge of the reporting requirements under

* Statement on Auditing Standards no. 60, Communication of Internal Control Structure Related Matters Noted in an Audit.

* Government Auditing Standards, commonly known as the yellow book, issued by the U.S. General Accounting Office.

* SAS no. 63, Compliance Auditing Applicable to Governmental Entities and Other Recipients of Governmental Financial Assistance. However, we won't be covering the section of SAS no. 63 concerning performance and reporting under the Single Audit Act of 1984.

IMPROVING COMMUNICATIONS

Over the past several years, one of the major objectives of the auditing standard setters has been improving communications between auditors and the users of their services. To this end, early in 1988 the American Institute of CPAs auditing standards board issued several new SASs, some of which were aimed directly at enhancing auditor communications.

During the same period, increased public attention was being focused on audits of government entities. Thus, while the new SASs were being finalized, the GAO was revising GAGAS, as set forth in its yellow book. Like the related AICPA standards, the yellow book includes requirements for auditor communications. The yellow book is effective for audits beginning on or after January 1, 1989.

One of the communication areas addressed in the yellow book is the auditor's responsibility for communicating internal control structure matters noted during the course of the audit. This responsibility was addressed for GAAS audits in SAS no. 60.

However, although the yellow book does not provide any specific examples of the communications of matters related to internal control structure, its requirements in some respects are more extensive than GAAS. Therefore, to further help auditors apply GAAS in government audits, the ASB developed SAS no. 63, which provides guidance on how auditors should modify SAS no. 60 reports on the internal control structure to satisfy the requirements of the yellow book.

DIFFERENCES BETWEEN THE YELLOW BOOK AND SASs nos. 63 AND 60

Exhibit 1 Features of the internal control structure report compares the requirements of the yellow book and SASs nos. 60 and 63. As can be seen, to satisfy the yellow book's requirements, SAS no. 63 adds additional elements to the basic internal control report set forth in SAS no. 60. SAS no. 63 also includes a few requirements found in neither SAS no. 60 nor the yellow book. Here are some illustrations of the differences between the yellow book and the two SASs.

* The yellow book carries forward the description of reportable conditions from SAS no. 60 and designates them as a key threshold for reporting internal control matters. But, the yellow book requires a written report on the internal control structure in every audit; SAS no. 60 requires communication--which may be oral or written--only when the auditor has noted reportable conditions.

* The yellow book requires any reportable conditions considered material weaknesses to be described as such. SAS no. 60, on the other hand, permits--but does not require--separate identification of reportable conditions deemed to be material weaknesses and reportable conditions not considered material weaknesses. The yellow book also requires the auditor to include the appropriate elements of an audit finding--criteria, condition, cause and effect.

* SAS no. 60 eliminated from the internal control report both previous language indicating the system of internal control is the responsibility of the company's management and the broad description of the objectives and inherent limitations of a system of internal control. The decision to do this was based on the concept that, typically, reports on the internal control structure are restricted to the company's use and the language unnecessarily clutters up the report.

SAS no. 63, on the other hand, reinstates a requirement for such cautionary language in reports on the internal control structure issued under the yellow book. Unlike reports issued in audits of typical commercial companies, reports issued under the yellow book usually become a matter of public record. Thus, the ASB believed it prudent to reinstate this cautionary language for the benefit of readers who didn't have direct knowledge about the audit engagement.

STANDARD REPORT FORM

Exhibit 2 How SASs nos. 60 and 63 and the yellow book interrelate shows the standard internal control structure report form and identifies the elements required by SAS no. 63 and the yellow book that go beyond the requirements of SAS no. 60.

Both SAS no. 63 and SAS no. 60 prohibit making any written representations that no reportable conditions were noted during the course of the audit. This prohibition becomes tricky in internal control structure reports issued under the yellow book because of the requirement for written communication in all audits. Thus, in situations in which no reportable conditions have been noted, the auditor normally would issue a report saying that no material weaknesses were noted. (Such reporting is appropriate under SASs nos. 60 and 63. The latter includes an example of a report that might be issued in these circumstances.)

IDENTIFYING REPORTABLE CONDITIONS AND MATERIAL WEAKNESSES

Because the yellow book and SAS no. 63 incorporate the performance and reporting standards of GAAS, the definitions of reportable conditions and material weaknesses carry through to government internal control structure reports. The threshold for a reportable condition is lower than that for material weaknesses, although a material weakness is one type of reportable condition. However, the distinction between a material weakness and an "other reportable condition" often will be difficult to ascertain. Neither the SASs nor the yellow book provides any examples for distinguishing between a material weakness and an "other reportable condition."

The identification of reportable conditions is subject to broad interpretation and requires substantial auditor judgment. When considering whether matters are reportable conditions, the auditor should assess the impact of the deficiency on the internal control structure as a whole, rather than focusing on individual elements of the internal control structure. In some instances, a weakness or deficiency in one element may be overcome by compensating factors in the other elements. In other instances, a weakness or deficiency in one element may be so pervasive it can't be overcome.

For example, the absence of control procedures in an entity that has a strong control environment and an effective accounting system often would not lead the auditor to believe there's a "significant deficiency in the design or operation of the internal control structure." That's the heart of the definition of a reportable condition under SAS no. 60. Conversely, if the auditor noted numerous errors in information generated by the accounting system and no compensating strengths in the control environment, the absence of control procedures generally would lead the auditor to conclude a reportable condition exists.

Below we list some examples of internal control report sections to illustrate these concepts.

ACCOUNTING FOR RECEIVABLES AND REVENUE

Criteria. The computer services operation represents a significant portion of the entity's total revenue. Accurate revenue data are essential to prepare reliable financial statements.

Condition. Revenue from the new computer services operation is accounted for by the computer services accounting system. That system calculates the amounts owed by customers for computer use and work done on contract and task orders, records unbilled accounts receivable and accrued revenue, creates and records customer billings and records customer payments.

However, the computer services accounting system was unable to process and generate reliable financial data for unbilled accounts receivable and related revenues. The system did not correctly reverse the unbilled accounts when customer billings were prepared. The reversals often appeared to have no relationship to either the billed or receivable amounts. Because of these problems, computer services revenue, unbilled accounts receivable and related financial reports were in error.

Cause. The new computer services accounting system was implemented without adequate testing to ensure it could be relied on for complete and accurate information.

Auditor's conclusion. Our audit tests estimated unbilled accounts receivable and related revenue accounts are overstated by approximately $6.5 million dollars, representing about 25% of adjusted computer services revenues. The entity is examining the system to identify the software programming problems and correct them. However, to date the problems have not been identified and corrections have not been made, causing the financial statements to be materially misstated. Accordingly, we consider this a material weakness in the entity's internal control structure.

INACCURATE RECORDS FOR MOTOR VEHICLES

Criteria. Accurate data for motor vehicles are essential to prepare reliable financial statements.

Condition. The entity maintains its records for motor vehicles in an automated accounting system. This system tracks vehicles acquired, on hand and disposed of; computes depreciation and billing rates; prepares invoices to bill customers for vehicle use and interfaces with the general ledger. However, the financial information in this system is not current and does not reflect motor vehicles on hand at any specific time.

Cause. The inaccurate records are attributable to two primary causes:

1. Delays--of up to four months--in accounting for motor vehicle sales.

2. Failure to reconcile periodically the number of vehicles in the records with the number of vehicles physically on hand.

Auditor's conclusion. The yearend amount for motor vehicles at September 30, 1989, erroneously included more than 1,400 sold vehicles with a capitalized value of more than $8.7 million and net book value of $3.1 million. In addition, capitalized values were recorded incorrectly in several instances. To correct these inaccuracies, the agency made a yearend adjustment to reduce its vehicle balance by $10 million. This resulted in a corresponding reduction of $2 million in the recorded depreciation balance. This adjustment brought the vehicle balance close to the estimated number of on-hand vehicles supplied by fleet managers. We believe the fleet managers' estimates of vehicles on hand are reliable, based on their validation of a sample of estimates. The adjustment prevented the financial statements from being materially misstated. We consider this deficiency in the internal control structure to be a reportable condition--and not a material weakness--since the deficiency did not result in the financial statements being materially misstated.

LACK OF COMPLIANCE CONTROLS

Criteria. Management of the agency is responsible for complying with laws and regulations. This responsibility includes establishing the necessary internal controls to ensure such compliance.

Condition. The agency was provided $100 million to carry out its programs. Program legislation and regulations imposed several requirements on the use of the funds. The agency has not established internal controls to ensure compliance with these requirements.

Cause. Agency management hasn't undertaken the necessary steps to establish appropriate internal controls.

Auditor's conclusion. Substantive audit tests for compliance with the requirements applicable to use of the funds did not reveal instances of noncompliance material to financial statements. However, due to its significance, we consider this condition to be a material weakness in internal controls.

PROCESSING TAX COLLECTIONS

Criteria. Timely processing of property tax collections is essential to provide supporting detail for the municipality's financial statements.

Condition. At March 31, 19X9, the Property Tax Department had not yet processed collections for the months of October and November 19X8.

Cause. A number of factors have contributed to this problem. These include a hiring freeze compounded by high employee turnover, lack of cross-training for employees and implementation of a new information system without adequate training and supervision of personnel.

Auditor's conclusion. Processing delays caused misstatements in delinquent property tax accounts to go unresolved because discrepancies between tax bill amounts and payments received have not been reconciled. As a result, timely information on the delinquent tax receivable balance was not prepared. Estimates of unprocessed collections were made for financial reporting purposes. Our test of these estimates indicated they prevented the financial statements from being materially misstated. We consider this to be a reportable condition.

COMPENSATED ABSENCES

Criteria. Accurate information on employee vacation, sick leave and holidays is needed to compute the liability for compensated absences.

Condition. Numerous errors were noted in the vacation, sick leave and holiday reports used in computing the liability for compensated absences. In addition, inconsistent reporting procedures were used by the various departments that submitted reports.

Cause. Lack of formal written procedures and employee training appear to be the major causes of errors and inconsistent reporting of vacation, sick leave and holidays in various departments. In addition, inadequate or untimely review by supervisory personnel allowed errors to go undetected.

Auditor's conclusion. The errors resulted in incorrect payments to employees for compensated absences. An incorrect accrual for financial reporting purposes also would have resulted; however, after extensive research, the payroll department recorded an adjustment at yearend to correct the compensated absence liability. As of March 31, 19X9, detailed calculations have not yet been performed to support adjustment of incorrect payments made to employees based on erroneous information. We consider this a reportable condition--and not a material weakness--since the deficiency did not result in the financial statements being materially misstated.

FUTURE GOVERNMENT AUDITING ISSUES

A number of efforts are under way that will affect the audits of government entities or of government funds received by nongovernment entities. Among these are new guidance on single audits of state and local governments and new requirements for audits of colleges and universities and other nonprofit organizations.

New guidance on single audits. The Office of Management and Budget (OMB) is currently revising circular A-87, Cost Principles Applicable to Grants and Contracts. This circular provides uniform rules for determining costs applicable to federal financial assistance given to state and local governments.

OMB also is revising the Compliance Supplement on Uniform Requirements for Federal Assistance Programs to State and Local Governments. This document provides important guidance to the auditor conducting single audits of state and local governments.

The AICPA is revising its audit and accounting guide, Audits of State and Local Government Units. This document provides, in part, guidance for conducting single audits of state and local governments. Current plans are to issue a statement of position covering reporting on internal control while conducting single audits of state and local governments.

New requirements for college and nonprofit audits. OMB currently is drafting new audit requirements (circular A-133) that will require organizationwide audits of colleges and universities and other nonprofit organizations receiving federal financial assistance. This circular will parallel circular A-128 covering audits of state and local governments and will be discussed in an upcoming issue of the Journal. [Exhibits 1 and 2 Omitted]

DONALD L. NEEBES, CPA, is the national director of auditing standards for Ernst & Young, Cleveland, Ohio. He is chairman of the American Institute of CPAs auditing standards board and the recipient of the Public Oversight Board's first John J. McCloy award. WILLIAM A. BROADUS, Jr., CPA, is an assistant director of the U.S. General Accounting Office, Washington, D.C. A member of the ASB, he is chairman of the AICPA national government training program committee and a member of the AICPA continuing professional education executive committee. He was the project director for the 1988 revision of the yellow book.