How does an auditor report under SAS No. 63 when SAS No. 55 hasn't been adopted?

HOW DOES AN AUDITOR REPORT UNDER SAS NO. 63 WHEN SAS NO. 55 HASN'T BEEN ADOPTED?

SAS no. 55 becomes effective for audits of financial statements for periods beginning on or after January 1, 1990. But SAS no. 63 is effective for audits of compliance with laws and regulations for periods starting on or after January 1, 1989. In this article Patrick McNamee, CPA, director, audit and accounting guides, American Institute of CPAs, New York, describes how to report during the interim period before SAS no. 55 is adopted. The yellow book, Government Auditing Standards, issued by the comptroller general of the United States, set certain requirements for auditors' reports on the internal control structure that differ from those contained in SAS no. 60, Communication of Internal Control Structure Related Matters Noted in an Audit. Most of these different requirements are discussed in SAS no. 63, Compliance Auditing Applicable to Governmental Entities and Other Recipients of Governmental Financial Assistance.

One of the yellow book's provisions calls for auditors to describe in the internal control report the scope of their internal control work. SAS no. 63 says auditors may satisfy this requirement by stating they have

1. Obtained an understanding of relevant internal control structure policies and procedures and whether those policies and procedures have indeed been placed in operation.

2. Assessed control risk.

This description of the scope of the auditor's consideration of the internal control structure is based on the provisions of SAS no. 55, Consideration of the Internal Control Structure in a Financial Statement Audit.

Thus, using SAS no. 63's suggested wording implies auditors did internal control work in accordance with SAS no. 55, which isn't effective until a year later--for audits of statements for periods beginning on or after January 1, 1990.

If the auditor hasn't yet implemented SAS no. 55, he or she should not use the reporting language illustrated in SAS no. 63. Rather, the description of the scope of the auditor's work should be based on the provisions of AU section 320, "The Auditor's Study and Evaluation of Internal Control," of AICPA Professional Standards. Here's an example:

"Our consideration of the internal control structure included all of the control categories listed above except that we did not evaluate the internal control structure over [identify any category not evaluated] because [state reasons for excluding any category from the evaluation]. The purpose of our consideration of the internal control structure was to determine the nature, timing and extent of the auditing procedures necessary for expressing an opinion on the general purpose financial statements."

If the auditor hasn't studied and evaluated any significant category of the internal control structure beyond the preliminary review phase described in AU sections 320.53 to 320.55, the following description of the scope of the auditor's work should be used:

"Solely to assist us in planning and performing our audit, we made a study and evaluation of the internal control structure of City of Example, Any State. That study and evaluation was limited to a preliminary review of the structure to obtain an understanding of the control environment and the flow of transactions through the accounting system. Because [state reason], our study and evaluation did not extend beyond this preliminary review phase."

This updated report language, as well as revisions to the reports illustrated in the American Institute of CPAs audit and accounting guide, Audits of State and Local Governmental Units, is presented in Statement of Position no. 89-6, Auditors' Reports in Audits of State and Local Governmental Units. This new SOP (product number 014836) is available from the AICPA order department.

Patrick McNamee, CPA director, audit and accounting guides American Institute of CPAs New York, New York