GAO Issues Interim Guidance Addressing Recent Issuance of SAS No. 115 and SSAE No. 15

DEAR CENTER MEMBERS Today, the Government Accountability Office (GAO) issued interim guidance on complying with Government Auditing Standards (the Yellow Book or GAS) in conjunction with the following newly-issued AICPA standards:  Statement on Auditing Standards (SAS) No. 115 (AU section 325), Communicating Internal Control Related Matters Identified in an Audit (which superseded SAS No. 112 of the same name) Statement on Standards for Attestation Engagements (SSAE) No. 15  (AT 501), An Examination of an Entity’s Internal Control Over Financial Reporting That Is Integrated With an Audit of Its Financial Statements (which supersedes extant AT section 501, Reporting on an Entity’s Internal Control Over Financial Reporting) The guidance can be accessed on the Yellow Book page of the GAO Web site by clicking here.    Why the Need for this Interim Guidance? The issuance of the AICPA standards noted above resulted in differences in the internal control definitions used in the new AICPA standards and the July 2007 revision of GAS. The July 2007 Yellow Book includes definitions of the terms material weakness and significant deficiency that were based on SAS No. 112.  As noted in GAQC Alert #92, the issuance of SAS No. 115 revised the definitions of the terms material weakness and significant deficiency that had been previously been established in SAS No. 112.  The issuance of SSAE No. 15 similarly revised the definitions of these terms for internal control examination attestation engagements. GAQC Alert #92 explains the reasons for the definitional changes.   What is the Interim Guidance? GAO states that the purpose of its guidance is to facilitate reporting of internal control deficiencies identified in engagements performed under GAS and the new AICPA standards and to assist auditors in complying with GAS until the next update of the Yellow Book.  The following interim guidance is provided for complying with the internal control reporting requirements of GAS:   Auditors may satisfy the internal control reporting requirements in GAS paragraph 5.11 by including in the Yellow Book report on internal control all identified material weaknesses and significant deficiencies following the new definitions and requirements from SAS No. 115 and SSAE No. 15, as applicable, providing those definitions, and describing the scope of testing performed on the entity’s internal control over financial reporting. Auditors are reminded to comply with all other relevant GAS requirements related to reporting deficiencies in internal control, such as developing findings and providing recommendations for corrective action if findings are sufficiently developed (GAS paragraphs 5.21 and 6.42), obtaining views of responsible officials (GAS paragraphs 5.32 through 5.38 and 6.44 through 6.50), and ensuring appropriate report distribution (GAS paragraphs 5.44 and 6.56).  When is the Interim Guidance Effective? The GAO guidance becomes effective concurrent with the auditors’ implementation of SAS No. 115 and/or SSAE 15.  As noted in GAQC Alert #92, SAS No. 115 is effective for audits of financial statements for periods ending on or after December 15, 2009, with earlier implementation permitted. SSAE No. 15 is effective for integrated audits for periods ending on or after December 15, 2008, with earlier implementation permitted. The GAO guidance does state that the Comptroller General’s Advisory Council on Government Auditing Standards will fully deliberate this issue in conjunction with the next GAS update, at which time the interim guidance may change.   Implications for Your Governmental Audits In GAQC Alert #92, we had cautioned member firms that SAS No. 115 could not be implemented early for audits performed under Government Auditing Standards, Office of Management and Budget (OMB) Circular A-133, Audits of States, Local Governments, and Non-Profit Organizations (Circular A-133), and other similar compliance audit requirements (e.g., the U.S. Department of Housing and Urban Development Consolidated Audit Guide), until such time as the underlying standards and regulations were updated.  With GAO’s issuance of this interim guidance, it is now permissible for auditors to implement SAS No. 115 on their financial statement audits performed under Government Auditing Standards and on internal control examinations performed under SSAE No. 15.  However, members should keep in mind that Circular A-133 and other similar federal regulations or audit guides have not yet been updated to reflect new internal control definitions for reporting on internal control over compliance. Therefore, it would not be appropriate for auditors to use definitions for reporting on internal control over compliance that may be consistent with the definitions found in SAS No. 115 until such time as Circular A-133 or other regulations or guides are amended to allow usage of new updated definitions. The GAQC staff is in the process of beginning to work with OMB and other federal agencies that require reporting on internal control over compliance to determine the changes needed to their regulations and/or federal audit guides as a result of the new AICPA standards. We will inform you in future Center communications and through status updates on our Web site as to progress made in this area by OMB and other federal agencies.    # # # # #   Sincerely,   AICPA Governmental Audit Quality Center   Back to top  STAY INFORMED As a member of the Center, your firm will receive periodic updates on important developments related to governmental audits, as well as the activities of the Center. To stay abreast of these and other relevant events, please visit the Center Web site at gaqc.aicpa.org. Also, we welcome any suggestions or questions. Please send them by e-mail to GAQC@aicpa.org. Back to top Members of the Governmental Audit Quality Center (GAQC) may only reproduce and distribute GAQC e-alerts internally within a firm to other Center member firm personnel as part of the firm's professional services. For information about permission to copy any part of these documents for redistribution or inclusion in other work, please click on the copyright notice at the bottom of the page or phone the AICPA copyright permission hotline (919) 402-4031. ©2008 The American Institute of Certified Public Accountants, ISO 9001 Certified. AICPA Online privacy policies and copyright information. AICPA, 1211 Avenue of the Americas, New York, NY 10036  Back to top