New Challenges to Auditing 2006 Financial Statements

By James M. Boak, CPA

Various standard setting organizations are repetitively adding new standards that clearly raise the level of complexity of auditing and accounting in today’s business environment. Two of those new standards are Statements on Auditing Standards (SAS) No. 103, Audit Documentation, and No. 112, Communicating on Internal Control Matters Identified in an Audit. Both standards are effective for financial statements for years ending after December 15, 2006. In other words, they are effective for calendar year 2006 financial statements. In addition, while the standards specifically apply to audits of non-public entities, auditors of public companies should be very familiar with the new standards in part as a re-emphasis of many concepts already applicable to public company audits and/or also in consideration of applying some of the new rules to audits of public companies in order to be consistent and more efficient for all audits in their practice. Obviously, where a PCAOB rule is more stringent than a SAS rule, the PCAOB rule must be followed in the audit of a public company.

SAS No. 103 on documentation is an update to SAS No. 96 of the same name, which was hastily issued in 2002 in the wake of the Enron failure. A few of the highlights of SAS NO. 103 are:

• Work paper documentation must be fully understandable by an outside ‘experienced auditor’ without need for oral explanation
• Nature and extent of audit documentation is strictly specified
• Any departures from SAS’s and other ‘contradictory’ issues must be documented
• Preparation and review dates and persons involved must be documented
• Minimum period of time for work paper retention (5 years for private entities)
• Audit documentation must be completed within (and not changed after) a relatively short period from the issuance date of the audit opinion (60 days for private entities)
• Audit opinion must be dated no later than the date that (1) the auditor obtained sufficient audit evidence including internal review, (2) the financial statements have been prepared and (3) management’s written assertion of responsibility has been obtained

This last element is especially significant because it changes the prior practice promulgated by SAS No. 1 under which the audit report was dated as of the last day of ‘fieldwork’. As Messrs. Whittington, Graham, Fischbach and Ahern point out in their article, Advancing the Audit Standard (Journal of Accountancy, June 2006), “In some cases the report date will still coincide with the date fieldwork is completed. But in many others, the extent of remaining work … will cause the auditor to use a date after the fieldwork completion date. If the report is dated later than before, this increases the period that is subject to … subsequent events work.” The practical implication of SAS No. 103 is that the final fieldwork, partner review(s), final financial statement preparation, management signature on the representation letter, date of the opinion and date the auditor releases the opinion must be reasonably proximate in time. (See paragraph 12 of SAS No. 103.)

SAS No. 112 on so-called management letters replaces SAS No. 60 of the same name and also contains a few but significant changes over previous practice.

Several key elements of SAS No. 112 are:

• • The concept of ‘significant deficiency’ replaces ‘reportable condition’ but its definition is much more complex including partial reliance on FASB No. 5 probability concepts
• The inclusion in a management letter is based on the severity of a significant deficiency related to its potential for causing misstatement
• The communication must be written

Several subtle but important points bear further consideration aside from the definitional elements. First, a significant deficiency must be considered for communication based on whether it has the potential for causing a misstatement instead of simply based on whether a failure has occurred. This change means that poorly designed internal controls encountered in an audit (as well as actual failures in execution of controls) must be analyzed for inclusion in the management letter. The practical effect of this change is that the scope and content of a management letter will significantly increase and management letters will be much longer. Second, not only must the management letter communication now be in writing but it must be accomplished preferably at the date of audit report release and not latter than 60 days after such release. This means for many practitioners that management letters must be issued at much earlier dates than in the past.

For many practitioners, the above changes in practice and procedures will likely cause significant time compression and stress in the completion of 2006 financial statement audits. Additional training will help. However, to ultimately meet the new standards, auditors must focus on allocating sufficient hours and timing to accomplish the increased procedures and workload at audit end. This will be a new challenge for many but can more easily be achieved with careful planning and coordination of work with company well before the start of fieldwork.