United States Government Accountability Office By the Comptroller General of the United States July 2018 GOVERNMENT AUDITING STANDARDS 2018 Revision GAO-18-568G United States Government Accountability Office By the Comptroller General of the United States July 2018 GOVERNMENT AUDITING STANDARDS 2018 Revision The 2018 revision of Government Auditing Standards is effective for financial audits, attestation engagements, and reviews of financial statements for periods ending on or after June 30, 2020, and for performance audits beginning on or after July 1, 2019. Early implementation is not permitted. The 2018 revision of Government Auditing Standards supersedes the 2011 revision (GAO-12-331G, December 2011), the 2005 Government Auditing Standards: Guidance on GAGAS Requirements for Continuing Professional Education (GAO-05-568G, April 2005), and the 2014 Government Auditing Standards: Guidance for Understanding the New Peer Review Ratings (D06602, January 2014). The 2018 revision should be used until further updates and revisions are made. An electronic version of this document can be accessed on GAO’s Yellow Book web page at http://www.gao.gov/yellowbook. GAO-18-568G Contents Letter 1 Chapter 1: Foundation and Principles for the Use and Application of Government Auditing Standards 3 Introduction 3 Types of GAGAS Users 6 Types of GAGAS Engagements 7 Financial Audits 7 Attestation Engagements and Reviews of Financial Statements 9 Performance Audits 10 Terms Used in GAGAS 15 The GAGAS Format 16 Chapter 2: General Requirements for Complying with Government Auditing Standards 18 Complying with GAGAS 18 Relationship between GAGAS and Other Professional Standards 20 Stating Compliance with GAGAS in the Audit Report 22 Chapter 3: Ethics, Independence, and Professional Judgment 25 Ethical Principles 25 The Public Interest 26 Integrity 26 Objectivity 27 Proper Use of Government Information, Resources, and Positions 27 Professional Behavior 28 Independence 28 GAGAS Conceptual Framework Approach to Independence 31 Provision of Nonaudit Services to Audited Entities 43 Consideration of Specific Nonaudit Services 50 Documentation 57 Professional Judgment 58 Chapter 4: Competence and Continuing Professional Education 63 Competence 63 Continuing Professional Education 67 Page i GAO-18-568G Government Auditing Standards Chapter 5: Quality Control and Peer Review 81 Quality Control and Assurance 81 System of Quality Control 81 Leadership Responsibilities for Quality within the Audit Organization 82 Independence, Legal, and Ethical Requirements 82 Initiation, Acceptance, and Continuance of Engagements 84 Human Resources 84 Engagement Performance 86 Monitoring of Quality 91 External Peer Review 96 Additional Requirements for Audit Organizations Not Affiliated with Recognized Organizations 102 Chapter 6: Standards for Financial Audits 109 Additional GAGAS Requirements for Conducting Financial Audits 109 Compliance with Standards 109 Licensing and Certification 110 Auditor Communication 110 Results of Previous Engagements 111 Investigations or Legal Proceedings 112 Noncompliance with Provisions of Laws, Regulations, Contracts, and Grant Agreements 112 Findings 113 Audit Documentation 116 Availability of Individuals and Documentation 117 Additional GAGAS Requirements for Reporting on Financial Audits 118 Reporting the Auditors’ Compliance with GAGAS 118 Reporting on Internal Control; Compliance with Provisions of Laws, Regulations, Contracts, and Grant Agreements; and Instances of Fraud 119 Presenting Findings in the Audit Report 121 Reporting Findings Directly to Parties outside the Audited Entity 122 Obtaining and Reporting the Views of Responsible Officials 123 Reporting Confidential or Sensitive Information 125 Distributing Reports 126 Page ii GAO-18-568G Government Auditing Standards Chapter 7: Standards for Attestation Engagements and Reviews of Financial Statements 127 Examination Engagements 128 Compliance with Standards 128 Licensing and Certification 129 Auditor Communication 129 Results of Previous Engagements 130 Investigations or Legal Proceedings 130 Noncompliance with Provisions of Laws, Regulations, Contracts, and Grant Agreements 131 Findings 132 Examination Engagement Documentation 135 Availability of Individuals and Documentation 136 Reporting the Auditors’ Compliance with GAGAS 136 Reporting Deficiencies in Internal Control 137 Reporting on Noncompliance with Provisions of Laws, Regulations, Contracts, and Grant Agreements or Instances of Fraud 138 Presenting Findings in the Report 139 Reporting Findings Directly to Parties outside the Audited Entity 139 Obtaining and Reporting the Views of Responsible Officials 140 Reporting Confidential or Sensitive Information 142 Distributing Reports 143 Review Engagements 144 Compliance with Standards 144 Licensing and Certification 144 Noncompliance with Provisions of Laws, Regulations, Contracts, and Grant Agreements 145 Reporting Auditors’ Compliance with GAGAS 145 Distributing Reports 146 Agreed-Upon Procedures Engagements 147 Compliance with Standards 147 Licensing and Certification 147 Noncompliance with Provisions of Laws, Regulations, Contracts, and Grant Agreements 148 Reporting Auditors’ Compliance with GAGAS 148 Distributing Reports 149 Reviews of Financial Statements 150 Compliance with Standards 150 Licensing and Certification 150 Noncompliance with Provisions of Laws, Regulations, Contracts, and Grant Agreements 151 Page iii GAO-18-568G Government Auditing Standards Reporting Auditors’ Compliance with GAGAS 151 Distributing Reports 152 Chapter 8: Fieldwork Standards for Performance Audits 154 Planning 154 Auditor Communication 158 Investigations or Legal Proceedings 159 Results of Previous Engagements 160 Assigning Auditors 160 Preparing a Written Audit Plan 161 Conducting the Engagement 162 Nature and Profile of the Program and User Needs 162 Determining Significance and Obtaining an Understanding of Internal Control 165 Assessing Internal Control 168 Internal Control Deficiencies Considerations 169 Information Systems Controls Considerations 171 Provisions of Laws, Regulations, Contracts, and Grant Agreements 174 Fraud 175 Identifying Sources of Evidence and the Amount and Type of Evidence Required 177 Using the Work of Others 177 Supervision 179 Evidence 179 Overall Assessment of Evidence 185 Findings 186 Audit Documentation 190 Availability of Individuals and Documentation 192 Chapter 9: Reporting Standards for Performance Audits 194 Reporting Auditors’ Compliance with GAGAS 194 Report Format 195 Report Content 195 Reporting Findings, Conclusions, and Recommendations 199 Reporting on Internal Control 201 Reporting on Noncompliance with Provisions of Laws, Regulations, Contracts, and Grant Agreements 203 Reporting on Instances of Fraud 204 Reporting Findings Directly to Parties outside the Audited Entity 204 Page iv GAO-18-568G Government Auditing Standards Obtaining the Views of Responsible Officials 206 Report Distribution 207 Reporting Confidential or Sensitive Information 208 Discovery of Insufficient Evidence after Report Release 210 Glossary 211 Acknowledgments 222 Comptroller General’s Advisory Council on Government Auditing Standards (2016-2020) 222 GAO Project Team 223 Staff Acknowledgments 223 Figures Figure 1: Generally Accepted Government Auditing Standards Conceptual Framework for Independence 61 Figure 2: Independence Considerations for Preparing Accounting Records and Financial Statements 62 Figure 3: Developing Peer Review Communications for Observed Matters in Accordance with Generally Accepted Government Auditing Standards 108 Figure 4: Consideration of Internal Control in a Generally Accepted Government Auditing Standards Performance Audit 193 Page v GAO-18-568G Government Auditing Standards Abbreviations AICPA American Institute of Certified Public Accountants AR-C AICPA Codification of Statements on Standards for Accounting and Review Services AT-C AICPA Codification of Statements on Standards for Attestation Engagements AU-C AICPA Codification of Statements on Auditing Standards CPA certified public accountant CPE continuing professional education GAGAS generally accepted government auditing standards IAASB International Auditing and Assurance Standards Board IT information technology OMB Office of Management and Budget PCAOB Public Company Accounting Oversight Board SAS Statements on Auditing Standards SSAE Statements on Standards for Attestation Engagements This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Page vi GAO-18-568G Government Auditing Standards Letter 441 G St. N.W. Comptroller General Washington, DC 20548 of the United States Audits provide essential accountability and transparency over government programs. Given the current challenges facing governments and their programs, the oversight provided through auditing is more critical than ever. Government auditing provides the objective analysis and information needed to make the decisions necessary to help create a better future. The professional standards presented in this 2018 revision of Government Auditing Standards (known as the Yellow Book) provide a framework for performing high-quality audit work with competence, integrity, objectivity, and