1. Accounting and Auditing Standards Update2006 NSAA/NASC Joint Middle Management Conference Indianapolis, Indiana April 10, 2006

2. Effective Immediately Defining professional standards (SAS 102) Effective for audits of June 30, 2007 F/S Audit documentation (SAS 103) Effective for audits of June 30, 2008 F/S Risk assessment standards (SASs 104 – 111) What Well Cover

3. Whats Coming AICPA Communicating Internal Control Matters (SAS No. 112?) U.S. GAO Government Auditing Standards (ED soon) OMB 2006 Compliance Supplement (Final) What Well Cover

4. Ethics Rulings (Nos. 113 & 114) Ethics Conceptual Framework If Time Permits...

5. Our Objectives As a result of todays session, participants will be able to: Identify the key the concepts for recently issued audit standards Follow and understand the development of current auditing standards projects Consider the impact for auditing (or being audited)

6. SAS No. 102 and SAE 13 Defining Professional Requirements

7. SAS No. 102 and SAE No. 13 Defines terminology to describe degree of responsibility to auditor UnconditionalMust or Is required Presumptively mandatoryShould ExplanatoryDescriptive guidance rather than imperative Applies to existing standards

8. SAS No. 103Audit Documentation

9. Audit Documentation Basics In sufficient detail for an experienced auditor without connection to the audit to understand: Work performed Results of that work Evidence obtained Conclusions reached Accounting records agree or reconcile with the financial statements or other information.

10. Audit Documentation Basics An experienced auditor is one who knows enough, including understanding of: Audit process SASs and legal/regulatory requirements The entitys business environment Auditing and financial reporting issues relevant to the entitys industry.

11. Audit Documentation Basics Oral explanations are not sufficient support for work performed or conclusions reached

12. More Documentation Guidance What should be in or out Electronic media Abstracts and copies Significant findings and issues Superseded drafts and notes Prior versions

13. More Documentation Guidance Identify preparer and reviewer Who performed the audit work The date such work was completed Who reviewed specific documentation The date and extent of such review Document specific items tested

14. New Dates to Remember Field work No earlier than when sufficient evidence exists to support the opinion Audit files assembled Within 60 days after report release Retention Minimum 5 years after report release

15. SAS Nos. 104–111Risk Assessment Suite of Standards

16. Risk Assessment Standards Most far-reaching change in standards in 20 years Issued in March 2006 Amends or revises 8 existing standards

17. Standards Amended or Revised Amends SAS 1, Due Professional Care Amends SAS 95,GAAS Planning and Supervision Understanding the Entity and Assessing Risks Audit Evidence Audit Risk and Materiality Performing Audit Procedures and Evaluating Evidence Amends SAS 39, Audit Sampling

18. Risk Assessment Standards Objectives More in-depth understanding of entity and internal controls More rigorous assessment of risks of misstatement Improved linkage between assessed risks and audit procedures performed

19. Planning and Supervision Enhances guidance on Preliminary activities Audit strategy and plan Establishing understanding with client Communication with Governance

20. Understanding Entity/Assessing Risks Guidance for Gaining understanding about entity Sources of information Discuss internal control components Describe risk assessment process

21. Audit Evidence Enhances guidance on Sufficiency of audit evidence Audit procedures, incl. tests of controls New assertions Class of transactions (5) Account balances (4) Presentation and disclosures (4)

22. New Assertions Class of transactions Occurrence Completeness Accuracy Cutoff Classification

23. New Assertions Account balances Existence Rights and Obligations Completeness Valuation and Allocation

24. New Assertions Presentation and disclosures Occurrence and Rights and Obligations Completeness Classification and Understandability Accuracy and Valuation

25. Risk and Materiality Guidance for Considering risk and materiality at the financial statement level Considering risk and materiality at the transaction, balance, or disclosure level Reassessing materiality as audit progresses

26. Risk and Materiality Evaluating misstatements Known Likely Individually and in the aggregate Iron curtain versus rollover Qualitative

27. Performing Procedures Design procedures that respond to risks Determining overall response Testing controls (encouraged) Substantive tests Evaluate sufficiency of evidence

28. Tests of Controls Auditors cannot default to the Max Tests of effectiveness encouraged Explains when controls must be tested I/C test can be rotated once every 3 years Annual update to confirm no changes Test annually, if changed Lengthy discussion of IT controls

29. Communication of Internal Control Matters Identified in an Audit

30. Communicating Internal Controls New definitions Control deficiency Significant deficiency Material weakness New threshold More deficiencies required to be identified as significant or material

31. Snapshot of the Difference Old DefinitionsNew Definitions Material weakness Reportable condition Significant deficiency Management letter comment Other internal control matter

32. U.S. GAO Temporary Exemptions and Guidance in Response to Hurricanes Katrina and Rita

33. The Quick and Dirty... Temporary exemption for some from: Certain independence standards Peer review requirements Continuing professional education requirements

34. The Quick and Dirty... Guidance for some for: Required audits when auditees records are lost or destroyed Completed or in-process audit documentation lost or destroyed before audit report issued

35. U.S. GAO Plans for Revising Government Auditing Standards

36. Yellow Book Revisions for 2006 GAO drafting Advisory Council reviewing Exposure draft in late April/early May 2006 Version issued late Summer/ early Fall Likely effective for 2007

37. Yellow Book Revisions for 2006 Strengthen audit quality Evidence and data reliability in performance audits Expand categories of nonaudit services Reporting deficiencies in internal control

38. Yellow Book Revisions for 2006 Enhanced ethics discussion Auditors responsibilities for restatements Use of GAGAS with other standards Clarification and clean up

39. Strengthen Audit Quality Objectives Increased emphasis on quality Increased transparency Consideration of peer review and internal inspection quality

40. Strengthen Audit Quality Defines elements of QC system Ethical requirements Acceptance and continuation of audits Human resources Audit performance and reporting Monitoring of quality

41. Strengthen Audit Quality Defines normal monitoring Formal and documented For the entire year Cover all elements of QC system Review of audit documentation Performed by those not performing work Written report and appropriate follow-up

42. Strengthen Audit Quality New external peer review timeframes If the most recent peer review is: AdverseAnnual external review ModifiedAnnual follow-up Unmodified, no enhanced criteria Triennial external review Unmodified, with enhanced criteria Quinquennial external review

43. Strengthen Audit Quality Enhanced monitoring criteria Rigorous annual internal inspection Review independence and human capital Review audits Survey professional staff Formal report to top management Consideration and corrective action

44. Strengthen Audit Quality Enhanced monitoring criteria Transparency: public disclosure of Description of QC system Internal inspection results External peer review opinion and letter of comments

45. Strengthen Audit Quality Enhanced monitoring criteria Other criteria: Most recent external peer review included review of inspection process No major changes No violations or sanctions

46. Evidence and Data Reliability for Performance Audits Objectives Clearly articulate level of assurance in performance audits Improve consistency in practice Update concept of appropriateness of data used as evidence

47. Evidence and Data Reliability for Performance Audits Defining level of assurance Reasonable assurance over answers to audit questions Reasonable assurance of adequate support to achieve objectives Level of assurance and tests of evidence will vary

48. Evidence and Data Reliability for Performance Audits Sufficient, appropriate evidence Replaces sufficient, competent, relevant Previous: competent = valid, reliable Now: appropriate = relevant, reliable, valid

49. Evidence and Data Reliability for Performance Audits New overall assessment of evidence Discussion for evaluating sufficiency and appropriateness Assess data and information used as: Appropriategives reasonable assurance Not appropriateunacceptably high risk for use Undetermined appropriatenesscannot conclude about appropriateness

50. Evidence and Data Reliability for Performance Audits Enhanced reporting Expanded discussion of data assessments in Objectives, Scope and Methodology section Expanded GAGAS citationadds: We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

51. Expand categories of nonaudit services Objectives Clarify other nonaudit services we perform Reiterate need to consider in relation to independence

52. Expand categories of nonaudit services Four new categories on nonaudit services For us, the legislature, or external party Routine activities Providing basic or limited services Activities replacing entity

53. Expand categories of nonaudit services Legislature/othersWould not impair Routine activitiesWould not impair Limited servicesSafeguards needed Replacing entityWould impair

54. Reporting Deficiencies in Internal Control Objectivesconsistency with PCAOB and AICPA Same revisions as AICPAs new revisions New reporting requirements

55. Reporting Deficiencies in Internal Control New reporting guidance Material weaknesses in I/C Report Significant deficiencies Can be in same report Can be in separate report, if issued to same recipients within 45 days

56. Reporting Deficiencies in Internal Control New challenges for auditors Timing of issuing I/C Reportsame as financial statements How to report significant deficienciesin same report or separate? Applying language to single audit

57. Enhanced Ethics Discussion Objectives Clarify ethical requirements Highlights ethical responsibilities Expand discussion of professional judgment

58. Auditors responsibilities for restatements Objectives Provide guidance for growing problem (in federal financial statements) Requires auditors to assess managements judgments, adequacy and timeliness Requires auditors to communicate to entity and others, if entity fails to do so

59. Other Standards and Cleanup Guidance for audits under multiple standards Defining must, should and should consider Sundry other minor items

60. U.S. OMB 2006 Compliance Supplement

61. 2006 Compliance Supplement Will be a complete version Drafts have been circulated Plan to issue soon Appendix V for list of changes

62. Part 3Compliance Requirements Updated to reflect reissuance of Cost Circulars and cost principles Clarify common rule requirements Auditors to be alert for Improper Payments Suspension and debarment changes

63. Part 4Agency Program Requirements Added Food for Peace Program (CFDA 98.008) Changes to Public Works and Economic Development (CFDA 11.300) and Economic Adjustment (CFDA 11.307) Lots of isolated/reference/changes changes

64. Part 5Clusters of Programs Updated R&D cluster for areas of vulnerability Deleted Health Education Assistance Loans (93.108) from SFA Cluster Added eZ-Audit to SFA program requirements

65. App. VIFederal Agency Waivers Recipients affected by Hurricanes Katrina and Rita (& Wilma) Auditors should: Verify waivers Consult Dept.s Internet Home Page Start with Parts 4, 5, or 7, then waivers Report finding if noncompliance and no/invalid waivers

66. App. VIFederal Agency Waivers Part 3Davis-Bacon Act Part 4Table of programs affected by waivers; and details by CFDA No. Part 5SFA Cluster

67. No Changes Part 6Internal control Part 7Guidance when not included App. ICommon Rule exclusions App. IIFederal agency codification App. VIIA-133 advisories App. VIIISAS 70 for EBT

68. Updated References App. IIIFederal agency contacts App. IVInternal references table App. VList of changes App. IXSupplement core team

69. Do we have time?

70. Ethics Rulings No. 113 and 114Gifts or Entertainment

71. Auditors and Gifts or Entertainment An auditor can offer or accept gifts or entertainment from his or her client (or a vendor), and not impair the auditors independence, if The gift is insignificant in value The gift or entertainment is reasonable in the circumstances

72. Whats Reasonable? Circumstances to consider Nature of gift or entertainment Occasion Cost or value Frequency and value of other gifts In or around conducting business Whether others participated Who participated

73. Arizonas Code of Ethics The employee shall not accept or solicit, directly or indirectly, anything of economic value as a gift, gratuity, favor, entertainment, or loan that is or may appear to be designed to in any manner influence official conduct, particularly from a person who is seeking to obtain contractual or other business or financial arrangements with the employing agency, or who has interests that might be substantially affected by the performance or nonperformance of the employee's duty.

74. Arizonas Code of Ethics This provision does not prohibit acceptance by an employee of food and refreshments of insignificant value on infrequent occasions in the ordinary course of a meeting, conference, or other occasion where the employee is properly in attendance, nor the solicitation or acceptance by an employee of loans from banks or other financial institutions on customary terms to finance proper and usual activities of the employee, nor the acceptance of unsolicited advertising or promotional material such as pens, pencils, calendars, and other items of nominal intrinsic value.

75. Ethics Conceptual Framework for Independence Standards

76. Ethics Conceptual Framework Risk-based tool used by Ethics Executive Committee Now can be used by auditors when not addressed in existing rulings and interpretations

77. Risk Based Approach Identify and evaluate threats If threats at acceptable level, no safeguards If threats not at acceptable level, consider safeguards

78. Risk Based Approach Do safeguards eliminate or sufficiently mitigate threat? Use of one or more safeguards against threat One safeguard may eliminate one or more threats If safeguards are unavailable or ineffective, independence is impaired

79. Risk Based Approach Definitions Threats7 types explained Safeguards3 categories Created by profession or regulation Implemented by auditee Implemented by auditor

80. And More to Come! Internal Control AttestationsED Communications with GovernanceED Quality ControlED soon Related PartiesED soon

81. Thats About It! Any Questions?