By George R. Young

Statement on Auditing Standards (SAS) 96 expands guidance for audit documentation. In particular, the new SAS identifies six factors that the auditor should consider when determining the quantity, type, and content of audit documentation. These factors, plus the examples of significant findings or issues that could affect the extent of audit documentation, make the new SAS particularly helpful. Statement on Standards for Attestation Engagements (SSAE) 11 provides broader, yet similar, guidance for documentation of attestation engagements. The tandem issuance of SAS 96 and SSAE 11 not only conforms audit and attestation standards, it further facilitates the broadening of services.

Background

It has been almost 20 years since the issuance of SAS 41, Working Papers, which specified the function, nature, content, and ownership of working papers. SAS 96, Audit Documentation (AICPA, Professional Standards, vol. 1, AU section 339), includes new guidance for auditors, including a more substantive list of factors that should be considered when auditors determine the nature and extent of audit documentation. Also recognized is the broader means of documenting audit evidence by using the term audit documentation, rather than the previously used term, working papers.

SSAE 11, Attest Documentation, represents an amendment to SSAE 10 (AICPA Professional Standards, vol. 1, AT section 101-701). By using an approach that mirrors the expansion of guidance provided to auditors in SAS 96, SSAE 11 expands documentation guidance for practitioners engaged in attestation engagements. SAS 96 is a specific application of the broad provisions of SSAE 11, and the two standards are virtually identical except that SSAE 11 requires documentation of an entity’s process for developing its prospective financial statements when determining the scope of the examination. Because SAS 96 and SSAE 11 are so similar and because SAS 96 provides more specific guidance, only the provisions of SAS 96 are discussed in this article.

The new SAS does not change the specific documentation requirements contained in other standards, such as in SAS 1, Codification of Auditing Standards and Procedures, regarding the auditor’s documentation of the understanding with the client, and in SAS 85, Management Representations, related to the proscription to obtain certain written representations from management. It affects previously issued pronouncements in the areas of audit risk and materiality, analytical procedures, and going concern.

This newly issued SAS is effective for financial statement audits covering periods that begin on or after May 15, 2002. SSAE 11 is effective for attest engagements that address either a matter or an assertion that exists at or is for a period ending on or after May 15, 2002. Early application of SAS 96 and SSAE 11 is permitted.

Purposes of Audit Documentation

The new SAS reiterates that audit documentation serves to provide principal support for the auditor’s report and to demonstrate that the fieldwork standards of planning the audit, supervising assistants, obtaining sufficient understanding of client internal controls, and accumulating sufficient competent evidence were met. Audit documentation also assists auditors in conducting and supervising the audit.

Audit documentation helps the auditor perform the audit by providing an organized, coherent map of the nature, timing, and extent of tests performed and conclusions reached, so that a sufficient evaluation of the adequacy of the examination can be made. According to SAS 96, audit documentation is the principal record of the procedures applied, the evidence obtained, and the auditor’s conclusions.

Professional standards require CPA firms to establish policies and procedures to ensure that they meet professional standards, including generally accepted auditing standards (GAAS) and regulatory requirements [see Statement on Quality Control Standards (SQCS) 2, System of Quality Control for a CPA Firm’s Accounting and Auditing Practice (AICPA, Professional Standards, vol. 2, QC section 20)]. SAS 96 indicates that the review of audit documentation and discussions that take place between reviewers and engagement team members are among procedures a CPA firm performs to determine whether it has complied with the quality control policies and procedures it has established.

Factors the Auditor Should Consider

Whereas SAS 41 stated that the quantity, type, and content of working papers vary according to circumstances, SAS 96 explicitly recognizes the role of professional judgment in determining the quantity, type, and content of audit documentation. The auditor exercises professional judgment by considering several factors when determining the nature and extent of audit documentation for an audit area or procedure:

According to SAS 96, audit documentation should include abstracts (or copies) of certain documents, such as important contracts or agreements, if provisions of these documents were used to evaluate how well the client accounted for significant transactions.

Other Considerations When Documenting Evidence

SAS 96 specifically requires, for tests of controls and substantive tests, that the documentation of audit procedures involving the inspection of documents or confirmation of balances should include an identification of the items tested. This identification should encompass the source from which the items were selected and the selection criteria used by the auditor. The following examples are given:

The auditor should also document significant audit findings or issues, actions taken to address these findings and issues, and the basis for final conclusions. The new SAS provides examples of significant findings or issues that could affect the extent of audit documentation:

While the new SAS contains the customary examples of audit documentation, such as audit programs, analyses, letters of confirmation and representation, memoranda, copies of documents, and schedules, it now recognizes that this documentation may be in electronic form. Regardless of its form, members of the engagement team charged with supervision and review should be able to determine from the audit documentation the nature, timing, and extent of audit procedures performed and the evidence gathered by the auditor. Adequate audit documentation includes an indication of the persons who performed the procedures and the persons who reviewed the documentation. SAS 96 also requires that audit documentation should demonstrate that the financial statements (or other information on which the auditor is reporting) agree or can be reconciled with the accounting records.

Ownership and Confidentiality

Consistent with SAS 41, SAS 96 reiterates that the auditor owns the audit documentation and that auditors should adopt reasonable procedures to retain this documentation as long as the information contains benefit for the CPA firm and satisfies legal and regulatory requirements. The adopted procedures should allow the auditor to have access to electronic audit documentation throughout the period the documentation is retained.

The auditor should adopt reasonable procedures to prohibit unauthorized access to audit documentation, and has an ethical and, in some situations, a legal and regulatory obligation to maintain confidentiality of client information. Finally, auditors are cautioned that some audit documentation may, as a reference, be useful to clients, but should never be viewed as part of, or a substitute for, client accounting records.

Effect on Other Pronouncements

Three previously issued pronouncements are affected by SAS 96. These three pronouncements relate to audit risk and materiality, analytical procedures, and going concern.

Audit risk and materiality. SAS 96 amends SAS 47, Audit Risk and Materiality in Conducting an Audit (AICPA, Professional Standards, vol. 1, AU section 312), by requiring the auditor to document the nature and effect of aggregated misstatements. In addition, the auditor should document his or her conclusion as to whether the aggregated misstatements cause the financial statements to be materially misstated.

Analytical procedures. A new amendment to SAS 56, Analytical Procedures (AICPA, Professional Standards, vol. 1, AU section 329), requires the auditor to document the use of analytical procedures when they are used as the principle substantive test. Specifically, auditors must document their expectations and the factors they considered when developing them if they are not easily determined from the documented work. The auditor should also document the results of comparing these expectations to recorded amounts (or ratios obtained from recorded amounts), and any additional auditing procedures applied (and their results) when unexpected differences are encountered.

Going concern. SAS 96 adds new documentation requirements as an amendment to SAS 59, The Auditor’s Consideration of an Entity’s Ability to Continue as a Going Concern (AICPA, Professional Standards, vol. 1, AU section 341). The auditor is now required to document the conditions that substantiated the substantial doubt that the entity would continue to exist, elements of management’s plans that appear to be particularly important in overcoming the adverse results produced by the conditions that led to the substantial doubt, and the audit procedures performed and evidence gathered to evaluate these elements. The auditor is also required to document conclusions whether substantial doubt about the entity’s continuance still exists or is alleviated after the investigation of management’s plans.

The auditor should also document the possible effects of the conditions or events on the financial statements and whether disclosure of the conditions and events that caused the substantial doubt is needed in the financial statements (including the footnotes) and the audit report. If client disclosures appear inadequate, the auditor should document conclusions whether a qualified or adverse audit opinion should be expressed.