A DETAILED LOOK

Substantial literature is availble describing, in general, the nature of peer review findings, case examples of the benefits of peer review and its historical development, and the interaction between the profession and regulators. Differences exist in the way commentators have categorized and interpreted these findings. Some, for example, make no distinction between a lack of documentation of supervision and a lack of documentation of whether an audit step has been completed. Given the legal role of working papers, there seem to be benefits obtained by distinguishing such matters, beyond merely expressing a concern for documentation per se.

This article avoids generalizations by presenting sufficient detail in describing the nature and implications of letters of comment (LOC) so as to facilitate action. Specificity has led to presenting clear directives for improving quality control. The directives have been formulated from a study of the AICPA public peer review files from 1980 through the first quarter of 1986. All the LOCs on file accompanying peer review reports of SECPS members have been read and coded as to the subject matter of findings.

ACCEPTANCE AND

CONTINUANCE OF CLIENTS

More than a quarter of the LOCs contained a finding related to relationship with clients. The most prevalent problem, reflected in 20% of the filings, was associated with client acceptance and retention policies. Often, no formal documentation was available concerning acceptance and retention decisions and when available, it often was not applicable to smaller engagements requiring fewer than 300 hours. The directives from such findings include:

* The firm's quality control document should specify acceptance and continuation criteria (e.g., consideration of the clients' financial history and inquiries of bankers and attorneys), decision processes, and modes of documentation, including required approval of client acceptance;

* The documentation should be completed for all clients, regardless of size; and

* Self-monitoring of compliance with the quality control document should be exercised, particularly as to modes of documentation.

Once the decision is made to accept or retain a client, the next step is expected to be an engagement letter. However, its absence was a finding in over 5% of the LOCs. Frequently given reasons were that an engagement letter was not required after the initial engagement or was not required on all clients. Yet, misunderstandings as to the extent of services to be performed can arise in subsequent periods, and clarification of the nature of the service provided may well be of greatest importance for smaller engagements.

One firm had a set policy of not having an engagement letter for compilation and review engagements of fewer than 40 hours. Such a policy is hard to understand given the rather nominal time required to tailor an engagement letter to a particular client. Moreover, such limited scope engagements can be the source of confusion, as detailed in past litigation and the horror stories of numerous practitioners and clients. Research suggests that many small clients refer to their CPAs as providing audits, when in fact only review services or compilations are provided. It seems to be in everyone's interest to clarify the nature of each professional arrangement.

Unfortunately, some firms obtain engagement letters, but they are incomplete. The purpose of quality control is not only to establish documentation of the process, but also to avoid errors and omissions. The second set of directives inferred from the LOCs are:

* Establish a firm practice of obtaining engagement letters for all client services, no matter how limited the scope; and

* Be certain such engagement letters are tailored to the specific engagement and do not omit critical details as to the nature of the service commitments, as well as responsibilities undertaken and not undertaken.

LETTERS OF

REPRESENTATION

Just as clarity is essential in engagement letters, it is imperative under GAAS to obtain a letter of representation from clients. Yet, findings tied to the absence or limitations of representation letters appeared in almost 8% of the LOCs. Limitations included key omissions in the representation letters, such as no representation as to subsequent events and no signature by the client! Other limitations related to the dating of the letters of representation. Some letters omitted dates, were dated after the engagement, or were dated too early relative to the completion of the CPA's work. The use of a boilerplate form for representation letters at times led to insufficient tailoring of the representations to the engagement. The directives include:

* Require that a complete representation letter be obtained, with both date and signature commensurate with the engagement requirements;

* Establish a review procedure to ensure inclusion in files of a complete and timely representation letter; and

* Take care in training to attune professional staff to the need to tailor boilerplate representation letters to peculiarities of each engagement.

INTERNAL CONTROL

COMMUNICATIONS

A common practice of CPAs is to communicate verbally and/or in writing the nature of internal control problems and opportunities for improvement available to clients. However, in 4% of the LOCs, concern was expressed as to the lack of such communication to clients on internal control matters or problems associated with such potential or actual communications. This was seen by peer reviewers as particularly troublesome when material weaknesses had been identified in the working papers. The decisions to verbally communicate were neither documented nor followed through to ensure the client was appropriately informed. These concerns lead to questions concerning compliance with GAAS. Even when decisions were made to communicate in writing, a review of such letters uncovered shortcomings in the nature of the communications.

Although recent SASs have altered the form of presentation of communications with clients and others, the lessons of past LOCs direct that firms:

* Clearly document their intentions as to verbal or written communication with clients on internal control matters.

* Assign responsibility to follow through on either decision and carefully document the process upon completion of the communication to avoid any ommissions.

* When management letters are issued, establish a review process to evaluate them for completeness, propriety, and clearness before sending the communication to clients; and

* Now that reportable conditions have evolved in tandem with the more traditional concept of material weakness, the nature of communication with clients will require more carefull scrutiny to ensure adequate compliance with professional standards.

INDEPENDENCE ISSUES

Presumably, before an engagement of an attest nature begins, the independents status of the firm and engagement team should be effectively evaluated. However, in over 15% of the LOCs, problems arose in this regard. Most often, there was an absence of a routine confirmation of independence by staff, or an absence of assurance that another firm helping on an engagement was independent. However, there were occasions in which it was found that a partner lacked independence or that the appearance of independence was present due to firm members and family members being on boards of not-for-profit clients. The LOCs suggest a need to:

* Assure periodic use and completion of confirmation procedures concerning independence to ensure their adequacy; and

* Integrate independence guidelines into the training and inspection process to avoid impairment.

SUPERVISION OF AUDIT

PERFORMANCE

Planning the Audit

Many of the files contained findings on this topic. Specifically, an absence of a detailed plan of who would be on a job, whether that staff assignment was approved, and whether consideration had been given to issues of "agreed-upon procedures," surprise visits, and staffing requirements characterized the findings. Although budgeting is not generally a quality issue, there were budgeting questions that entailed whether the budget was reasonable, why comparisons of budget to actual had not been made, and why explanations of discrepancies were not in the working papers.

The directive of such findings is:

* Ensure that the planning process includes staff assignment, resource, timing, and budget considerations, as well as commitments for added "agreed-upon procedures."

Work Programs

Approximately 13% of the LOCs expressed problems with either not having a program for an audit or a review engagement, or not appropriately tailoring that program to the engagement. As a result, there could be omissions of key steps. These findings also pointed out that some steps of the audit or review process were not appropriately signed off, which in the absence of adequate working paper documentation to the contrary imply a lack of assurance that such steps were ever performed. Furthermore, instances in which review points had not been cleared left questions as to whether such work had been completed but merely left undocumented.

Supervision of Field Work

Five percent of the LOCs contained findings related to the actual supervision of work, both of the audit process and of work by internal audit. By and large, the concern was that the quality control document either did not deal with supervision or gave too much discretion to engagement auditors or team leaders, some of whom were not partners. Due to inadequate documentation in the workpapers, it was at times difficult to infer the extent of the engagement partners' involvement in the supervision of the planning process, as well as field work. The directive from such findings include:

* In addition to documenting work performed on an engagement, be certain to document how that work was supervised, at each stage of the process and by whom; and

* Such attention is needed both for the audit process and for work done under the supervision of the audit team by internal auditors.

Internal Control

A most pervasive finding to content (about 12% of the LOCs on file) related to internal control assessments. Specifically, some engagements did not document why the professional staff judged that internal control could not be relied upon to some extent or, where internal control could be relied upon but was not, decided to use an all substantive approach for efficiency reasons. Many failed to tie the tests of control to the subsequent substantive test work. Instances of testing controls without any apparent reliance were noted. Additional problems seemed to arise when EDP processing of transactions was present, particularly outside EDP service bureaus or organizations. About 8% of filings referred to an EDP-related concern.

Sampling

Almost as troublesome as the internal control area was the application of sampling tools, also cited in about 12% of the LOCs. Problems included an absence of any firm practice on the use of statistical tools and noncompliance with GAAS, particularly the provisions of SAS 39. Errors in designing sampling plans and making inferences were cited.

Analytical Procedures

Another conspicuous area in which substantial problems were noted involved the use of analytical procedures; over seven percent of the LOGs referred to this area. Specifically, such procedures tended to be inadequately documented or not applied to key aspects of the audit.

Review of Work

About 20% of the files contain a finding involving issues related to the absence of review by partners or by an independent party. Another common problem is that sign-offs are not appropriately documented. One finding noted that there was no indication of partner review of prior year workpapers, while another noted that one firm does not review the final draft of a 10-K prior to issue. Public files imply that:

* Care is needed to document the review process in a comprehensive manner, particularly pre-issuance (second or concurring partner) reviews; and

* The initialling and dating of review steps are critical facets of evidencing appropriate review and should not only be emphasized in the quality control documentation and training, but also should be monitored priodically through inspection.

Areas of Risk in Which

Audit Steps Were

Cited as Inadequate

Beyond key types of procedures, such as those related to controls, sampling, and analytical procedures, numerous findings, ranging from 1% to 4% of the LOCs on file, concerned related parties, subsequent events, and confirmations. Absence of attention to these areas, incomplete procedures, or inadequate documentation of work performed characterized the findings. The specific concerns with respect to related parties were the possibility of inadequate identification of related parties and inadequate documentation relative to related-party transactions.

In addition to these concerns, findings were cited involving: communications with predecessor auditors; documentation of the use of internal auditors; the allocation of income tax in a manner not in accordance with professional standards; the absence of a schedule of unrecorded as well as recorded adjustments for each engagement; inadequate confirmation of investments; timelines of attorney's letters used in the search for contingencies; an absence of accruals for compensated absences; and a lack of documentation of compliance with quality control procedures associated with long-term debt and pension plan disclosures. Global comments included: "documentation of decisions relating to accounting principles and auditing procedures could be improved;" and the need to "inform firm attorney of significant matters" existed. Among the findings was a constant theme that attention to specific accounting principles was lacking, particularly as they may have related to an industry standard, such as for a not-for-profit entity. In addition, there was concern that communication to the managing partner was not sufficiently comprehensive. The disclosure issues were principally the total lack of use of disclosure checklists. Moreover, financial statement checklists had been signed subsequent to the issuance of the report, suggesting a quality control in form only, rather than in substance.

The directives from the findings relate to two key dimensions:

* Training is needed with respect to the aggregation of evidence from tests of controls and substantive tests, as well as the application of tools of analysis relating to EDP, sampling, and analytical procedures; and

* Care must be taken to establish and monitor controls over complex aspects of the audit and reporting process.

Other Findings on

Documentation

As noted earlier many findings relate purely to documentation without giving question as to whether the actual underlying audit step had in fact been performed. These findings appeared in over a third of the files. They ranged from a lack of signatures on the working papers to the use of an outdated disclosure checklist.

As to compilations and reviews, concerns were expressed that the firm failed to document the client industry, accounting system, and other general information as required under SSARS 1. At times, verbal communication of policies and procedures was viewed to be excessive, with inadequate written documentation.

Of particular interest were discrepancies such as the dating of field work, according to working papers on an engagement, after the report date, and the presence of divergent expressions of conclusions in the working papers without any apparent reconciliation being sought.

The directives most apparent are:

* Use up-to-date disclosure checklists;

* Maintain disclosure checklists and specialized decision aids for specific industries; and

* Give attention to detail in the working paper process, particularly tellate signs of inconsistencies in both dating and concluding on workpapers. Proper supervision would determine that attention had been directed to such matters.

Reporting

Over a quarter of the files referred to a reporting finding; indeed, a fifth of the files cited an error in a report's content, five percent cited omissions, and just over one percent noted an apparent error in the dating of the report. The detailed findings imply particular trouble spots to which directives should be aimed:

* The auditor's report should be consistent with GAAS, should clarify the responsibility for supplemental information including summarized financial information, and should be dated to correspond to the end of field work.

* Footnote disclosure need to be comprehensive, in accordance with GAAP, with special attention to: --pensions --interest costs, -- construction contractors, --inventory costing methods, --valuation reserve policies, --contingencies, --stock repurchases, --income taxes, --five-year maturities of long-term debt, and --related-party transactions. The use of a disclosure checklist is strongly encouraged; and

* Classification of accounts should be reviewed carefully, e.g., long- term and short-term debt status and interest expense as an income item.

The files also suggest instances when the working papers' evidence was inadequate to support the type of report issued or the lack of disclosure of some event,s uch as noncompliance with a debt covenant.

CONSULTATION, TRAINING

AND ADVANCEMENT

About one-fifth of the LOCs contained findings in these categories. Most concerns related to consultation. In particular, training of personnel as to when to consult, who to consult with, how to document the consultation, and the advantage of circulating copies of related memoranda to those consulted was not apparent. The documentation of matters requiring consultations was often inadequate, and consultations that should have resulted may not have been made.

Numerous instances arose in which CPA firms made no background check of new hires and maintained incomplete personnel files. Documentation of employee interviews was similarly incomplete. Inattention to training of firm professionals on quality control matters and inadequate library resources for the maintenance of quality work were among the findings.

The lessons to be learned include:

* Carefully screen and document the hiring process of new employees;

* When training professional staff, introduce quality control procedures and give particular attention to the use of consultants;

* Maintain library resources and consultation lists that are up-to- date and able to meet the needs of the professional staff; and

* Consider staff evaluation as documentation on important tasks.

INSPECTIONS AND OTHER

QUALITY CONTROL FINDINGS

A fifth of the LOC's were concerned about the inspection process, a tenth about the quality control document, and another tenth about issues including insurance, management advisory services, partner rotation, and reporting practices. Often no inspection was performed, and, if done, it was deemed inadequate and other than on an annual basis. Documentation related to inspections was challenged, as was the scope of the inspection, particularly when it related purely to engagement reviews. A problem was noted of not formalizing findings from the inspection process to ensure follow-up of problems and effective commuication with individuals affected by such potential enhancements in quality control procedures.

The quality control document was cited as inadequate in numerous ways implying a directive as follows:

* A quality control document if requires by the size of the practice, should be realistic. It should include annual inspection requirements, with related reporting practices, and be up-to-date; furthermore,

* The document should avoid omitting: procedures for communicating the firm's policies to new staff; independence issues; continuance of client concerns; a requirement for a listing of in-house specialists when consultations are required; and personnel matters.

Editor's Note: Quality control documents are not a mandatory requirement. However, the larger a firm's practice the more likely a quality control document would be needed to effectively articulate the quality control system.

An added message is that when a peer review or an inspection is performed, monitoring mechanisms must be in place to ensure responsiveness to the findings and corrective action. On numerous occasions, it was noted that no improvements were apparent, despite findings from an earlier peer review or inspection process. Advancement policies were not well developed in many firms, and an absence of personnel review documents and staff evaluations was frequently problematic.

CPE REQUIREMENTS

About a tenth of the LOCs cited a finding related to CPE requirements, typically including a lack of documentation, the failure to meet reporting requirements, or inadequacies in training. The absence of review of CPE training, use of in-house training, evaluation of in-house training, and tracking CPe on an annual basis were highlighted in specific findings. The directives would include:

* Initiate in-house training programs and carefully document their development, evaluation, and scope; and

* Maintain records as required by all of the groups to whom reporting is required.

OVERVIEW

While this article reinforces messages that have appeared elsewhere, such as the need to direct attention to the "tone at the top" of a public accounting firm and to direct attention to each of the key elements of a quality control system, more specificity of direction is detailed herein. The hope is that through systematic consideration of what has "gone wrong" in controls and performance at other CPA firms, current and future practices will be enhanced. Table 1 re-emphasizes the most frequent finding sin past LOCs. These matters merit special attention by firms striving to establish and maintain effective quality control.

If a CPA firm is enrolled in the quality review program, with oversight being exercised by the AICPA, the areas of practice and quality control likely to catch the attention of the reviewers can be anticipated by learning from history. The role of this article is to share that history and to enhance understanding of lessons learned from LOCs in peer reviews. omega

*This article is based on a research grant from the Peat Marwick Main Foundation through its Research Opportunities in Auditing Program.

The views expressed herein are those of the authors and do not necessarily reflect those of the Peat Marwick Main Foundation. The research assistance of both Ronald L. Campbell and Norma W. Morris, both former Ph.D. Students at Texas A&M University and now faculty members at the University of Georgia and Penn State, was a key contribution to this effort.

Wanda A. Wallace, PhD, CMA, CIA, CPA, the Deborah D. Shelton Systems Professor of Accounting at Texas A&M University.

James J. Wallace, MBA, CFE, Senior Lecturer, Texas A&M University.