The quality control policies and procedures of most of the first reviewed in 1990 were appropriately designed and functioning in order to provide reasonable assuance of compliance with professional standards. These are the firms that received unqualified reports. Even if an unqualified report was issued, if conditions were observed that led the reviewer to conclude that more than a remote possibility existed that the firm would not conform with professional standards on accounting and auditing engagements, such conditions were included in a letter of comments.

The specific findings as to individual firms are confidential. The deficiences discussed in this article are not associated with any particular firm and are a composite of what some involved in the program observed this first year.

SUPERVISION

The most frequently encountered and troublesome deficiencies were found in the supervision element of quality control. These deficiencies can be grouped into three basic categories:

1. Disclosure and reporting;

2. The performance of audit procedures; and

3. Documentation.

Disclosure and Reporting

Deficiencies

Modified and adverse reports were issued by review teams in many cases because the reviewed firms issued subtandard reports or the financial statements on which they reported contained serious GAAP deficiencies. In order to receive a modified or adverse, report for GAAP disclosure (as contrasted with GAAP measurement) deficiencies, the team would have seen a pattern or numerous deficiencies in the financial statements. Usually a modified or adverse report would have been issued only if there was a significant breakdown in the firm's quality control system. An isolated instance of substandard reporting or financial statements did not necessarily result in a modification of the quality review report.

Some of the more frequently encountered disclosure and reporting deficiencies were as follow:

1. Inadequate disclosure of related party transactions, especially total amount of transactions;

2. Inadequate disclosure of notes payable, especially five-year debt maturities and interest rates;

3. Inadequate lease disclosures, particularly future minimum lease payments and not capitalizing leases as required.

4. Indequate pension disclosure;

5. Inadequate tax disclosures; for example, no disclosure of the reasons for differences between pre-tax income and tax expense;

6. No disclosure of interest expense;

7. For the Statement of Cash Flows:

* No disclosure of income taxes paid and interest paid,

* No disclosure of non-cash investing and financing transactions,

* Improper classification of transactions as operating, investing or financing,

* Transactions were netted, rather than grossed up,

* Improper treatment and disclosure of cash equivalents;

8. Inadequate accounting policies noted such as:

* No disclosure of revenue recognition,

* No disclosure of OCBOA,

* No disclosure of bad debt policy, if direct write-off method was used,

* No disclosure of inventory method;

9. Report problem:

* Issued a review or audit report when there was a lack of independence,

* Did not issue a qualified report for a departure from GAAP,

* Compilation reports did not indicate that disclosures were omitted,

* No disclosure of OCBOA,

* No indication of the degree of assurance given for supplementary data,

* Improperly worded reports;

10. Other deficiencies such as:

* No disclosure of par value and number of shares of stock,

* No disclosure of contingent liabilities, such as a buy-sell agreement, a stock purchase agreement, or consulting agreements, and

* Rent and pension expense disclosed only in supplementary data and not in the basic financial statements.

The Performance of Audit

Procedures

Another reason for a number of modified or adverse reports was the failure of the reviewed firm to perform audit procedures sufficient to support the report issued. Usually, a firm did not receive a modified or adverse report if procedures were deficient on only one engagement. Review teams probed further to see if there was problem with the quality control system. Isolated breakdowns did not necessarily result in a modification to the report.

Although a number of these deficiencies related to audit procedures, the review teams also noted that on review engagements, the firms had not performed analytical procedures nor other procedures sufficient to support the issuances of a review report.

Surprisingly, the types of deficiencies relating to audit engagements generally involved not adequately performing "tried and true" audit procedures, such as the following.

1. Inventory. Several review teams noted that inventory was not adequately tested. In some cases, investory was not observed. In other cases, there were no tests of the value of inventory (price tests or lower of cost or market tests). There were also instances when cut-off procedures were not performed.

2. Accounts Receivable. The reviewers noted a number of deficiencies, including:

* No confirmation, with no justification for not performing this procedure;

* Inadequate scope of confirmations;

* No alternative procedures performed;

* Inadequate audit testing of account receivable transactions from the date confirmations were sent to balance sheet year-end.

3. Cash Balances. Bank balances were not confirmed when cash represented a material amount on the balance sheet.

4. Accounts Payable and Accrued Expenses. Reviewers noted that no search for unrecorded liabilities has been performed on material accounts payable balances. Also, firms did not consider whether an accrual was necessary for compensated absences, as required by SFAS 43.

5. Leases. Although SFAS 13 has been amended and revised a number of times, its basic premise has not, requiring capitalization of leases that meet specific criteria of the Statement. Often, firms did not consider whether leases should have been capitalized.

There other audit procedure deficiencies dealt with more recently issued auditing requirements. These arise as a result of the "expectation gap" SASs which were effective for audits of periods beginning on or after January 1, 1989.

Margaret Loscalzo, CPA, is President of Loscalzo Associates Publishing Corp. and Loscalzo Associates, P.A., Red Bank, NJ, companies engaged in providing CPE and quality control services. Prior to forming these companies, Ms. Loscalzo was a manager in both the Quality Control and CPE Divisions of the AICPA. While there, she developed a variety of training programs, including the curriculum for the quality control and peer review programs. Ms. Loscalzo was the president of ber local state society chapter and is currently serving on the New Jersey Society of CPA's Quality Review Executive Committee. She has been elected a Trustee of the New Jersey Society of CPAs.

Following are some examples of non-compliance:

1. Risk Assessment. SAS 53, "The Auditor's Responsibility to Detect and Report Errors and Irregularities," specifies that audit risk be assessed at both the financial statement and account balance levels. Quality reviewers found instances where this was not being done on some audits.

2. Analytical Procedures. SAS 56 requires that analytical procedures (APs) be performed on all audits, just as they are required for review engagements. Review teams noted instances where APs were not performed in the planning stage of audits.

3. Control Risk Assessment. Some firms that had delayed, as permitted, the effect of SAS 55, also did not comply with the old SAS 43 requirements for internal control evaluation. The common deficiencies noted were that preliminary reviews of the internal control system were not performed and the firms did not consider how internal control impacted the scope of substantive tests.

It also became clear that many firms did not fully understand the requirements of SAS 39 on audit sampling. Some firms are still using the "old" one-month block testing approach, rather than choosing a representative sample from the entire population. Moreover, instances were noted where the impact of errors found were not projected over the entire population and there was no aggregation of misstatements.

Documentation

The second common deficiency (after disclosure and reporting matters) noted in engagements related to documentation of performance of procedures. Typically a documentation deficiency triggered a modified or adverse report if the documentation was specifically required by professional standards, such as the requirement for written communication from the client's attorney.

Some of the problems noted by review teams were as follows:

1. No Planning Documentation. This is, by far, the most common documentation deficiency noted. Remember, professional standards require all accounting and auditing engagements to be adequately planned, with appropriate documentation. This applies to compilations and reviews as well as audits. For compilations and reviews, planning documentation can be a planning checklist or simply signing off planning steps in a work program.

2. No Documentation of Analytical Procedures. Reviewers reported a lack of documentation of APs in both reviews and audits. For reviews, many firms "eyeball" comparative numbers but do not document this procedure. This was found to be especially common with revenue and expense accounts. Note that AP documentation should show not only a comparative analysis but also explain significant or unusual fluctuations.

Reviewers frequently reported the absence of documentation of AP during the review stages. This documentation simply can be:

* Notations on a draft comparative financial statement;

* Review notes discussing unusual trends or significant fluctuations; and

* Reviewers' memos, documenting AP observations.

3. No Evidence of Partner Review of Financial Statements and Workpapers. Although reviewers questioned whether a partner review had been performed, based on the financial statement and workpaper deficiencies noted, more often than not, the review simply wasn't documented. Quality control standards do not require every workpaper to be initialed by a partner, but they do require some evidence of partner review. Some firms have a separate partner review checklist; others use a report docket sheet or review notes. Also, a partner may simply initial the binder cover of workpapers to show that the appropriate workpapers and financial statements have been reviewed.

There are five frequently occurring documentation deficiencies that were cited by review teams in audit engagements:

1. No Written Audit Programs. SAS 22 requires a written audit program. If a firm does not use written audit programs on any of its audits, this will result in a modified report. On several quality reviews, the review teams also found that firms were using outdated or inadequate audit programs.

2. No Client Representation Letter. Although SSARS makes the use of a client representation letter optional for a review engagement, SAS 19 requires that a client representation letter be obtained for all audits. Reviewers noted a number of instances where this was not done for audits. In addition, some representation letters did not conform with either SAS 19 or SAS 63. SAS 63 requires that the representation letter be tailored for governmental audits to include the following two additional representations:

* Management is responsible for the entity's compliance with laws and regulations; and

* Management has identified and disclosed to the auditor all laws and regulations that have a direct and material effect on the determination of financial statement amounts.

3. No Legal Letters. The lack of legal letters came as a surprise to some review teams, especially in light of today's litigious business environment. A firm would not have been deficient if it did not obtain a legal letter when the client represented in writing that it had not consulted with an attorney during the audit period.

4. Inadequate or No Documentation of Internal Control Evaluation. If the reviewed firms delayed implementation of SAS 55 until 1990, under SAS 43, workpapers should have contained at the least, a statement that the firm had made a preliminary review of internal control and the extent to which it intended to rely on the system of internal control. Moreover, the workpapers should have indicated how their firm modified the scope of work based on the degree of reliance on the system. This type of documentation was not prepared by some firms that were reviewed. For 1991 reviews, dealing with internal control may pose a more significant problem because of the expanded documentation requirements of SAS 55, which requires documentation indicating the following:

* An understanding of the control environment;

* An understanding of the accounting system;

* An understanding of control procedures;

* An assessment of control risk for purposes of conducting substantive procedures;

* Tests of controls, if control risk is assessed below the maximum; and

* Correlation between control risk assessment and the scope of substantive tests.

5. No Documentation of Sampling Requirements. Reviewers also noted that sampling documentation was often very limited. For example, there were instances where there was no documentation of how a sample was selected or how a sample was evaluated.

CONSULTATION

Reviewers found three major problems with this element of quality control:

1. No Consultation Performed. In a number of quality reviews, the reviewers found substandard reporting or significant departures from GAAP because the firms did not recognize the need for special reporting or the departure. Examples were improper reporting on governmental engagements and improper accounting for NOL carry-forwards. These failures occurred because the firms did not perform adequate research when dealing with an issue not familiar to them.

2. No Documentation of the Consultation Process. Firms were found to be deficient in documenting consultation. This does not mean that there must be a memo to the file every time an issue is researched. Consultation should be documented when the issue is unusual, is subject to professional judgment, or represents an exposure situation.

3. Inadequate Library. Reviewers reported many instances in which the reviewed firm's accounting and auditing library was inadequate. Such basic research tools as the AICPA's Professional Standards or the FASB Original Pronouncements and Current Text were not readily available in the firms' offices. Libraries frequently did not include copies of audit and accounting guides of industries in the firms' practice areas.

OTHER ELEMENTS OF

QUALITY CONTROL

Of the remaining seven elements of quality control, deficiencies were common in the following four.

1. Independence. In this area, reviewers found the following:

* The issuance of review and audit reports, when the firm lacked independence or failed to mention this lack of independence when it issued a compilation report. For example, some partners owned limited partnership interests and the firm audited the partnerships. Some firms issued reports when prior year fees had not been paid. Many firms demonstrated a lack of familiarity with the AICPA's Code of Ethics. Within the last two years, there have been numerous changes to the AICPA's independence rules; these changes should be discussed with all members of the professional staff.

* Independence confirmations were not obtained. Quality control standards require firms to monitor their compliance with independence. For most firms, this means obtaining at least an annual written statement from partners and professional staff that they are familiar with independence rules and are independent with respect to the firm's accounting and auditing clients. If there is an independence problem, it must be immediately investigated and resolved.

2. Professional Development. The major deficiency noted was that staff had not obtained the appropriate CPE hours, as required by either state board requirements, AICPA requirements, or firm policy. In some cases, the number of hours was inadequate. For others, they did not comply with the 24 hour governmental accounting and auditing requirement. And, as the supervision deficiencies clearly indicated, some did not have adequate accounting and auditing training.

3. Client Acceptance and Continuance. While firms are interested in obtaining and retaining clients, the evaluation of new clients and existing ones was often not addressed and documented by the reviewed firms.

Client acceptance procedures such as reviewing prior period workpapers, financial statements, and tax returns and discussing potential clients with bankers, attorneys, or other referral sources can be easily documented on the administrative form a firm uses to set up a new client in the office. Continuance, or discontinuance decisions, can be documented by a memo to the file.

4. Inspection. A number of firms did not perform an inspection of the other eight elements of quality control. Although quality control standards require an annual inspection, the AICPA permitted an exception for a firm's initial review. This exception stated that if a firm did not perform an inspection prior to its initial quality review, it would not receive a modified report. It further stated that:

* For firms with 10 or fewer professionals, failure to perform an inspection would not even be mentioned in the letter of comments, unless the review team noted serious deficiencies during the review that could have been detected and acted upon, if an inspection had been performed.

* For firms with more than 10 professionals, failure to perform an inspection would be noted in the letter of comments.

WHAT CAN BE LEARNED

FROM THESE INITIAL

QUALITY REVIEWS?

In one year, many firms made tremendous progress in improving the quality of their practices. But it's clear that some firms are not fully complying with professional standards. Some firms have not kept up-to-date with accounting and auditing requirements. Other firms have not adequately supervised inexperienced staff. The only way for these firms to win the compliance battle is to:

1. Properly train all those involved in accounting and auditing. The firm must assure that the staff members are attending the proper accounting and auditing courses.

2. Provide the staff with appropriate accounting and auditing materials. This includes technical practice aids, checklists, questionnaires, and workpaper formats, as well as reference books and publications.

3. Have at least one "heavy" accounting and auditing person technically supervising and reviewing work. Small tax oriented firms may want to consider using an outside person on a consulting or per diem basis.

The profession has come a long way in the quality review process and no doubt will continue to make great strides in this self-monitoring activity.