GAO-21-368G, Government Auditing Standards: 2018 …

1 Government Auditing STANDARDS 2018 Revision Technical Update April 2021 By the Comptroller General of the United States April 2021 GAO-21-368G United States Government Accountability Office Government Auditing STANDARDS 2018 RevisionTechnical Update April 2021By the Comptroller General of the United States April 2021 GAO-21-368G United States Government Accountability Office The 2018 revision of Government Auditing Standards is effective for financial audits, attestation engagements, and reviews of financial statements for periods ending on or after June 30, 2020, and for performance audits beginning on or after July 1, 2019. Early implementation is not permitted. The 2018 revision of Government Auditing Standards supersedes the 2011 revision (GAO-12-331G, December 2011), the 2005 Government Auditing Standards: Guidance on GAGAS Requirements for Continuing Professional Education (GAO-05-568G, April 2005), and the 2014 Government Auditing Standards: Guidance for Understanding the New Peer Review Ratings (D06602, January 2014).

2 The 2018 revision should be used until further updates and revisions are made. An electronic version of this document can be accessed on GAO s Yellow Book web page at Page i GAO-21-368G Government Auditing Standards The following technical updates have been made to the 2018 revision of Government Auditing Standards (known as the Yellow Book). These technical updates to the 2018 revision of Government Auditing Standards are effective upon issuance. 2018 Revision of Government Auditing Standards 2021 Technical Updates The concept of accountability for use of public resources and Government authority is key to our nation s governing processes. Management and officials entrusted with public resources are responsible for carrying out public functions and providing service to the public effectively, efficiently, economically, and ethically within the context of the statutory boundaries of the specific Government program. The concept of accountability for use of public resources and Government authority is key to our nation s governing processes.

3 Management and officials entrusted with public resources are responsible for carrying out public functions and providing service to the public effectively, efficiently, economically, ethically, and equitably within the context of the statutory boundaries of the specific Government program. As reflected in applicable laws, regulations, agreements, and standards, management and officials of Government programs are responsible for providing reliable, useful, and timely information for transparency and accountability of these programs and their operations. Legislators, oversight bodies, those charged with governance, and the public need to know whether (1) management and officials manage Government resources and use their authority properly and in compliance with laws and regulations; (2) Government programs are achieving their objectives and desired outcomes; and (3) Government services are provided effectively, efficiently, economically, and ethically.

4 As reflected in applicable laws, regulations, agreements, and standards, management and officials of Government programs are responsible for providing reliable, useful, and timely information for transparency and accountability of these programs and their operations. Legislators, oversight bodies, those charged with governance, and the public need to know whether (1) management and officials manage Government resources and use their authority properly and in compliance with laws and regulations; (2) Government programs are achieving their objectives and desired outcomes; and (3) Government services are provided effectively, efficiently, economically, ethically, and equitably. Examples of program effectiveness and results audit objectives include f. determining whether a program provides access to or distribution of public resources within the context of statutory parameters; Examples of program effectiveness and results audit objectives include f.

5 Determining whether a program provides equitable access to or distribution of public resources within the context of statutory parameters; Auditors who previously provided nonaudit services for an entity that is a prospective subject of an engagement should evaluate the effect of those nonaudit services on independence before agreeing to conduct a GAGAS engagement. If auditors provided a nonaudit service in the period to be covered by the engagement, they should (1) determine if GAGAS expressly prohibits the nonaudit service; (2) if audited entity management requested the nonaudit service, determine whether the skills, knowledge, and experience of the individual responsible for overseeing the nonaudit service were sufficient; and (3) determine whether a threat to independence exists and address any threats noted in accordance with the conceptual framework. Auditors who previously provided nonaudit services for an entity that is a prospective subject of an engagement should evaluate the effect of those nonaudit services on independence before agreeing to conduct a GAGAS engagement.

6 If auditors provided a nonaudit service in the period to be covered by the engagement, they should (1) determine if GAGAS expressly prohibits the nonaudit service; (2) if audited entity management requested the nonaudit service, determine whether the skill, knowledge, or experience of the individual responsible for overseeing the nonaudit service was sufficient; and (3) determine whether a threat to independence exists and address any threats noted in accordance with the conceptual framework. 2021 Technical Updates to the 2018 Revision of Government Auditing Standards Page ii GAO-21-368G Government Auditing Standards If internal control is significant to the audit objectives, auditors determine which of the five components of internal control and underlying principles are significant to the audit objectives, as all components of internal control are generally relevant, but not all components may be significant to the audit objectives. This determination can also identify whether specific controls are significant to the audit objectives.

7 Determining which internal control components and principles and/or specific controls are significant to the audit objectives is a matter of professional judgment. If internal control is significant to the audit objectives, auditors determine which of the five components of internal control are significant to the audit objectives, as all components of internal control are generally relevant, but not all components may be significant to the audit objectives. This determination can also identify the underlying principles, control objectives, or specific controls that are significant to the audit objectives. Determining which internal control components, principles, control objectives, and/or specific controls are significant to the audit objectives is a matter of professional judgment. If internal control is determined to be significant to the audit objectives, auditors should assess and document their assessment of the design, implementation, and/or operating effectiveness of such internal control to the extent necessary to address the audit objectives.

8 If internal control is determined to be significant to the audit objectives, auditors should plan and perform audit procedures to assess internal control to the extent necessary to address the audit objectives. If some but not all internal control components are significant to the audit objectives, the auditors should identify as part of the scope those internal control components and underlying principles that are significant to the audit objectives. When reporting on the scope of their work on internal control, auditors should identify the scope of internal control assessed to the extent necessary for report users to reasonably interpret the findings, conclusions, and recommendations in the audit report. Control components and underlying principles that are not considered significant to the audit objectives may be identified in the scope if, in the auditors professional judgment, doing so is necessary to preclude a misunderstanding of the breadth of the conclusions of the audit report and to clarify that control effectiveness has not been evaluated as a whole.

9 Auditors may also identify and describe the five components of internal control so that report users understand the scope of the work within the context of the entity s internal control system. Auditors may identify the control components, underlying principles, control objectives, or specific controls assessed in describing the scope of their work on internal control. Auditors may also identify the level of internal control assessment performed, as discussed in paragraph Control components and underlying principles that are not considered significant to the audit objectives may be identified in the scope if, in the auditors professional judgment, doing so is necessary to preclude a misunderstanding of the breadth of the conclusions of the audit report and to clarify that control effectiveness has not been evaluated as a whole. Auditors may also identify and describe the five components of internal control so that report users understand the scope of the work within the context of the entity s internal control system.

10 Conforming changes have been made to the figures to reflect the technical updates. Page iii GAO-21-368G Government Auditing Standards Letter 1 Chapter 1: Foundation and Principles for the Use and Application of Government Auditing Standards 3 Introduction 3 Types of GAGAS Users 6 Types of GAGAS Engagements 7 Financial Audits 7 Attestation Engagements and Reviews of Financial Statements 9 Performance Audits 10 Terms Used in GAGAS 15 The GAGAS Format 16 Chapter 2: General Requirements for Complying with Government Auditing Standards 18 Complying with GAGAS 18 Relationship between GAGAS and Other Professional Standards 20 Stating Compliance with GAGAS in the Audit Report 22 Chapter 3: Ethics, Independence, and Professional Judgment 25 Ethical Principles 25 The Public Interest 26 Integrity 26 Objectivity 27 Proper Use of Government Information, Resources, and Positions 27 Professional Behavior 28 Independence 28 GAGAS Conceptual Framework Approach to Independence 31 Provision of Nonaudit Services to Audited Entities 43 Consideration of Specific Nonaudit Services 50 Documentation 57 Professional Judgment 58 Chapter 4: Competence and Continuing Professional Education 63 Competence 63 Continuing Professional Education 67 Contents Page iv GAO-21-368G Government Auditing Standards Chapter 5.