The new standards also make it clear that preparing financial statements in their entirety from a client-provided trial balance or underlying records is considered a significant threat to the auditors’ independence. While the AICPA’s 2011 Yellow Book Independence—Nonaudit Services Documentation Practice Aid provides several examples to help auditors use their judgment on whether the preparation of financial statements creates a significant threat to independence, the 2018 Yellow Book clearly takes that judgment away from the auditor by stating this type of service automatically creates a significant threat. Because of this, the author recommends that auditors who are still performing audits under the 2011 Yellow Book take into account the rules in the 2018 Yellow Book when determining whether the nonaudit service of preparing substantially all of the financial statements is a significant threat or not.

The standards clarify other nonaudit services frequently performed by auditors that automatically impair independence such that no safeguard could possibly be applied to eliminate this threat. In these cases, auditors must either refuse to perform the nonaudit service or resign from the audit. The following is a list of those services that automatically impair independence:

●     Keeping the original books and records of the entity

●     Changing journal entities, account coding, or classification

●     Authorizing or approving the entity’s transactions

●     Preparing or making changes to source documents without management approval.

Other frequently performed nonaudit services that do not automatically impair independence should be evaluated to determine if they create significant threats. These services include the following:

●     Making cash to accrual conversions

●     Performing reconciliations

●     Preparing Form 990 and other taxes

●     Maintaining depreciation schedules

●     Recording transactions in the entity’s books that management has approved

●     Preparing certain line items on financial statements based on information in the trial balance

●     Posting entries that management has approved to the entity’s trial balance 

Under the new standards, the most important factors in determining whether the nonaudit service should be considered a significant threat to independence are the extent to which the outcome of the service could have a material effect on the financial statements, the degree of subjectivity in determining amounts, and the extent of the audited entity’s involvement in determining significant matters of judgment.

The identification of a significant threat does not prohibit an auditor from performing an audit unless it is one of the prohibited services outlined above. In these circumstances, however, the auditor must implement a safeguard that will eliminate or reduce the treat to an acceptable level. Auditors should use judgment in deciding which safeguard will best eliminate or reduce the threat to an acceptable level. Common safeguards that have been known to be effective include the following:

●     Assigning separate engagement personnel for audit and nonaudit services

●     Obtaining secondary reviews by personnel who were not involved in planning or supervising the engagement

●     Educating management on the nonaudit services performed

●     Requiring such engagements to undergo an engagement quality control review (EQCR)

●     Having an independent organization perform a secondary review of the file or reports

●     Having a partner not involved with planning or supervising the audit engagement review the financial statements before releasing them

●     Educating management so they are in a position to review and approve the financial statements

●     Requesting that the audited entity complete a disclosure checklist as part of its overall review. 

The new standards include one important clarification: providing clerical assistance, such as typing, formatting, printing, and binding financial statements, is unlikely to be a significant threat. The nature of these services should, however, be evaluated and documented.

Required Competence and CPE

The other major impact of the new standards is the clarification on how continuing professional education (CPE) affects the competence auditors should have regarding skills, ability, and knowledge of specific GAS requirements. Those who were following the Yellow Book exposure draft should be aware that the proposed requirement to take four hours of GAS-specific CPE was not included in the finalized 2018 Yellow Book; instead, the standards state that obtaining CPE on specific GAS topics, particularly during years in which there are revisions to the standards, may assist auditors in maintaining the competence necessary to conduct GAS engagements. The standards also state that auditors assigned to an engagement must collectively possess competence for the engagement’s objectives and GAS before beginning work on the engagement.

The rules state that auditors who plan, direct, perform, and report on an engagement in accordance with GAS should develop their competency by completing 80 hours of CPE during every two-year period, with a minimum of 20 hours of CPE in each year of that period. Of those 80 hours, at least 24 hours of subject matter need to be directly related to the government environment, government auditing, or the specific environment in which the audited entity operates; the remaining 56 hours of subject matter should directly enhance professional expertise to conduct engagements. The new standards provide examples of topics that qualify under each of those categories. In addition, the audit organization should maintain documentation of each auditor’s CPE.

There are several exceptions and exemptions to these rules. If an auditor charges less than 20% of her time annually to engagements conducted in accordance with GAS and only performs procedures (i.e., does not plan, direct, or report), she is only required to meet the 24-hour requirement over the two-year period and is exempt from the 56-hour requirement. In addition, nonsupervisory auditors who charge less than 40 hours to GAS auditors are exempted from all CPE requirements.

The 2018 Yellow Book introduces a new concept referred to as “waste,” defined as “the act of using or expending resources carelessly, extravagantly, or for no purpose. Importantly, waste can include activities that do not include abuse and does not necessarily involve a violation of law. Rather, waste relates primarily to mismanagement, inappropriate actions, and inadequate oversight.”

Waste is an expansion of the concept referred to as “abuse” in the 2011 Yellow Book. While auditors are not responsible for designing testing procedures to detect waste or abuse, they should understand that the discovery of either of these items may indicate that fraud or noncompliance could exist.