With the October 15 Form 5500 filing deadline over, the Center wishes to remind you of important steps in wrapping up your 2006 plan year audits. The wrap up of an audit is an essential step to comply with GAAS. Plan auditors have up to 60 days after the audit report release date for completing the plan audit workpaper files (i.e. audit document files) and communicating internal control deficiencies to clients. Plan auditors should ensure that the firm has appropriate policies and procedures in place as these important steps may be overlooked after the audit report is issued.
Assembly, "Lock Down" and Retention of Plan Audit Documentation File
SAS No. 103, Audit Documentation, contains specific guidance on finalizing audits. You will need to understand the new requirements to ensure that your plan audits are properly documented and complete and you retain the audit documentation. SAS No. 103 applies to current year audit documentation maintained in any type of file, including the permanent file, if such documentation serves as support for the current year's audit report.
SAS No. 103 requires the following:
· The auditor must complete the assembly of the audit documentation for the audit of the plan's financial statements within 60 days* of the audit report release date. The end of the 60 day period following the audit report release date is the "documentation completion date." The period between the audit report release date and the document completion date is the "assembly period."
In connection with assembling the audit documentation the auditor may make changes to the documentation up to the document completion date. For example, the auditor may have previously neglected to document a discussion called for in the audit program. In this situation the auditor would prepare the documentation and sign and date it contemporaneously. The document may make reference to the original date or approximate date of the discussion. Moreover, during the assembly period the auditor may discard superseded drafts of memos, letters, financial statements, analyses, cleared review notes, etc.
· After the documentation completion date, the audit file must be "locked down" and the auditor must not delete or discard audit documentation before the end of the specified retention period. The auditor may add documentation after the documentation completion date under SAS No. 46, Consideration of Omitted Procedures after the Report Date or SAS No. 1, Codification of Auditing Standards and Procedures, "Subsequent Discovery of Facts Existing at the Date of the Auditor's Report." The auditor should make the changes necessary to reflect either the performance of the new audit procedure or the new conclusion reached, including:
· When and by whom such changes were made and reviewed, if applicable.
· The specific reasons for the change.
· The effect, if any, of the changes on the auditor's conclusions.
· Audit documentation must be retained until at least five years* after the report release date (Note: ERISA section 107 requires audit workpapers to be retained at least six years.)
· Documentation should be sufficiently detailed to give experienced auditors who were not previously involved in the audit a clear understanding of the work performed, the evidence obtained and the conclusions reached.
· Oral explanations are not sufficient to document auditors' work or conclusions, but auditors may use them to clarify or explain information in the documentation.
· Auditors should document audit evidence that contradicts or is inconsistent with audit conclusions regarding significant findings or issues and also explain how they addressed the contradiction in forming the conclusion.
*Auditors should be aware that some states impose other, more stringent requirements than those in SAS No. 103. As an example, New York State requires auditors to finalize a copy of their documentation within 45 days of delivering the report to the client rather than within 60 days, as permitted in SAS No. 103. If a state or regulator specifies a shorter lock down period or a retention period exceeding SAS 103's five-year requirement, the auditor should conform to the more stringent of the two requirements.
Helpful Tips
The following are selected excerpts of helpful tips which appeared in a Journal of Accountancy June 2006 article http://www.aicpa.org/pubs/jofa/jun2006/whitting.htm (Copyright 2007. American Institute of Certified Public Accountants, Inc. All rights reserved.)
· As a preparer of audit documentation, step back and read your work objectively. Would it be clear to another auditor? After preparers, reviewers are best qualified to ensure documentation is clear.
· As a reviewer of documentation, if you have to ask the audit staff basic questions about the audit, the documentation probably does not contain the detail contemplated in SAS no. 103. The workpapers should contain all information and linkages that are necessary to ensure that all required procedures were performed, evidence was obtained and conclusions were reached by the auditors. Oral explanations may be used only to clarify or explain the documentation. Document the audit clearly the first time to minimize the effort necessary to put the files in order before the documentation completion date—that is, within 60 days of your delivering the audit report to the client.
· Carefully determine whether more stringent state laws or other documentation requirements apply to your firm or certain of its audits.
· Ensure staffing and review time is scheduled in time to meet the 60-day final file assembly deadline.
· As an auditor, assess how SAS no. 103 requires you to change your current documentation approach and policies. Because it may be difficult to perform an objective self-assessment, you may want to consider engaging an objective third party to make specific recommendations.
· Keep your workpapers safe and retrievable. Consider the standard's requirement that auditors be able to retrieve files five or more years old. Determine which of your current software programs will run in future environments, and plan to purchase new software or retain old software and hardware as necessary.
· Determine whether you really need a permanent file. Reconsider its content and ensure that workpapers integral to the annual audit are filed in the annual audit file.
For further information and tools on SAS No. 103 visit the EBPAQC's Auditing Standards Resource Center on the Center website (click here).
Back to top
Written Communications of Internal Control Deficiencies
SAS No. 112, Communicating Internal Control Related Matters Identified in an Audit, requires auditors to communicate in writing to plan management and those charged with governance any significant deficiency or material weakness in internal control noticed during the plan audit. These written communications must be made no later than 60 days after the report release date. For many employee benefit plans, this will be a change. For example, a situation where there are no or few controls over the preparation of the financial statements would be at least a significant deficiency and a strong indicator of a material weakness. Other issues that would indicate a control deficiency that would need to be evaluated include material adjusting entries, inability by the client to properly value its plan investments, a lack of segregation of duties, or no management oversight of the third party administrator.
In composing the written communication, the auditor should include the following components:
· State that the purpose of the audit was to express an opinion on the financial statements, but not to express an opinion on the effectiveness of the entity's internal control over financial reporting.
· State that the auditor is not expressing an opinion on the effectiveness of internal control.
· Include the definition of the terms significant deficiency and, where relevant, material weakness.
· Identify the matters that are considered to be significant deficiencies and, if applicable, those that are considered to be material weaknesses.
· State that the communication is intended solely for the information and use of management, those charged with governance and others within the organization and is not intended to be and should not be used by anyone other than those specified parties.
An illustrative SAS No. 112 communication containing some of the more common significant deficiencies and material weaknesses that may be found in a plan audit is attached to this EAlert (originally communicated in Center EAlert #106a.)
SAS No. 112 continues to permit the auditor to issue a communication to the entity that states no material weaknesses were identified during the plan audit. However, because of the potential for misinterpretation, the standard prohibits the auditor from issuing a written communication stating that no significant deficiencies were identified during the plan audit.
SAS No. 112 does not preclude the auditor from communicating to plan management and those charged with governance other matters that the auditor believes to be of potential benefit to the plan, such as recommendations for operational or administrative efficiency, or for improving internal control, or matters the auditor has been requested to communicate (for example, control deficiencies that are not significant deficiencies or material weaknesses.) Such matters may be communicated either orally or in writing. If the information is communicated orally, the auditor should document the communication.
For further information and tools on SAS No. 112, visit the EBPAQC's Auditing Standards Resource Center on the Center website (click here) and refer to Appendix B of the 2007 Audit Risk Alert, Employee Benefit Plans Industry Developments