Common Audit Deficiencies

The Louisiana Legislative Auditor (LLA) issues over 2,000 local auditee audit reports each year. Each report is issued as the result of an audit engagement performed by a certified public accounting (CPA) firm that has been approved by LLA.

As part of its monitoring activities of CPAs’ work, LLA performs quality control reviews (QCRs) of selected engagements. LLA has found these common deficiencies in audit engagements in its QCRs:

• The CPA failed to gain an understanding of the local auditee and its environment, especially its internal controls.
• The CPA failed to consider the integrity of a local auditee’s management and/or the risk that management would override normally adequate controls.
• The CPA failed to assess the risk of material misstatement, particularly regarding the completeness of revenue, at the overall financial statement and relevant assertion level.
• The CPA failed to respond appropriately to identified risks, such as the poor controls over monies that flowed through a local auditee’s fiduciary funds that made them susceptible to misappropriation.
  
• The CPA failed to report conditions that should be considered significant deficiencies or material weaknesses in internal controls over financial reporting, such as poor segregation of duties, or failure of the local auditee to timely reconcile its bank accounts.

Any of the above deficiencies could cause an auditor to fail to detect fraud, waste or abuse; or to appropriately modify his or her opinion when an entity’s financial statements are materially misstated.

To prevent this from occurring, CPAs should be familiar with generally accepted government auditing standards before performing any audit engagement for LLA (See Auditing Standards and the Difference Between GAAP, GAAS and GAGAS). LLA also recommends the following:

• The CPA must gain an understanding of the local auditee and its environment, especially its internal controls, through inquiry, analytical procedures, observation and inspection. A CPA can’t audit what he or she doesn’t understand.
• The CPA should consider and appropriately respond to risks related to noncompliance, particularly due to fraud or misappropriation (including any allegations or other information sent to the CPA by LLA) in its fraud risk assessment, as required by AU-C 240. See Allegations, Misappropriation Notices, and Other LLA Notifications to CPA.
• The CPA should meet in person with the local auditee’s management at the beginning of each engagement to discuss the engagement agreement and other issues. A phone call or email is not a substitute for a face-to-face meeting.
• The CPA should expect to spend time on site with the local auditee’s management to perform certain audit procedures, especially inquiries, observations and inspections.
• The CPA should consider qualitative as well as quantitative factors in his or her risk assessment when setting materiality; and determine whether lower levels of materiality should be used for certain account balances or relevant assertions.
• The CPA should not only test whether controls have been effectively designed, but that they also have been implemented by the local auditee.
• Some local governments process a significant amount of money through their fiduciary funds. There is often little control over these funds; and numerous reports issued by LLA have found significant fraud and misappropriations relative to monies that should have been reported as additions to fiduciary funds. CPAs should include additions and deletions to fiduciary funds in their risk assessment.
• The CPA should use checklists to avoid missing important audit procedures, but remember that checklists are not a substitute for critical thinking.
• If assessed risks are identified, the CPA should extend procedures, or have a very good reason for not doing so.

During LLA’s desk review of local auditee reports, and quality control reviews (QCR’s) of selected engagements, LLA has also found a lack of understanding regarding the laws of the state of Louisiana and LLA’s policies. CPAs should be familiar with Louisiana law regarding the local auditee; particularly Louisiana Revised Statute (R.S.) 24:513 and 24:514 (the audit law; see also Laws and Regulations); and the Louisiana Governmental Audit Guide, which is the document that sets forth the standards by which local auditee engagements must be performed.

CPAs should particularly be aware of the following matters of Louisiana law and LLA policy:

• An audit, review/attestation, or compilation report is subject to revision until it is issued as a public document by LLA. If LLA requires a report to be revised, and that report has already been distributed to third parties by the CPA or the local auditee, the CPA must follow the guidance in AU-C Sections 560.15 - .18 and 560 A.18 – 26 (for audit engagements) or AT-C Sections 210.A. 41 – 42 (for review engagements) regarding notification to the parties to whom the report has been distributed. See also Reissued Reports.
• If a report is submitted to LLA more than six months after the local auditee’s fiscal year end, it is delinquent, and must include a finding for noncompliance with R.S. 24:513 A. (5) (a) (i)⁴. See also Due Date of Reports and Consequences of A Late Report.
• The schedule of compensation, benefits, and other payments to the agency head is required to be included in each report. If none of the compensation received by the agency head is derived from the Louisiana sourced public funds the agency received, the schedule must still be included in the report, with the name of the agency head, and either zeros in the compensation categories, or a statement that none of the agency head’s compensation was derived from the Louisiana public funds the agency received. See also Special Reporting – Schedule of Compensation, Benefits, and Other Payments to Agency Head or Chief Financial Officer.
• CPAs should check the other information in the Special Reporting Requirements in the State of Louisianasection of the Louisiana Governmental Audit Guide to ensure that their reports include all the requirements of Louisiana law and LLA policy that are over and above the requirements of GAAP.
• The requirements of Louisiana law and LLA policies regarding local auditee reports is not dependent upon the amount of Louisiana sourced funds the local auditee receives in comparison to funds from other sources. For example, a nonprofit agency that receives a small amount of Louisiana sourced funds in comparison to funds received from other states must still include the schedule of compensation, benefits, and other payments to their agency head in their report that is submitted to LLA; and there must be a finding in the report if it is submitted to LLA past the Louisiana statutory due date.
• All CPA firms must be current in their peer review requirements to remain on LLA’s approved list. To find out more about the type and timing of peer review information that must be submitted to LLA, see Peer Reviews.
• LLA periodically sends out Audit Risk Alerts to CPAs. These notifications pertain to changes in Louisiana law, LLA policies, and other information. It is very important to notify LLA of any change in email addresses for the individual CPA contacts in each firm. It is also important to periodically ensure that Audit Risk Alerts and other LLA emails are not getting caught in a firm’s spam filter.
• CPA firms should contact LLAif they encounter difficulties on their audit engagements. LLA staff offer assistance to CPA firms from answering technical questions to helping develop meaningful findings and attending entrance and exit conferences. However, the CPA is ultimately responsible for the work performed on his or her audit and attest engagements, and should first rely on their own judgment in determining the sufficiency of the procedures they perform on local auditee engagements.