Using the name GAGAS in Vain

Do you ever use the words “Jesus!” or “God!” to punctuate a sentence?

My aunt couldn’t stand it when we used the Lord’s name in vain. Using the Lord’s name in vain was a big no-no to her (and many others). She would cuss us out if we kids ever made that mistake in her presence. It’s pretty funny when you think about it, but as a kid, you don’t appreciate irony.

The GAO also doesn’t appreciate it when you use the name GAGAS in vain, either. By that, I mean that they do not want GAGAS to be mentioned in the audit report unless you follow all of their standards.

When an auditor follows GAGAS (Generally Accepted Government Auditing Standards – also known as the Yellow Book) they say so in their audit report with a sentence that sounds something like, “We conducted this audit in accordance with Generally Accepted Government Auditing Standards.”

If you don’t want to get cussed out by your peer reviewer, you had better make sure you follow every must and should statement in GAGAS before you put that sentence in your audit report. The GAO does not want auditors to follow GAGAS in spirit only.

What is the difference between ‘must’ and ‘should’?

In general, “must” means mandatory and “should” means mandatory unless you have a compelling reason to deviate.

The GAO emphasizes that not every paragraph of the Yellow Book contains mandatory requirements. Here is how the GAO explains the differences:

2.02     GAGAS uses two categories of requirements, identified by specific terms, to describe the degree of responsibility they impose on auditors and audit organizations:

1. Unconditional requirements: Auditors and audit organizations must comply with an unconditional requirement in all cases where such requirement is relevant. GAGAS uses must to indicate an unconditional requirement.

2. Presumptively mandatory requirements: Auditors and audit organizations must comply with a presumptively mandatory requirement in all cases where such a requirement is relevant except in rare circumstances discussed in paragraphs 2.03, 2.04, and 2.08. GAGAS uses should to indicate a presumptively mandatory requirement.

“Unconditional requirement” means that you do not have an option to follow the requirement. You must comply with these requirements. When you see the word “must,” you will not be able to refer to the GAO in your report.

But, if you see the word “should,” then you have a little more wiggle room. You can choose not to comply with a “should” statement, but you will need to justify the departure in your working papers and disclose your non-compliance in your audit report. Ouch!

2.03     In rare circumstances, auditors and audit organizations may determine it necessary to depart from a relevant presumptively mandatory requirement. In such rare circumstances, auditors should perform alternative procedures to achieve the intent of that requirement.

2.04     If, in rare circumstances, auditors judge it necessary to depart from a relevant presumptively mandatory requirement, they must document their justification for the departure and how the alternative procedures performed in the circumstances were sufficient to achieve the intent of that requirement.

The serious stuff is in a box

Not every statement in the Yellow Book is a must or should statement. Some start with “may,” “might,” or “could.” Those statements are called explanatory guidance and are not mandatory.

The 2018 version of the Yellow Book conveniently puts the must and should statements in a box and the may, might, or could statements live outside the box. If you would like a copy of every “must” and “should” statement in the 2018 Yellow Book in an Excel spreadsheet, you can download one here.

What your report will look like if you don’t comply

After explaining that you need to follow every “must” and “should,” the GAO goes on to say that you can’t claim to follow the Yellow Book if you didn’t follow every “must.” If you do not follow a “should” statement, you can claim to have followed the Yellow Book in your report, but you are going to have to disclose which should statement you did not follow. The GAO calls these “modified compliance statements.”

2.17     Auditors should include one of the following types of GAGAS compliance statements in reports on GAGAS engagements, as appropriate.

1. Unmodified GAGAS compliance statement: Stating that the auditors conducted the engagement in accordance with GAGAS. Auditors should include an unmodified GAGAS compliance statement in the audit report when they have

(1) followed unconditional and applicable presumptively mandatory GAGAS requirements or (2) followed unconditional requirements, documented justification for any departures from applicable presumptively mandatory requirements, and achieved the objectives of those requirements through other means.

2. Modified GAGAS compliance statement: Stating either that (1) the auditors conducted the engagement in accordance with GAGAS, except for specific applicable requirements that were not followed, or (2) because of the significance of the departure(s) from the requirements, the auditors were unable to and did not conduct the engagement in accordance with GAGAS.

 2.18    When auditors use a modified GAGAS statement, they should disclose in the report the applicable requirement(s) not followed, the reasons for not following the requirement(s), and how not following the requirement(s) affected or could have affected the engagement and the assurance provided. 

So if you follow every must and should, you can clearly say, “We conducted this audit in accordance with GAGAS.” ...Continue reading here.

Sign up for YellowBook-CPE newsletters