3101 Specialists in accounting or auditing

Apr-2018

OAG Guidance

Specialists in accounting or auditing—OAG staff members who possess expertise in accounting or auditing.

A specialist in accounting or auditing performing audit procedures on an engagement is considered part of the engagement team as defined in OAG Audit 3060.

Performance of audit procedures on an engagement involves performing planning or risk assessment procedures, and designing and/or executing procedures in response to identified risks, for the purpose of gathering sufficient appropriate audit evidence, and completion-related activities. It also includes review activities. Providing advice as a result of being consulted is not considered a performance of audit procedure on an engagement; therefore, to understand which CAS requirements are relevant, consideration will need to be given to the type of procedures performed and the roles of the specialists on the audit. See OAG Audit 3081 for additional guidance on consultations.

Distinguishing between expertise in accounting or auditing and expertise in another field is required to determine whether the involvement of others will be in their capacity as specialists in accounting or auditing (to which CAS 220 Quality Control for an Audit of Financial Statements applies) or as auditor’s experts (to which CAS 620 Using the Work of an Auditor’s Expert applies if they are auditor’s external experts, or both CAS 220 and CAS 620 apply if they are auditor’s internal experts). This will determine which of the CAS requirements are relevant and the procedures to perform. See OAG Audit 3092 for additional guidance on distinguishing between expertise in accounting or auditing and expertise in another field.

Examples of specialists in accounting or auditing are included in OAG Audit 3092.

OAG Guidance

The engagement leader, assisted by the team manager, is responsible for deciding whether to engage specialists in accounting or auditing in the audit. Consideration begins early in the engagement cycle, either during the acceptance and continuance process or during mobilization, but the need for specialists in auditing or accounting can arise at any time during the audit.

There are many areas where specialists in accounting or auditing may benefit the audit process. The most commonly engaged specialists are an IT audit specialist (OAG Audit 3102), a controls assurance specialist, and a data analytics specialist.

OAG Audit 3092 includes examples of where specialists in accounting or auditing may be able to assist in understanding the entity and its environment, identifying and assessing the risks of material misstatement, and testing during the audit process, and where such specialists may reside within the OAG. It will be rare for expertise in accounting or auditing not to be available within the OAG; therefore, it is unlikely that expertise in accounting or auditing will be provided by an external source.

When determining the need to involve specialists in accounting or auditing, the engagement leader and team manager will also consider:

• the technical expertise needed in the team, including specialized areas of accounting or auditing;

• the size and complexity of the entity’s operations;

• the degree to which there have been significant changes in the entity’s operations or the entity’s industry (e.g., new technology, new markets, new competitors);

• whether there have been recent control breakdowns at the entity or at other companies in the industry sector;

• local regulatory risk management and/or corporate governance requirements; The level of sophistication of the entitys risk management function; and

• the level of audit evidence required from non-financial systems and processes.

See OAG Audit 5513 for guidance on Internal Specialist for Fraud.

OAG Guidance

The responsibilities of specialists in accounting or auditing will vary by engagement, the expertise of the specialist, and the relationship to the engagement team. Whatever audit work is performed by the specialist in accounting or auditing, responsibility for the opinion on the financial statements rests with the engagement leader.

If a specialist in accounting or auditing will be used in the audit process, determine, together with the specialist, the nature, timing, and extent of the specialist’s role. The need for and the role of the specialist in accounting or auditing will typically vary depending on whether he or she is in a consulting, supervision/coaching, or completing role, as depicted in the chart below:

View actual size

If consulting, the specialist’s involvement may be limited to advising on the identification of significant risks based on the entity’s business and changes since the prior year. The specialist in accounting or auditing may assist in preparation for key meetings. If a specialist’s involvement is only in a consulting role, the specialist will not be considered to perform audit procedures on the engagement.

If coaching, the specialist’s involvement is generally targeted at areas of change and generally consists of attendance at key meetings as well as assisting in the development of the risk assessment. The specialist in accounting or auditing may coach other team members working in the specialist’s area of expertise. As part of this role, the specialist may participate in the review process, if agreed to by the team manager or the engagement leader and in accordance with OAG Audit 3071. In these circumstances, evidence of the specialist’s review is needed.

If completing, the specialist in accounting or auditing performs the work in the specialist’s area of expertise that is higher risk, is in a complex environment, or where significant changes have occurred. The specialist in accounting or auditing will be involved in all aspects of the audit process. These higher risk areas ordinarily require two levels of detailed review to be performed by the specialist manager and the team manager, or the engagement leader. The team manager’s or engagement leader’s review is performed to evaluate the adequacy of the specialist’s work, including the relevance and reasonableness of its findings or conclusions and for consistency with other audit evidence.

The primary responsibility to communicate the significant matters arising in the audit to the entity (board of directors, audit committee, or similar governance board) sits with the engagement leader. However, specialists in accounting or auditing may assist the engagement leader and participate in such communications as a subject-matter expert.

In addition, specialists in accounting or auditing are expected to maintain ongoing and effective communication with the team manager. When completing audit work, specialists in accounting or auditing are expected to prepare sufficient audit documentation of the work performed, which will provide the reviewer with an understanding of the nature, timing, and extent of procedures performed, results of testing, audit evidence, significant matters arising, significant judgments made, and conclusions reached. Such documentation will be tailored to the entity’s circumstances and the work performed. In some cases, a single comprehensive memorandum from the specialist in accounting or auditing may be sufficient; in other cases, a fully executed work program may be required. If OAG specialists in accounting or auditing have prepared certain standard documentation and reporting templates and/or program steps, the engagement leader is responsible for determining the sufficiency and completeness of this documentation and of the ultimate report that will be received from the specialist.

Specialists in accounting or auditing are required to be independent of their audit clients at all times. See OAG Audit 3031 for details on independence considerations.

Differences of opinion

The engagement leader has overall responsibility for determining team roles and responsibilities, including those of specialists in accounting or auditing. If there is a difference of opinion with the decision of the engagement leader as to the level of the specialist’s involvement, refer to the guidance in OAG Audit 3082 for resolving the difference.

OAG Guidance

The work performed by specialists such as IT Audit specialists, and other specialists in accounting or auditing on audit engagements is subject to the same documentation (including document retention) policy in OAG Audit 1111 discusses the nature and extent of audit documentation. Key documentation considerations are:

• The audit engagement database and/or file is the sole repository of all documents supporting the audit opinion. See OAG Audit 1112.

Generally, the following items related to work performed by specialists in accounting or auditing using technology tools are documented in the audit file:

• The scope and purpose of the work to be performed as determined in conjunction with the core assurance team members of the engagement team. This would ordinarily include

  • the population to be tested (consolidation, specific set of books, entity or company codes, IT system configurations, IT security settings, etc.);

  • the financial system(s) or data source(s) that are included in a substantive test of details using a Computer Assisted Audit Technique (“CAAT”) to test existence of transaction detail at the appropriate level (e.g., consolidation, general ledger, sub-ledger);

  • the system(s) or data source(s) that are included in a test of the entity’s internal controls (application-level or ITGCs) to test existence of the population to be tested (e.g., system configurations, application security settings);

  • the audit risks to be addressed by the tests;

  • the specific procedures to be performed; and

  • the timing of the procedures to be performed.

• A description of the work completed, including the following:

  • a detailed report, preferably in an MS Word or MS Excel format, of all CAATs or other procedures performed, including the nature, timing, extent, and results of tests performed; who performed the work; and the date such work was performed;

  • the intellectual property used to perform the analysis (e.g., IDEA). A description of original entity file(s) used for each report and the source(s) from which the data was obtained (i.e., person, system) and date received;

  • changes or additions to the original scope;

  • a summary of analysis and findings;

  • any follow-up actions required by the audit team.

Specialists in accounting or auditing, in coordination with the core assurance team, will retain in the audit file any of the documents specified for retention by OAGAudit 1190 and OAG Audit 1170.

It is not necessary to retain in our audit documentation the original data file obtained from the entity, from which the data to perform the CAATs (or equivalent procedures) was extracted, as long as our audit documentation meets the requirements previously discussed and also satisfies the requirements discussed in Identification of items tested in OAG Audit 1111. However, we may want to retain the original data file in the audit documentation. If so, the original data file will be archived along with the other audit documentation in accordance with the archiving policy set forth in OAG Audit 1171. The data file may be archived in either of the following formats:

• post the data extract directly in the audit file and archive it with the other files on the engagement; or

• place a hard copy of the CD/DVD in an external hard copy file, and archive it in accordance with procedures for hard copy files as directed in OAG Audit 1171.

If the specialist in accounting or auditing wants to retain a copy of the data set, the specialist may do so, as long as the original is retained in the audit documentation as described above, and as long as the copy that is retained by the specialist is a “clean” copy of the data as it was provided by the entity. Appropriate reasons for retaining a copy include

• performance of trend analysis covering multiple years of data,

• facilitating the entity’s assembly of subsequent year data, and

• training new team members on the engagement to understand the data element nuances.

Additionally, to retain a clean copy of the data file outside the audit file, the specialist in accounting or auditing (e.g., IT Audit specialist) will need to set up a process to safeguard this copy of the data extract against unauthorized users accessing or altering the data.

Specialists in accounting or auditing will not retain audit data on their personal laptop computers. Such audit evidence belongs in the audit documentation, and copies will not be retained in desk or personal files in accordance with the policy discussed in OAG Audit 1112.

The above procedures also apply when auditor’s internal experts use technology tools as part of the audit. See OAG Audit 3096 for guidance on documentation considerations for the auditor’s expert’s work.