Workpaper Issues
Support for Isolation Determination
In order for a deficiency in a system review to be considered isolated, information must be presented in the SRM (or the MFC) to indicate steps taken to determine that the issue was isolated. For example, assume that one cash flow statement was missing from comparable year financial statements. In order to reach a conclusion that the problem was isolated, the reviewer would need to expand the scope of the review to look at other comparable financial statements to determine that both cash flow statements were present. It would be incorrect to say the problem was isolated if the expanded review included only single year financial statements. The expanded review should be documented to support the conclusion. To assist in performing the expanded review, the peer reviewer could ask the firm to identify other engagements where the item in question was handled correctly.
Dates on Firm’s Representation Letters
There has been some confusion as to the correct date to be used on the firm’s representation letter to the peer reviewer. According to the standards, for system peer reviews the firm’s representation letter to the peer reviewer should be dated the same date as the peer review report. However, for engagement and report peer reviews, the firm’s representation letter to the peer reviewer should be dated the same day as when the firm submitted the listing of engagements (Summary Engagement Form) to the reviewer.
Engagement Summary Forms for Engagement and Report Reviews
The AICPA Peer Review Program Manual requires that firms sign and date an Engagement Summary Form for engagement and report reviews. This form must be submitted to the administering entity along with other work papers for each engagement/report review. This is an important document as it supports the firm’s representation concerning the engagements performed during the peer review year and is the basis for the selection of engagements to be reviewed. However, there continues to be a number of problems with the correct completion of this form.
Frequently the form is not signed or dated, the period is not indicated or is not the same as the peer review period, or the engagements are not broken down by partner. The technical reviewer must then determine whether a firm’s representation was adequately supported and whether the reviewer’s scope was adequate, which can delay the completion of the review.
Bookkeeping Hours
For system reviews, one of the criteria used by team captains to determine if there has been adequate scope selection of engagements is to consider the percentage of accounting and auditing hours they have peer reviewed. This information is documented in the SRMs. Accounting and auditing hours do not include time for tax preparation or bookkeeping. When compiling engagements statistics, firms often include bookkeeping and tax preparation hours. Reviewers should advise firms to estimate the time spent to apply professional standards to a compilation – a common range is 1 to 5 hours. If the estimate is 2 hours, an annual engagement would be 2 hours and monthly engagements would be 24 hours. Firms will appreciate receiving this information as it will streamline the time spent compiling the data and reviewers will obtain more accurate scope information.
System Review Risk Assessment
When evaluating a peer review, committee members must consider whether the risk assessment documentation in the Summary Review Memorandum (SRM) is adequate. The questions in the SRM addressing risk assessment do not provide much guidance on content to include in the risk assessment documentation. Guidance can be found, however, in the AICPA Consolidation of Peer Reviewers’ Alerts (Consolidated Alert), including factors that should be considered and documented in the risk assessment process. An easy way to document risk assessment is in a memo referenced in the SRM as an attachment. In addition, the AICPA recently issued a practitioner tool kit that included an excel spread sheet that you may use to document risk. For convenience, we have added this worksheet to our peer review web site under the reviewer section. We have also included a sample memo at our website that you may download and use as a template, modifying it as appropriate for each peer review. You may also continue to document risk assessment by using the questions in the SRM but you must include enough information about the risk factors identified in the Consolidated Alert. The committee has advised our technical reviewers to emphasize risk assessment documentation in their reviews, so you could receive a technical reviewer feedback form if additional information is needed regarding this matter.
Audit Checklist
A member of the California Peer Review Committee, Dave Vaughn, has developed a helpful checklist for reviewing audit files during a peer review. This does not replace the peer review checklists but is an interim tool. The checklist is available at our peer review web site.
Findings for Further Consideration Forms (FFC)
The California Peer Review Committee has decided that the FFC forms must be typed. These forms are retained and used in the next peer review. The FFC forms should be written similar to letter of comments. For engagement reviews a simple method would be to have an FFC for each of the following areas: documentation, reporting, presentation, and disclosure. For system peer reviews, the FFC would usually describe the design or performance problem in the quality control system and then describe the resulting symptoms of the problem. It is no longer necessary to conclude that the financial statements were not misleading or that there was sufficient documentation to support the opinion.
For engagement reviews the definition of repeat has changed significantly. Per PRP Section 1000.122m, “if the specific types of reporting, presentation, disclosure, or documentation deficiencies or significant deficiencies are not substantially the same on the current review as on the prior review, the deficiencies or significant deficiencies would not be considered a repeat. This same definition of repeat applies to the findings in the FFC form. If you do have repeats, it would be fairer to the firm to list these on a separate FFC form. For system reviews the definition of repeat remains the same and is based on the underlying systemic cause.
Please note that the firm may just respond by checking the box that the reviewed firm agrees with the finding and will implement the reviewer’s recommendation, and the firm must also provide the date of the action(s) taken or to be taken. If you and the firm discuss the recommendation during the review, there may not be any need for an additional response from them. You should always ask a firm why they think a matter occurred and what they could have done to prevent this.
Finally, it is your responsibility to get back from the firm signed copies of the FFC no later than two weeks after the exit conference or by the peer review’s due date, whichever is earlier. You would then send them to us. The firm does not send these forms to our program.
Helpful hints for MFC and FFC forms
For system reviews, MFCs relating to issues noted during the review of engagements should be signed by the engagement partner in the box at the bottom of the form. When the matter noted applies to the firm’s quality control system, the MFC should be signed by the individual charged with governance. Examples of quality control system matters are monitoring issues or inadequate CPE under Government Auditing Standards.
For engagement peer reviews, peer reviewers may discuss MFCs by phone and document on the MFCs the agreement of the individual with whom the matter was discussed.
It is the peer reviewer’s responsibility to get signed FFC forms from the firms within two weeks of the peer review exit conference. Some reviewers send the report and FFCs by email to expedite the process. Firms can sign electronically through the adobe signature process or print the FFCs, sign them and either scan or mail them. Please do not fax these documents; they are maintained until the next review and faxed documents are frequently difficult to read. Best practice for system reviews - Prepare the FFCs while at the firm’s office, copy them to a flash drive or email them to firm personnel, have the firm print them out, and get them signed before you leave.
Reviewers can assist firms by completing the bottom portion of the FFC. For example, reviewers can include a generic response in the appropriate response section such as “We agree to implement the reviewer’s recommendation as noted above.” or “We will ensure that all appropriate documentation is performed as noted above.” Also, check the box that the firm agrees with the finding and will implement the reviewer’s recommendation and insert “Immediately” as an answer to the date of actions taken. Inform the firm that you have done this and explain that they are welcome to change the response or add additional comments. Be sure to discuss with the firm your recommendation to correct the matter noted and make certain they are in agreement. This should expedite the process and prevent technical review notes.
