Nov 08

Episode 16 – How to Improve Your Book of Business (for CPA firms)

By Charles Hall | Podcast

Over time CPA firms naturally pick up undesirable clients. And these clients can adversely affect the value of your CPA firm’s book of business.

For example, 20% of your clients may take 35% of your time and yet bring in only 15% of your income. Some clients take an inordinate amount of time and are difficult to deal with (though, thankfully, this is usually not the case). And these undesirable clients can weigh negatively upon you (the CPA firm owner) and your business value.

In this podcast I talk about three important factors in valuing your book of business:

1. Types of services

2. Payment history of clients

3. Realization

Changing the composition of your client portfolio makes all the difference. Listen now to better understand why–and for solutions. 

Perform compilation engagement
Oct 29

How to Perform Compilation Engagements

By Charles Hall | SSARS

Knowing how to perform compilation engagements is important for CPAs. Below I provide an overview of the salient points of AR-C 80, Compilation Engagements.

Perform compilation engagement

Guidance

The guidance for compilations is located in AR-C 80, Compilation Engagements.

Applicability

The accountant should perform a compilation engagement when he is engaged to do so.

A compilation engagement letter should be prepared and signed by the accountant or the accountant’s firm and management or those charged with governance. An engagement letter to only prepare financial statements is not a trigger for the performance of a compilation engagement.

Previously (in the SSARS 19 days), the preparation and submission of financial statements to a client triggered the performance of a compilation engagement. Now, compilation engagement guidance is applicable only when the accountant is engaged to (requested to) perform a compilation. 

Objectives

The objectives of the accountant in a compilation engagement are to:

  • Assist management in the presentation of financial statements 
  • Report on the financial statements in accordance with the compilation engagement section of the SSARSs

Reports

In a compilation engagement, a compilation report is always required. A compilation engagement is an attest, nonassurance service. Nonassurance means the accountant is not required to verify the accuracy or completeness of the information provided by management or otherwise gather evidence to express an opinion or a conclusion on the financial statements.

The compilation report looks distinctly different from audit or review reports (which include paragraph titles such as Management Responsibility and Accountant’s Responsibility). The standard compilation report is one paragraph with no paragraph titles. (See the Sample Compilation Report section below.)

Financial Statements

The accountant prepares financial statements as directed by management or those charged with governance. The financials should be prepared using an acceptable reporting framework including any of the following:

  • Cash basis
  • Tax basis
  • Regulatory basis
  • Contractual basis
  • Other basis (as long as the basis uses reasonable, logical criteria that are applied to all material items) 
  • Generally accepted accounting principles (GAAP)

All of the above bases of accounting, with the exception of GAAP, are referred to as special purpose frameworks. The description of special purpose frameworks may be included in:

  • The financial statement titles
  • The notes to the financial statements, or
  • Otherwise on the face of the financial statements

Management specifies the financial statements to be prepared. The most common financial statements created include:

  • Balance sheet
  • Income statement
  • Cash flow statement

The accountant can, if directed by management, create and issue just one financial statement (e.g., income statement). 

Some bases of accounting (e.g., tax-basis) do not require the issuance of a cash flow statement.

The financial statements can be for an annual period or for a shorter or longer period. So, financial statements can be for a fiscal year, quarterly, or monthly, for example.

Should a reference to the compilation report be included at the bottom of each financial statement page (including supplementary information)? While not required, it is acceptable to add a reference such as:

  • See Accountant’s Report
  • See Accountant’s Compilation Report, or
  • See Independent Accountant’s Compilation Report

Why add such references? The accountant’s report may become detached from the financial statements. The reference notifies the reader of the financial statement that a compilation report exists.

Documentation Requirements

The accountant should prepare and retain the following documentation:

  • The engagement letter
  • The financial statements, and 
  • The accountant’s compilation report

The accountant should document any significant consultations or judgments.

If the accountant departs from a presumptively mandatory requirement, it is necessary to document the justification for the departure and how the alternative procedures performed are sufficient to achieve the intent of the requirement. (The SSARSs use the word should to indicate a presumptively mandatory requirement.)

Engagement Letter

compilation engagements

While it is possible for the accountant to perform only a compilation and not prepare the financial statements, most compilation engagement letters will state that the following will be performed by the accountant:

  1. Preparation of the financial statements (a nonattest service)
  2. A compilation service (an attest service)

Since a nonattest service and an attest service are being provided, the accountant will add language to the engagement letter describing the client’s responsibility for the nonattest service. 

AICPA independence standards require the accountant to consider whether he is independent when he performs an attest service (e.g., compilation) and a nonattest service (e.g., preparation of financial statements) for the same client. If management does not possess the requisite skill, knowledge, and experience to oversee the preparation of the financial statements and accept responsibility, the accountant may not be independent.

Procedures

The accountant should:

  • Read the financial statements in light of the accountant’s understanding of the selected financial reporting framework and the significant accounting policies adopted by management
  • Consider whether the financial statements appear appropriate in form and free from obvious material misstatements

Here are examples of inappropriate form and obvious material misstatements:

  • An equity account is shown in the liability section of the balance sheet
  • The balance sheet does not reflect the accrual of receivables though the financial statements were supposedly prepared in accordance with GAAP
  • Total assets as reflected on the balance sheet do not equal the individual items on the statement (an addition error)
  • The financial statements omit a material debt disclosure, though the statements were prepared in accordance with GAAP and substantially all disclosures were to be included

Given that the focus of a compilation is the reading of the financial statements to determine if they are appropriate in form and free from obvious material misstatements, what are some procedures that are not required?

  • Confirmation of cash 
  • Testing of subsequent receipts
  • Analytical comparisons with the prior year
  • Substantive analytics
  • Confirmation of debt
  • A search for unrecorded liabilities 

Is it permissible to perform audit or review procedures while conducting a compilation engagement? While not required to do so, such procedures are allowed. If you perform audit or review procedures, be careful not to imply to the client or other parties that you are performing a service other than a compilation.

The accountant is not required to perform procedures to ensure the completeness of the client-supplied information, but what if the client provides information that is obviously not complete or contains material errors? If management-supplied information is not complete or appears incorrect, the accountant should request corrections. 

Also, the accountant should request corrections if:

  • The financial statements do not appropriately refer to the applicable financial reporting framework
  • Revisions are necessary to comply with the selected reporting framework, or 
  • The financial statements are otherwise misleading

If requested or corrected information is not received or if the financial statements are not corrected, the accountant should consider withdrawing from the engagement and may wish to consult with legal counsel. 

If the accountant decides not to withdraw and a material departure from the reporting framework exists, he should modify the compilation report to disclose the departure. See the example below in Reporting Known Departures from the Applicable Financial Reporting Framework.

Sample Compilation Report

The following is a sample compilation report:

Management is responsible for the accompanying financial statements of XYZ Company, which comprise the balance sheets as of December 31, 20X2 and 20X1 and the related statements of income, changes in stockholder’s equity, and cash flows for the years then ended, and the related notes to the financial statements in accordance with accounting principles generally accepted in the United States of America. I (We) have performed compilation engagementa in accordance with Statements on Standards for Accounting and Review Services promulgated by the Accounting and Review Services Committee of the AICPA. I (we) did not audit or review the financial statements nor was (were) I (we) required to perform any procedures to verify the accuracy or completeness of the information provided by management. I (we) do not express an opinion, a conclusion, nor provide any assurance on these financial statements.

[Signature of accounting firm or accountant, as appropriate]

[Accountant’s city and state]

[Report Date]

Minimum Compilation Report Elements

The compilation report should:

  • Include a statement that management (owners) is (are) responsible for the financial statements
  • Identify the financial statements
  • Identify the entity
  • Specify the date or period covered
  • Include a statement that the compilation was performed in accordance with SSARS
  • Include a statement that the accountant did not audit or review the financial statements nor was the accountant required to perform any procedures to verify the accuracy or completeness of the information provided by management, and does not express an opinion, a conclusion, nor provide any assurance on the financial statements
  • Include the signature of the accountant or the accountant’s firm
  • Include the city and state where the accountant practices and
  • Include the date of the report (which should be the date the accountant completes the compilation procedures)

You may have noticed that a compilation title and salutation are not required. Can they be included? While AR-C 80 does not require a report title or a salutation, it is permissible to add them. Here’s a sample report title and salutation:

                        Accountant’s Compilation Report

To the Board of Directors and Management

XYZ Company

The signature on the compilation report can be manual, printed, or digital. 

If the accountant’s letterhead includes the city and state where the accountant practices, then the city and state can be omitted from the bottom of the compilation report.

The date of the compilation report should be the date the accountant completes the compilation procedures.

Omission of Substantially All Disclosures

Can the accountant omit all disclosures (notes to the financial statements) in a compilation engagement? Yes. Alternatively, the accountant can provide selected disclosures or if needed, full disclosure. In short, the accountant can do any of the following:

The compilation report should disclose the omission of substantially all disclosures with language such as the following:

Management has elected to omit substantially all the disclosures ordinarily included in financial statements prepared in accordance with the tax-basis of accounting. If the omitted disclosures were included in the financial statements, they might influence the user’s conclusions about the company’s assets, liabilities, equity, revenue, and expenses. Accordingly, the financial statements are not designed for those who are not informed about such matters.

The engagement letter should describe the level of disclosure to be included in the financial statements. 

Reporting Known Departures from the Applicable Financial Reporting Framework

If the accountant becomes aware of a material departure from the basis of accounting that is not corrected, he should modify the compilation report to disclose the departure. For example:

Management is responsible for the accompanying financial statements of XYZ Company, which comprise the balance sheets as of December 31, 20X2 and 20X1 and the related statements of income, changes in stockholder’s equity, and cash flows for the years then ended, and the related notes to the financial statements in accordance with accounting principles generally accepted in the United States of America. I (We) have performed compilation engagements in accordance with Statements on Standards for Accounting and Review Services promulgated by the Accounting and Review Services Committee of the AICPA. I (we) did not audit or review the financial statements nor was (were) I (we) required to perform any procedures to verify the accuracy or completeness of the information provided by management. I (we) do not express an opinion, a conclusion, nor provide any assurance on these financial statements.

Accounting principles generally accepted in the United States of America require that material impairments in the fair value of owned property be recognized in the balance sheet. Management has informed us that a recent appraisal of its Fumbleton office reflected a fair value of $2.25 million less than carrying value. If accounting principles generally accepted in the United States of America were followed, the buildings and equity accounts would have decreased by $2.25 million. 

[Signature of accounting firm or accountant, as appropriate]

[Accountant’s city and state]

[Report Date]


The effects of the departure, if known, should be disclosed in a separate paragraph of the compilation report. If the effects of the departure are not known and cannot be readily determined with the accountant’s procedures, the compilation report should include a statement that the determination has not been made by management.

The accountant may not issue a compilation report that states the financial statements (as a whole) are not presented in accordance with the applicable financial reporting framework. Doing so is considered, in effect, an adverse opinion. An adverse opinion can only be expressed in an audit engagement.

Reporting When There are Other Accountants

Other accountants might perform a compilation of a subsidiary. What is your reporting responsibility if you are performing a compilation of a consolidated entity that includes the subsidiary? The compilation report for the consolidated entity is not altered to make a reference to the other accountant. AR-C 80 is silent in regard to whether you are required to obtain a copy of the other accountant’s compilation report.

Going Concern

If the accountant becomes aware of uncertainties with regard to an entity’s ability to continue as a going concern, he may suggest additional disclosures. Without the additional going concern disclosures, it is possible that the financial statements could be misleading.

If substantially all disclosures are omitted from the financial statements, disclosure of the going concern uncertainty is not required. Even so, the accountant should be careful not to issue financial statements that are misleading. If needed, ask management to include the requisite going concern disclosures.

If the necessary going concern disclosures are not added and the financial statements are misleading, the accountant should consider withdrawing from the engagement.

Is it permissible to include an emphasis-of-a-matter paragraph in a compilation report? Yes.

The following is an example of a going concern uncertainty paragraph that could be added to a compilation report:

Going Concern

As discussed in Note H, certain conditions indicate that the Company may be unable to continue as a going concern. The accompanying financial statements do not include any adjustments that might be necessary should the Company be unable to continue as a going concern.

Independence

Where should an accountant’s lack of independence be noted in the compilation report? The accountant can disclose his lack of independence in the last paragraph of the compilation report with wording such as: 

I am (We are) not independent with respect to XYZ Company.

The reason for the lack of independence need not be included, but if the accountant includes one reason for a lack of independence, then all such reasons should be included. 

If independence is impaired and the accountant desires to provide the reason independence is impaired, the compilation report may include wording such as:

We are not independent with respect to XYZ Company as of and for the year ended June 30, 2019, because an engagement team member made management decisions on behalf of XYZ Company.

Compilation Reports - Special Purpose Frameworks

compilation engagements

The compilation report should highlight the use of a special purpose framework when one is used. 

If a special purpose framework is used and disclosures are included, then the compilation report should include a separate paragraph such as the following:

We draw attention to Note X in the financial statements, which describes the basis of accounting. The financial statements are prepared in accordance with the tax-basis of accounting, which is a basis of accounting other than accounting principles generally accepted in the United States of America.

If disclosures are omitted, the separate paragraph could read as follows:

The financial statements are prepared in accordance with the tax-basis of accounting, which is a basis of accounting other than accounting principles generally accepted in the United States of America.

Unless the entity elects to omit substantially all disclosures, the compilation report should be modified to describe departures when the financial statements do not contain:

  1. A description of the special purpose framework
  2. A summary of significant accounting policies 
  3. A description of how the special purpose framework differs from GAAP
  4. Disclosures similar to those of GAAP 

The description of the special purpose framework can be included in the titles of the financial statements or the notes. If the financial statements omit notes, the financial statement titles should include the special purpose framework; for example, Statement of Revenues and Expenses—Tax Basis.

If substantially all disclosures are omitted, then 2, 3, and 4 above are not necessary. However, the accountant should include a separate paragraph in the accountant’s compilation report stating that management elected to omit substantially all disclosures. (See the preceding section titled Omission of Substantially All Disclosures.)

Click here for more information about which special purpose framework you should use.

Other Historical Information

In addition to historical financial statements, AR-C 80 may be applied to the following:

  • Specified elements, accounts, or items of a financial statement, including schedules of:
    • Rents
    • Royalties
    • Profit participation, or
    • Income tax provisions
  • Supplementary information
  • Required supplementary information
  • Pro forma financial information

Prospective Information

AR-C 80 can be applied to prospective information.

Prospective financial information is defined as any financial information about the future. 

Prospective financial information can be presented as:

  • A complete set of financial statements, or
  • One or more elements, items, or accounts

If you prepare prospective financial information, the summary of significant assumptions must be included Why? It is considered essential to the user’s understanding of such information.

If you prepare a financial projection, you should not exclude:

  • The identification of hypothetical assumptions, or
  • The description of the limitations on the usefulness of the presentation

The compilation report should include statements that:

  • The forecasted or projected results may not be achieved and
  • The accountant assumes no responsibility to update the report for events and circumstances occurring after the date of the report

AR-C 80 references the AICPA Guide Prospective Financial Information as suitable criteria for the preparation and presentation of prospective financial information.

Prescribed Forms

Is it permissible to perform a compilation engagement with regard to prescribed forms?

Yes. There is nothing in the SSARSs that prohibits the accountant from performing a compilation engagement with regard to prescribed forms (e.g., bank personal financial statement).

When a bank, credit union, regulatory or governmental agency, or other similar entity designs a prescribed form to meet its needs, there is a presumption that the required information is sufficient. What should be done if the prescribed form conflicts with the applicable basis of accounting? For example, what if the prescribed form requires all numbers to be in compliance with GAAP with the exception of receivables? Follow the form, and no departure from the applicable reporting framework exists. In effect, the form and its related directions are treated as though they are the applicable reporting framework. The accountant must report departures from the prescribed form and related instructions as a departure from the applicable financial reporting framework. Include any significant departures in the compilation report. (See the preceding section titled Reporting Known Departures from the Applicable Financial Reporting Framework.)

If the prescribed form includes a compilation report not in conformity with AR-C 80, the report should not be signed. Append an appropriate compilation report to the prescribed form.

Conclusion

There you have it. Now you know how to perform a compilation engagement.

The main things to remember are (1) you need a signed engagement letter, (2) always include a compilation report with the financial statements, and (3) read the financial statements to determine if they are appropriate.

If you desire to issue financial statements without a compilation report, consider the use of AR-C 70, Preparation of Financial Statements.

For my free compilation course, click here.

Auditing Debt
Oct 28

Auditing Debt: The Why and How Guide

By Charles Hall | Auditing

What are the keys to auditing debt?

While auditing debt can be simple, sometimes it’s tricky.  For instance, classification issues can arise when debt covenant violations occur. Should the debt be classified as current or noncurrent? Likewise, some forms of debt (with detachable warrants) have equity characteristics, again leading to classification issues. Is it debt or equity—or both? Additionally, leases can create debt, even if that is not the intent. 

Most of the time, however, auditing debt is simple. A company borrows money. An amortization schedule is created. And thereafter, debt service payments are made and recorded. 

Either way, whether complicated or simple, below I show you how to audit debt.

Auditing Debt

Auditing Debt — An Overview

In many governments, nonprofits, and small businesses, debt is a significant part of total liabilities. Consequently, it is often a significant transaction area.

In this post, we will cover the following:

  • Primary debt assertions
  • Debt walkthroughs
  • Debt-related fraud
  • Debt mistakes
  • Directional risk for debt
  • Primary risks for debt
  • Common debt control deficiencies
  • Risk of material misstatement for debt
  • Substantive procedures for debt
  • Common debt work papers

Primary Debt Assertions

The primary relevant debt assertions include:

  • Completeness
  • Classification
  • Obligation

I believe, in general, completeness and classification are the most important debt assertions. When a company shows debt on its balance sheet, it is asserting that it is complete and classified correctly. By classification, I mean it is properly displayed as either short-term or long-term. I also mean the instrument is debt and recorded as such (and not equity). By obligation, I mean the debt is legally owed by the company and not another entity.

Keep these three assertions in mind as you perform your transaction cycle walkthroughs.

Debt Walkthroughs

Early in your audit, perform a walkthrough of debt to see if there are any control weaknesses. As you perform this risk assessment procedure, what questions should you ask? What should you observe? What documents should you inspect? Here are a few suggestions.

Debt Walkthrough

As you perform your debt walkthrough ask or perform the following:

  • Are there any debt covenant violations?
  • If the company has violations, is the debt classified appropriately (usually current)?
  • Is someone reconciling the debt in the general ledger to a loan amortization schedule?
  • Inspect amortization schedules.
  • Does the company have any unused lines of credit or other credit available?
  • Inspect loan documents.
  • Has the company refinanced its debt with another institution? Why?
  • Who approves the borrowing of new money?
  • Who approves new leases? Who handles lease accounting and are they competent?
  • Does the company have any leases that should be recorded as debt?
  • Inspect new loan and lease approvals. 
  • How are debt service payments made (e.g., by check or wire)? Who makes those payments?
  • Are there any sinking funds? If yes, who is responsible for making deposits and how is this done?
  • Observe the segregation of duties for persons:
    • Approving new loans,
    • Receipting loan proceeds,
    • Recording debt in the general ledger, and
    • Reconciling the debt in the general ledger to the loan amortization schedules
  • Is the company required to file periodic (e.g., quarterly) reports with the lender? Inspect sample debt-related reports, if applicable.
  • Does the company have any convertible debt or debt with detachable warrants? Are they properly recorded?
  • Is the company following reporting framework requirements (e.g., FASB Codification) for debt?
  • Has collateral been pledged? If yes, what?
  • What are the terms of the debt agreements?
  • Has all debt of the company been recorded in the general ledger?
  • Have debt issuance costs been accounted for properly based on the reporting framework requirements? (FASB requires the netting of such costs with debt.)
  • Has the company guaranteed the debt of another entity?

If control weaknesses exist, create audit procedures to address them. For example, if—during the walkthrough—we see that one person approves loans, deposits loan proceeds, and records the related debt, then we will perform fraud-related substantive procedures.

Debt-Related Fraud

A company can fraudulently inflate its equity by intentionally omitting debt from its balance sheet. (Total assets equal liabilities plus equity. Therefore, if debt is not reported, equity increases.) 

As we saw with Enron, some entities place their debt on another company’s balance sheet. (Enron did so using special purpose entities.) So auditors need to consider that companies can intentionally omit debt from their balance sheets.

Another potential fraudulent presentation is showing short-term debt as long-term. When might this happen? When debt covenant violations occur. Such violations can trigger a requirement to classify the debt as current. If accounting personnel are aware of the requirement to classify debt as current and don’t do so, then the reporting can be considered fraudulent.  

Additionally, mistakes can lead to errors in debt accounting.

Debt Mistakes

Errors in accounting for debt can occur when debt service payments are misclassified as expenses rather than a reduction of debt. Also, debt can—in error—be presented as long-term when it is current. Why? Maybe the company’s accountant doesn’t understand the accounting rules.

Some forms of debt, such as certain types of leases, can be difficult to interpret. Consequently, a company might errantly fail to record debt when required. 

So, what is the directional risk for debt? An overstatement or an understatement?

Directional Risk for Debt

Auditing Debt

The directional risk for debt is an understatement. So, audit for completeness (and determine that all debt is recorded).

Primary Risks for Debt

Primary risks for debt include:

  1. Debt is intentionally understated (or omitted)
  2. Debt is recorded as noncurrent (due more than one year from the balance sheet date) though the amount is current (due within one year of the balance sheet date)

It’s obvious why a company might want to understate its debt. The company looks healthier. But why would a business desire to classify current debt as noncurrent? For the same reason: to make the company look stronger. By recording current debt as noncurrent, the company’s working capital ratio (current assets divided by current liabilities) improves. 

As you think about the above risks, consider the control deficiencies that allow debt misstatements.

Common Debt Control Deficiencies

In smaller entities, it is common to have the following control deficiencies:

  • One person performs two or more of the following:
    • Approves the borrowing of new funds,
    • Enters the new debt in the accounting system, 
    • Deposits funds from the debt issuance
  • Funds are borrowed without appropriate approval
  • Debt postings are not agreed to amortization schedules
  • Accounting personnel don’t understand the accounting standards for debt (including lease accounting)

Another key to auditing debt is understanding the risks of material misstatement.

Risk of Material Misstatement for Debt

In auditing debt, the assertions that concern me the most are classification, completeness, and obligation. So my risk of material misstatement for these assertions is usually moderate to high. 

Auditing Debt

My response to the higher risk assessments is to perform certain substantive procedures: namely, a review of debt covenant compliance and a review of debt and lease agreements—and the related accounting. Why?

As we saw above, debt covenant violations may require the company to reclassify debt from noncurrent to current. Doing so can be significant. The loan could be called by the lender, depending on the loan agreement. So, proper classification of debt can be critical. 

Also, some leases should be recorded as debt. If such leases are not recorded, the company looks healthier than it is. Our audit should include procedures that address the completeness of debt and the obligations of the company.

Once your risk assessment is complete, decide what substantive procedures to perform.

Substantive Procedures for Debt

My customary tests for auditing debt are as follows:

  1. Summarize and test debt covenants
  2. Review new leases to determine if debt should be recorded
  3. Confirm all significant debt with lenders
  4. Determine if all debt is classified appropriately (as current or noncurrent)
  5. Agree the end-of-period balances in the general ledger to the amortization schedules
  6. Agree future debt service payment summaries to amortization schedules 
  7. Review accruals of any significant interest 
  8. Review interest expense (usually comparing current and prior year interest)

In light of my risk assessment and substantive procedures, what debt work papers do I normally include in my audit files?

Common Debt Work Papers

My debt work papers normally include the following:

  • An understanding of debt-related internal controls 
  • Documentation of any internal control deficiencies related to debt
  • Risk assessment of debt at the assertion level
  • Debt audit program
  • A copy of all significant debt agreements (including lease and line-of-credit agreements)
  • Minutes reflecting the approval of new debt
  • A summary of debt activity (beginning balance plus new debt minus principal payments and ending balance)
  • Amortization schedules for each debt
  • Summary of all debt information for disclosure purposes (e.g., future debt service to be paid, interest rates, types of debt, collateral, etc.) 

If there are questions regarding debt agreements and their presentation, I include additional language in the representation letter to address the issues. For example, if an owner loans funds to the company but there is no written  debt agreement, the owner or management might verbally explain the arrangement. In such cases, I include language in the management representation letter to cover the verbal responses.

In Summary

In this article we’ve looked at the keys to auditing debt. Those keys include risk assessment procedures, determining relevant assertions, creating risk assessments, and developing substantive procedures. The most important issues to address are usually (1) the classification of debt (especially if debt covenant violations exist) and (2) lease accounting.

Next we’ll look at how to audit equity.


Auditing Payroll
Oct 14

Auditing Payroll: The Why and How Guide

By Charles Hall | Auditing

While payroll is often seen as a low-risk area, considerable losses can occur here. So, knowing how to audit payroll is important.  

In this post, I’ll answer questions such as, “how should I test payroll?” And “when should I perform fraud-related payroll procedures?”

Auditing Payroll

Auditing Payroll - An Overview

Payroll exceeds fifty percent of total expenses in many governments, nonprofits, and small businesses. Therefore, it is often a significant transaction area.

To assist you in understanding how to audit payroll, let me provide you with an overview of a typical payroll process.

First, understand that entities have payroll cycles (e.g., two weeks starting on Monday). Then, payments are made at the end of this period (e.g., the Tuesday after the two-week period). Also, understand that most organizations have salaried and hourly employees. Salaried personnel are paid a standard amount each payroll, and hourly employees earn their wages based on time.

Second, an authorized person (e.g., department head) hires a new employee at a specified rate (e.g., $80,000 per year).

Third, human resources assists the new-hire with the completion of payroll forms, including tax forms and elections to purchase additional benefits such as life insurance. 

Fourth, a payroll department employee enters the approved wage in the accounting system. The employee’s bank account number is entered into the system (if direct deposit is used). 

Fifth, employees clock in and out so that time can be recorded.  

Sixth, once the payroll period is complete, a person (e.g., department supervisor) reviews and approves the recorded time. 

Seventh, a second person (e.g., payroll supervisor) approves the overall payroll. 

Eighth, the payroll department processes payments. Direct deposit payments are made (and everyone is happy). 

In this article, we will cover the following:

  • Primary payroll assertions
  • Payroll walkthroughs
  • Payroll fraud
  • Payroll mistakes
  • Directional risk for payroll
  • Primary risks for payroll
  • Common payroll control deficiencies
  • Risk of material misstatement for payroll
  • Substantive procedures for payroll
  • Common payroll work papers

Primary Payroll Assertions

The primary relevant payroll assertions are:

  • Completeness
  • Cutoff
  • Occurrence

I believe—in general—completeness and cutoff (for accrued payroll liabilities) and occurrence (for payroll expenses) are the most important payroll assertions. When a company accrues payroll liabilities at period-end, it is asserting that they are complete and that they are recorded in the right period. Additionally, the company is saying that recorded payroll expenses are legitimate.

To detect threats to these assertions, you must understand the entity’s payroll system. I do so with a payroll walkthrough.

Payroll Walkthroughs

Perform a walkthrough of payroll to see if there are any control weaknesses. How? Walk transactions from the beginning (the hiring of an employee) to the end (a payroll payment and posting). And ask questions such as the following:

  • Does the company have a separate payroll bank account?
  • How often is payroll processed? What time period does the payroll cover? On what day is payroll paid?
  • Who has the authority to hire and fire employees?
  • What paperwork is required for a new employee? For a terminated employee?
  • Is payroll budgeted?
  • Who monitors the budget to actual reports? How often?
  • Who controls payroll check stock? Where is it stored? Is it secure? 
  • If the company uses direct deposit, who keys the bank account numbers into the payroll system? Who can change those numbers?
  • Do larger salary payments require multiple approvals?
  • Who approves overtime payments?
  • Who monitors compliance with payroll laws and regulations?
  • Who processes payroll and how?
  • Who signs checks or makes electronic payments? If physical checks are used, are they signed electronically (as checks are printed) or physically?
  • How are payroll tax payments made? How often? Who makes them?
  • Who creates the year-end payroll tax documents (e.g., W-2s) and how?
  • What controls ensure the recording of payroll in the appropriate period?
  • Are the following duties assigned to different persons:
    • Approval of each payroll,
    • Processing and recording payroll, 
    • The reconciliation of related bank statements
    • Possession of processed payroll checks
    • Ability to enter or change employee bank account numbers
    • Ability to add employees to the payroll system or to remove them
  • Who can add or remove employees from the payroll system? What is the process for adding and removing employees from the payroll system?
  • Who can change the master pay rate file? Does the computer system provide an audit trail of those changes?
  • Who approves salary rates and how?
  • Who reconciles the payroll bank statements and how often?
  • Who approves bonuses? 
  • What benefits (e.g., retirement accounts) does the company offer? Who pays for the benefits (e.g., employee) and how (e.g., payroll withholding)?
  • Who reconciles the payroll withholding accounts and how often?
  • Are any salaries capitalized rather than expensed? If yes, how and why?
  • Are surprise payroll audits performed? If yes, by whom?
  • Does the company outsource its payroll to a service organization? If yes, does the payroll company provide a service organization control (SOC) report? What are the service organization controls? What are the complementary controls (those performed by the employing company)?

Moreover, as we ask these questions, we need to inspect documents (e.g., payroll ledger) and make observations (e.g., who signs checks or makes electronic payments?).

If controls weaknesses exist, we create audit procedures to respond to them. For example, during the walkthrough, if we see that one person prints and signs checks, records payments, and reconciles the bank statement, then we will plan fraud-related substantive procedures.

As we perform payroll walkthroughs, we are asking, “What can go wrong—whether intentionally or by mistake?”

Payroll Fraud

When payroll fraud occurs, understatements or overstatements of payroll expense may exist.

If a company desires to inflate its profit, it can—using bookkeeping tricks—understate its expenses. As (reported) costs go down, profits go up.

On the other hand, overstatements of payroll can occur when theft is present. For example, if a payroll accountant pays himself twice, payroll expenses are higher than they should be.

Payroll Mistakes

Mistakes also lead to payroll misstatements. Payroll errors can occur when payroll personnel lack sufficient knowledge to carry out their duties. Additionally, misstatements occur when employees fail to perform internal control procedures such as reconciling bank statements. 

Directional Risk for Payroll

Auditing Payroll

The directional risk for payroll is an understatement. So, audit for completeness (determining that all payroll is recorded). Nevertheless, when payroll theft occurs (e.g., duplicate payments), overstatements can occur. 

Primary Risks for Payroll

The primary payroll risks include:

  1. Payroll is intentionally understated
  2. Inappropriate parties receive payments
  3. Employees receive duplicate payments

As you think about these risks, consider the control deficiencies that allow payroll misstatements.

Common Payroll Control Deficiencies

In smaller entities, it is common to have the following control deficiencies:

  • One person performs two or more of the following: 
    • Approves payroll payments to employees,
    • Enters time or salary rates in the payroll system,
    • Issues payroll checks or makes direct deposit payments, 
    • Adds or removes employees from the payroll system
    • Reconciles the payroll bank account
  • No one reviews and approves recorded time
  • No one reviews and approves payroll before processing
  • No one performs surprise audits of payroll
  • Appropriate procedures for adding and removing employees are not present
  • No one reviews the removal of terminated employees from payroll 
  • No one compares payroll expenses to a budget

(Here are suggestions to make your payroll controls stronger.)

Another key to auditing payroll is understanding the risks of material misstatement.

Risk of Material Misstatement for Payroll

In auditing payroll, the assertions that concern me the most are completeness, occurrence, and cutoff. So my risk of material misstatement for these assertions is usually moderate to high.

My response to higher risk assessments is to perform certain substantive procedures: namely, a reconciliation of payroll in the general ledger to quarterly 941s. Why? The company has an incentive to accurately file 941s since the returns are subject to audit by governmental authorities. So, if the 941s are correct, the reconciliation provides support for recorded payroll.

Additionally, consider theft which can occur in numerous ways, such as duplicate payments or ghost employees. 

In a duplicate payment fraud, the thief, usually a payroll department employee, pays himself twice. 

Ghost employees exist when payroll personnel leave a terminated employee on the payroll. Why would someone in the payroll department intentionally leave a terminated employee in the payroll system? To steal the second payment. How? By changing the terminated employee’s direct deposit bank account number to his own. The result? He receives two payments (his own and that of the terminated employee). 

Once your payroll risk assessment is complete, decide what substantive procedures to perform.

Substantive Procedures for Payroll

Auditing Payroll

My customary tests for auditing payroll are as follows:

  1. Reconcile 941s to payroll
  2. Recompute accrued payroll liability (amount recorded at period-end)
  3. Review payroll withholding accounts for appropriateness and vouch subsequent payments for any significant amounts
  4. Compare payroll expenses (including benefits) to budget and examine any unexplained variances
  5. When control weaknesses are present, design and perform procedures to address the related risks
  6. Compare accrued vacation to prior periods and current payroll activity

In light of my risk assessment and substantive procedures, what payroll work papers do I normally include in my audit files?

Common Payroll Work Papers

My payroll work papers normally include the following:

  • An understanding of payroll-related internal controls
  • Risk assessment of payroll at the assertion level
  • Documentation of any payroll control deficiencies
  • Payroll audit program
  • Accrued salaries detail at period-end
  • A summary of any significant payroll withholding accounts with supporting information
  • A detail of vacation payable (if material) with comparisons to prior periods
  • Budget to actual payroll reports
  • A reconciliation of payroll in the general ledger to quarterly 941s 
  • Fraud-related payroll work papers (when needed)

In Summary

In this article we looked at the keys to auditing payroll. Those keys include risk assessment procedures, determining relevant assertions, assessing risks, and developing substantive procedures. My go-to substantive procedure is to reconcile payroll to 941s. I also review payroll withholding accounts and recompute salary accruals. Comparisons of payroll expenses are useful. Finally, if merited, I perform fraud-related payroll procedures.

In the next post we’ll look at how to audit debt.

Auditing accounts payable
Oct 09

Auditing Accounts Payable and Expenses: The Why and How Guide

By Charles Hall | Auditing

Accounts payable is usually one of the more important audit areas. Why? Risk. First, it’s easy to increase net income by not recording period-end payables. Second, many forms of theft occur in the accounts payable area.

Auditing accounts payable

In this post, I’ll answer questions such as, “how should we test accounts payable?” And “should I perform fraud-related expense procedures?” We’ll also take a look at common payables-related risks and how to respond to them.

Auditing Accounts Payable and Expenses — An Overview

What is a payable? It’s the amount a company owes for services rendered or goods received. Suppose the company you are auditing receives $2,000 in legal services in the last week of December 2019, but the law firm sends the related invoice in January 2020. The company owes $2,000 as of December 31, 2019. The services were provided, but the payment was not made until after the year-end. Consequently, the company should accrue (record) the $2,000 as payable at year-end.

In determining whether payables exist, I like to ask, “if the company closed down at midnight on the last day of the year, would it have a legal obligation to pay for a service or good?” If the answer is yes, then record the payable even if the invoice is received after the year-end. Was a service provided or have goods been received by year-end? If yes (and the amount has not already been paid), accrue a payable.

In this chapter, we will cover the following:

  • Primary accounts payable and expense assertions
  • Accounts payable and expense walkthroughs
  • Directional risk for accounts payable and expenses
  • Primary risks for accounts payable and expenses
  • Common accounts payable and expense control deficiencies
  • Risks of material misstatement for accounts payable and expenses
  • Search for unrecorded liabilities
  • Auditing for accounts payable and expense fraud
  • Substantive procedures for accounts payable and expenses
  • Typical accounts payable and expense work papers

Primary Accounts Payable and Expense Assertions

The primary relevant accounts payable and expense assertions are:

  • Existence
  • Completeness
  • Cutoff
  • Occurrence

Of these assertions, I believe completeness and cutoff (for payables) and occurrence (for expenses) are usually most important. When a company records its payables and expenses by period-end, it is asserting that they are complete and that they are accounted for in the right period. Additionally, the company is implying that amounts paid are legitimate.

Accounts Payable and Expense Walkthroughs

As we perform walkthroughs of accounts payable and expenses, we are looking for understatements (though they can also be overstated as well). We are asking, “what can go wrong?” whether intentionally or by mistake?

Auditing accounts payable

In performing accounts payable and expense walkthroughs, ask questions such as:

  • Who reconciles the accounts payable summary to the general ledger?
  • Does the company use an annual expense budget?
  • Are budget/expense reports provided to management or others? Who receives these reports?
  • What controls ensure the recording of payables in the appropriate period?
  • Who authorizes purchase orders? Are any purchases authorized by means other than a purchase order? If yes, how?
  • Are purchase orders electronic or physical?
  • Are purchase orders numbered?
  • How does the company vet new vendors?
  • Who codes invoices (specifies the expense account) and how?
  • Are three-way matches performed (comparison of purchase order with the receiving document and the invoice)?
  • Are paid invoices marked “paid”?
  • Does the company have a purchasing policy?
  • Can credit cards be used to bypass standard purchasing procedures? Who has credit cards and what are the limits? Who reviews credit card activity?
  • Are bids required for certain types of purchases or dollar amounts? Who administers the bidding process and how?
  • Do larger payments require multiple approvals?
  • Which employees key invoices into the accounts payable module?
  • Who signs checks or makes electronic payments?
  • Who is on the bank signature card?
  • Are signature stamps used? If yes, who has control of the signature stamps and whose signature is affixed?
  • How are electronic payments made (e.g., ACH)?
  • Is there adequate segregation of duties for persons:
    • Approving purchases,
    • Paying payables,
    • Recording payables, and
    • Reconciling the related bank statements
  • Which persons have access to check stock and where is the check stock stored?
  • Who can add vendors to the payables system?
  • What are the entity’s procedures for payments of travel and entertainment expenses? 
  • Who reconciles the bank statements and how often?

As we ask these questions, we inspect documents (e.g., payables ledger) and make observations (e.g., who signs checks or makes electronic payments?). So, we are inquiring, inspecting, and observing. 

If controls weaknesses exist, we create audit procedures to respond to them. For example, if--during the walkthrough--we see that one person prints and signs checks, records payments, and reconciles the bank statement, then we will perform fraud-related substantive procedures (more about this in a moment).

Learn More About Walkthroughs:
Receive Four (Free) Emails

Directional Risk for Accounts Payable and Expenses

The directional risk for accounts payable and expenses is an understatement. So, perform procedures to ensure that invoices are properly included. For example, perform a search for unrecorded liabilities (see below).

Primary Risks for Accounts Payable and Expenses

The primary risks for accounts payable and expenses are:

  1. Accounts payable and expenses are intentionally understated 
  2. Payments are made to inappropriate vendors
  3. Duplicate payments are made to vendors 

Common Accounts Payable and Expense Control Deficiencies

Auditing accounts payable

In smaller entities, it is common to have the following control deficiencies:

  • One person performs two or more of the following:
    • Approves purchases,
    • Enters invoices in the accounts payable system,
    • Issues checks or makes electronic payments, 
    • Reconciles the accounts payable bank account,
    • Adds new vendors to the accounts payable system
  • A second person does not review payments before issuance
  • No one performs surprise audits of accounts payable and expenses 
  • Bidding procedures are weak or absent
  • No one reconciles the accounts payable detail to the general ledger
  • New vendors are not vetted for appropriateness
  • The company does not create a budget
  • No one compares expenses to the budget
  • Electronic payments can be made by one person (with no second-person approval or involvement)
  • The bank account is not reconciled on a timely basis
  • When bank accounts are reconciled, no one examines the canceled checks for appropriate payees (the dollar amount on the bank statement is agreed to the general ledger but no one compares the payee name on the cleared check to the vendor name in the general ledger)

When segregation of duties is lacking, consider whether someone can use the expense cycle to steal funds. How? By making payments to fictitious vendors, for example. Or intentionally paying a vendor twice--and then stealing the second check. (See the section titled Auditing for Accounts Payable and Expense Fraud below.)

Risks of Material Misstatement for Accounts Payable and Expenses

In smaller engagements, I usually assess control risk at high for each assertion. When I assess control risk at less than high, I have to test controls to support the lower risk assessment. Therefore, assessing risks at high is usually more efficient (than testing controls).

When control risk is assessed at high, inherent risk becomes the driver of the risk of material misstatement (control risk X inherent risk = risk of material misstatement). The assertions that concern me the most are completeness, occurrence, and cutoff. So my RMM for these assertions is usually moderate to high.

My response to higher risk assessments is to perform certain substantive procedures: namely, a search for unrecorded liabilities and detailed expense analyses. The particular expense accounts that I examine are often the result of my preliminary planning analytics

Search for Unrecorded Liabilities

How does one perform a search for unrecorded liabilities? Use these steps:

  1. Obtain a complete check register for the period subsequent to your audit period
  2. Pick a dollar threshold ($10,000) for the examination of subsequent payments
  3. Examine the subsequent payments (above the threshold) and related invoices to determine if the payables are suitably included or excluded from the period-end accounts payable detail
  4. Inquire about any unrecorded invoices

As the RMM for completeness increases, vouch payments at a lower dollar threshold.

How should you perform a detailed analysis of expense accounts? First, compare your expenses to budget—if the entity has one—or to prior year balances. If you note any significant variances (that can’t be explained), then obtain a detail of those particular expense accounts and investigate the cause.

Theft can occur in numerous ways—such as fictitious vendors or duplicate payments. If control weaknesses are present, consider performing fraud-related procedures. When fraud-related control weaknesses exist, assess the RMM for the occurrence assertion at high. Why? There is a risk that the expense (the occurrence) is fraudulent. 

So, how should you respond to such risks?

Auditing for Accounts Payable and Expense Fraud

Auditing accounts payable

An example of a fraud-related test is one for duplicate payments. How?

  • Obtain a check register in Excel
  • Sort by the vendor
  • Scan the check register for payments made to the same vendor for the same amount
  • Inquire about payments made to the same vendor for the same amount

In a duplicate payment fraud, the thief intentionally pays an invoice twice. He steals the second check and converts it to cash.

This is just one example of expense fraud. There are dozens of such schemes. 

(See White Collar Crime is Knocking at Your Door: Are You Prepared?)

Substantive Procedures for Accounts Payable and Expenses

My customary audit tests are as follows:

  1. Vouch subsequent payments to invoices using the steps listed above (in Search for Unrecorded Liabilities)
  2. Compare expenses to budget and examine any unexplained variances
  3. When control weaknesses are present, design and perform fraud detection procedures

If there are going concern issues, you may need to examine the aged payables listing. Why? Management can fraudulently shorten invoice due dates. Doing so makes the company appear more current. For example, suppose the business has three unpaid invoices totaling $1.3 million that were due over ninety days ago. The company changes the due dates in the accounts payable system, causing the invoices to appear as though they were due just thirty days ago. Now the aged payables listing looks better than it would have. 

Typical Accounts Payable and Expense Work Papers

My accounts payable and expense work papers usually include the following:

  • An understanding of internal controls as they relate to accounts payable and expenses
  • Risk assessment of accounts payable and expenses at the assertion level
  • Documentation of any accounts payable and expense control deficiencies
  • Accounts payable and expense audit program
  • An aged accounts payable detail at period-end
  • A search for unrecorded liabilities work paper
  • Budget to actual expense reports and, if unexpected variances are noted, a detailed analysis of those accounts 
  • Fraud-related expense work papers (if significant control weaknesses are present)

So, now you know the why and how of auditing accounts payable and expenses.

In some entities such as governments, payroll makes up over 50% of total expenses. Consequently, knowing how to audit payroll expenses is of great importance. My next post is titled The Why and How of Auditing Payroll. So, stay tuned.

See my prior posts in The Why and How of Auditing.

1 2 3 51
>