All Posts by Charles Hall

Follow

About the Author

Charles Hall is a practicing CPA and Certified Fraud Examiner. For the last thirty years, he has primarily audited governments, nonprofits, and small businesses. He is the author of The Little Book of Local Government Fraud Prevention and Preparation of Financial Statements & Compilation Engagements. He frequently speaks at continuing education events. Charles is the quality control partner for McNair, McLemore, Middlebrooks & Co. where he provides daily audit and accounting assistance to over 65 CPAs. In addition, he consults with other CPA firms, assisting them with auditing and accounting issues.

Single Audit Major Program Determination
Jun 13

Single Audit Major Program Determination

By Charles Hall | Auditing

Single Audit major program determination can be challenging. And if this determination is wrong, your Single Audit will be wrong. 

So in this article, I explain how you can correctly determine your major programs in four steps. 

Single Audit Major Program Determination

First, understand that Single Audits focus on major programs. This is how you know which programs to test. So if your auditee has multiple federal programs, it's important to determine which are major and which are not. 

Here is a summary of the four steps of Single Audit major program determination:

  1. Identify Type A programs
  2. Identify Type A low-risk programs
  3. Identify Type B high-risk programs
  4. Determine major programs

(If you desire a deeper dive, watch the following video with a case study.)

Before you do any of these, create a list of all federal programs, similar to the schedule of expenditure of federal awards (the SEFA). The list is comprised of each federal program and the amounts expended. 

Next, apply the four steps to this list. We'll start by identifying the type A programs.

1. Identify Type A Programs

The type A threshold is $750,000 when the total federal awards expended are $25 million or less. So if you have a federal program of $750,000 or greater, then it's a type A program. Type B programs are those of less than $750,000. 

When total federal awards exceed $25 million, see the table below.

Total federal awards expended

Type A/B threshold

≥$750,000 and ≤ $25 million

$750,000

>$25 million but ≤ $100 million

total federal awards expended times .03

>$100 million but ≤ $ 1 billion

$3 million

> $1 billion but ≤ $10 billion

total federal awards expended times .003

>$10 billion but ≤ $20 billion

$30 million

>$20 billion

total federal awards expended times .0015

Remove the Large-Loan Program Distortion

Large loan programs can potentially cause some type A programs to be excluded. In other words, large loan programs can cause some programs to be deemed type B though they should be type A. Therefore, the auditor subtracts any large loan balances from the total federal programs before determining what programs are type A.

And what are large loan balances? They are loan programs that exceed four times the largest non-loan program.

So see what the largest non-loan program is and multiply that amount times four. Then see if any loan programs exceed that amount. If they do, subtract the large loan program from the total federal awards before determining the A/B thresholds. See §200.518 (b)(3) for more information. 

Clusters are One Program

Additionally, if the entity has a cluster such as student financial aid, then treat that program as one program. Clusters have multiple CFDA numbers for each grant but are treated as one program when performing a Single Audit. The Compliance Supplement states "a cluster of programs means a grouping of closely related programs that share common compliance requirements." So if you have a cluster, add all the grants together to see if the total cluster exceeds the type A threshold. (See part 5 of the Compliance Supplement for additional information about clusters.)

No Type A Programs

What if there are no type A programs? Then go to step 4 and pick enough programs to satisfy the coverage requirement. 

Next, we'll see how to identify low-risk type A programs. 

2. Identify Low-Risk Type A Programs

The Uniform Guidance provides the auditor with criteria in §200.518 (c) for determining whether a type A program is low risk. Type A programs that meet these criteria are low-risk. Programs that do not meet these criteria are not low-risk. 

The Uniform Guidance says,

For a Type A program to be considered low-risk, it must have been audited as a major program in at least one of the two most recent audit periods.

Consequently, a type A program will be major at least once every three years.

Additionally, the Uniform Guidance goes on to say:

in the most recent audit period, the program must have not had:
(i) Internal control deficiencies which were identified as material weaknesses in the auditor's report on internal control for major programs as required under §200.515 Audit reporting, paragraph (c);
(ii) A modified opinion on the program in the auditor's report on major programs as required under §200.515 Audit reporting, paragraph (c); or
(iii) Known or likely questioned costs that exceed five percent of the total Federal awards expended for the program.

Additionally, federal agencies can request that programs not be considered low-risk for certain recipients. If such a request is made, the program will not be low risk. 

But if the factors listed above don't lead to a high-risk classification, can the auditor use inherent risk factors such as size and complexity to move the assessment to high risk? No. The auditor must use the criteria listed above. 

And what if there are no low-risk programs?

No Low-Risk Type A Programs

If there are no low-risk type A programs then step 3, identifying high-risk type B programs, is not necessary. Go directly to step 4: Determine major programs. 

Now, let's take a look at step 3: Identifying high-risk type B programs.

3. Identifying High-Risk Type B Programs

The auditor identifies the type B programs by using their judgment and criteria such as that listed below. But how many high-risk type B programs should the auditor identify? No more than at least one-fourth the number of low-risk type A programs.

Additionally, the auditor is only required to perform risk assessments of type B programs that exceed 25% of the type A threshold (e.g., 25% of 750,000 is $187,500). If all of the type B programs are less than this amount, then none are assessed. And you skip step 3. But if you have type B programs greater than this 25% amount, perform risk assessments.

In determining whether a type B program is high-risk, the auditor should use factors such as:

  • The complexity of the program
  • The phase of the program in its life cycle (newer programs may be higher risk)
  • The degree of significant changes in the program or related statutes and regulations
  • The size of the program (programs with larger expenditures are higher risk)
  • Weaknesses in internal controls as related to compliance requirements (e.g., controls to ensure allowability of costs)
  • Prior audit findings
  • The structure of the internal control system (multiple structures tend to be higher risk)
  • Federal programs not recently audited as a major program
  • Oversight by a federal agency (if their review noted issues, then the program could be higher risk)

Other than known material control weaknesses in internal controls pertaining to compliance requirements or known compliance problems, a single risk criterion will seldom cause the program to be high risk.

But what if there are no high-risk type B programs?

No High-Risk Type B Programs

If there are no high-risk type B programs, then none are major. This is true even if there are low-risk type A programs. You can't make a type B program high-risk just because a low-risk type A program exists (and you're trying to meet the one-fourth of type A low-risk requirement). So, assess the program in light of the criteria. And let it be what it is, whether high-risk or low-risk.

If, however, there are multiple high-risk type B programs, a potential problem arises: identifying too many high-risk programs.

Identify Only What is Required

Don't make the mistake of identifying more high-risk type B programs than what is necessary. If you do, then you must test them all (those you identified as high-risk). So, once you have identified the requisite number of high-risk type B programs, stop. 

If there are multiple potential type B high-risk programs and not all are identified as high-risk, then consider rotating the programs tested each year. 

Rotate Programs Tested

The Uniform Guidance (§200.518) encourages providing "an opportunity for different high-risk type B programs to be audited as major over a period of time." So if the auditor only needs one type B high-risk program, for example, and there are multiple potential high-risk type B programs, then it is desirable to identify a different one as major each year. That way, different type B high-risk programs will be audited over time.

We're almost done. Now, let's determine the major programs.

4. Determine Major Programs

At a minimum, the following will be your major programs:

  • All type A programs not identified as low risk
  • All type B programs identified as high-risk
  • Any additional programs needed to comply with the percentage of coverage rule

So what is the percentage of coverage rule? It's 20% for low-risk auditees and 40% for those that are not low-risk auditees. But what does this mean? Well, let's look at an example to clarify.

Suppose the entity is a low-risk auditee. And suppose the entity has type A program that is not low risk (it's a major program). It makes up 17% of the total federal awards. All other programs are type B and none is considered major. What should be done? Pick a type B program and test it. But the program picked must bring the total tested to at least 20% of the total federal awards. Now you've complied with the coverage rule.

The low-risk auditee criteria follows below. Though there are similarities with program risk assessment criteria shown above, there are differences as well. 

Low-Risk Auditee

An auditee must meet all of the following conditions for each of the preceding two audit periods to qualify as a low-risk auditee:

  • An annual Single Audit was performed and the reporting package was timely filed with the Federal Audit Clearinghouse
  • The auditor issued an unmodified opinion on the financial statements and on the schedule of expenditures of federal awards
  • There were no internal control material weaknesses in the Yellow Book report
  • The auditor's opinion did not report substantial doubt about the entity's ability to continue as a going concern
  • No federal programs had findings from any of the following in the preceding two years:
    • No material weaknesses in internal control for a major program
    • No modified opinion on a major program
    • No known or likely questioned costs that exceeded five percent of the total federal awards expended for a type A program during the audit period

So if the entity meets all of these conditions, it is a low-risk auditee and you can use the 20% threshold. If not, use 40%.

Meeting the percentage of coverage rule does not by itself permit the auditor to skip remaining steps. Suppose in step 2. that one type A program is 50% of the total federal awards and is identified as a major program, can the auditor skip step 3.? Not necessarily. Coverage does not exempt the auditor from following the remaining steps. 

Four Steps of Major Program Determination

Now you know how to determine which programs are major. These are the programs you'll test for compliance. You'll also test related compliance internal controls.

Additionally, you now know how to determine whether an entity is a low-risk auditee.

You may want to save this article and keep it handy. Why? Well, the four-step determination is relevant in every Single Audit. 

If you're looking for information about whether an entity is required to have a Single Audit, see my article

Single Audit Applicability
Jun 07

Single Audit Applicability and Objectives

By Charles Hall | Auditing , Local Governments

Your organization received federal funds but you're not sure about Single Audit applicability. Should you engage an audit firm to perform a Single Audit or not? 

In this article, I'll help you determine whether a Single Audit is needed. I'll also explain the objectives of such an audit. Why? So you can understand what auditors are looking for.

Single Audit Applicability

Single Audit: What is it?

Many nonprofits and governments receive federal funds from the United States government. And some of those entities are required to have a Single Audit.

But what is a Single Audit? It's just what it says: a single audit. Of what? A single audit of all federal awards received by a nonprofit or a government. 

For example, a county government might receive disaster funds from FEMA and a block grant from HUD. But rather than contracting for two separate audits, a Single Audit of both programs is performed. This audit requirement is usually triggered when total federal awards exceed $750,000 in one year.

The Uniform Guidance

So what guidance does the auditor and the nonfederal organization (government or nonprofit) follow? The Office of Management and Budget's (OMB) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awardscommonly referred to as the Uniform Guidance.

Subpart F, Audit Requirements, provides guidance for auditors.

Next, let's dig a little deeper regarding Single Audit applicability.

Single Audit Applicability

When is a Single Audit required? The Uniform Guidance states: A non-Federal entity that expends $750,000 or more during the non-Federal entity's fiscal year in Federal awards must have a single audit. (There is an exception. That's when the entity elects to have a program specific audit.)

But what does expend mean? Typically the word means that an entity spends money. But the word expend has a broader meaning in Single Audits. For example, the word includes:

  • receipt of federal property or goods (e.g., surplus property or commodities)
  • receipt and use of federal loans 
  • loan balances with the federal government (when there are continuing compliance requirements)
  • interest subsidies from the federal government

So if the government or nonprofit expends at least $750,000 in federal funds during its fiscal year, a Single Audit is necessary. If it expends less than $750,000, then a Single Audit is normally not required. States may, however, require a Single Audit even though amounts expended are less than $750,000.

Does the entity look solely at funds received directly from the federal government? No. Federal awards may come directly from a federal agency. But they may also come indirectly through a pass-through entity such as a state. The nature of the federal funds does not change as it passes through an entity (e.g., a state). It's still federal money.

In light of these facts, how does the Uniform Guidance define federal financial assistance? Let's take a look.

What is Federal Financial Assistance?

The Uniform Guidance defines federal assistance in the following manner:

§ 200.40 Federal financial assistance.

(a) Federal financial assistance means assistance that non-Federal entities receive or administer in the form of:

  (1) Grants;

  (2) Cooperative agreements;

  (3) Non-cash contributions or donations of property (including                 donated surplus property);

  (4) Direct appropriations;

  (5) Food commodities; and

  (6) Other financial assistance (except assistance listed in paragraph       (b) of this section).

(b) For § 200.202 Requirement to provide public notice of Federal financial assistance programs and Subpart F - Audit Requirements of this part, Federal financial assistance also includes assistance that non-Federal entities receive or administer in the form of:

  (1) Loans;

  (2) Loan Guarantees;

  (3) Interest subsidies; and

  (4) Insurance.

Total of Federal Assistance

The non-federal entity adds all federal financial assistance together to see if they exceed the $750,000 threshold. If, for example, a county government expends $500,000 in block grant funds and $450,000 in disaster funds during its fiscal year, then a Single Audit is necessary. 

Now that you understand Single Audit applicability, you may be wondering what the objectives are. 

Objectives of a Single Audit

The easiest way to understand the objectives of a Single Audit is to look at a Single Audit report. See example 13-1 from the AICPA. There are two main objectives. 

1. Opinion on Compliance with Federal Program Requirements

First, understand that the auditor provides an opinion regarding the entity's compliance with major federal program requirements.

A portion of that wording reads as follows:

Opinion on Each Major Federal Program
In our opinion, Example Entity complied, in all material respects, with the types of compliance requirements referred to above that could have a direct and material effect on each of its major federal programs for the year ended June 30,20X1.
2. Reporting on Internal Control Testing

Second, understand that the auditor reports on internal control testing. While no audit opinion is rendered by the auditor, the controls are tested nonetheless.  

A portion of that wording reads as follows:

Report on Internal Control Over Compliance
Management of Example Entity is responsible for establishing and maintaining effective internal control over compliance with the types of compliance requirements referred to above. In planning and performing our audit of compliance, we considered Example Entity's internal control over compliance with the types of requirements that could have a direct and material effect on each major federal program to determine the auditing procedures that are appropriate in the circumstances for the purpose of expressing an opinion on compliance for each major federal program and to test and report on internal control over compliance in accordance with the Uniform Guidance, but not for the purpose of expressing an opinion on the effectiveness of internal control over compliance. Accordingly, we do not express an opinion on the effectiveness of Example Entity's internal control over compliance.

Single Audit Applicability and Objectives

In summary, Single Audits are necessary when an entity expends $750,000 or more. And the objectives of the audit are to provide an opinion on compliance with federal requirements and to report on the internal control testing. 

Jun 06

Higher Audit Prices Due to Higher Risk

By Charles Hall | Auditing

Audit risk increases uncertainty—and price. At least, it should.

In this post, I provide examples increased audit risk and reasons why audit prices should increase accordingly.

First, let’s look at examples of increased audit risk.

Factors that Increase Audit Risk

Factors that increase audit risk include:

  • Entity is about to be sold
  • Records not reconciled on a timely basis (including bank accounts, inventory, accounts receivable, and accounts payable)
  • Business with a high debt load and covenant violations
  • Known existence of fraud
  • Inexperienced management in a complicated business
  • Known legal proceedings against the company
  • Unusual estimates (e.g., environmental liabilities)
  • Complex transaction cycles with varied accounting systems (systems differ at each location)
  • Group audit situations with subsidiaries audited by other audit firms (especially if the components are foreign entities)
  • Entities with severe cash flow deficiencies

Now, let’s think about why we might increase our audit prices based on such risks.

Your Insurance Carrier’s Perspective

Pretend, for a moment, that you are a representative of a professional liability insurance carrier, and you’ve been assigned the duty of reviewing an audit firm’s book of business. How would you rate–from an insurance perspective–audits of the following entities?

  1. The City of Perfect has a CPA as its finance director. For the last twenty years, they have received the financial reporting Government Finance Officer’s Certificate of Achievement. They have never had a significant fraud. The city’s net position is strong, and it has no debt.
  2. Shazaam, Incorporated, is a high-tech company funded with venture capital. Operations began two years ago. Shazaam has weak cash flow, but the company has successfully created one new whiz-bang product, making it a highly desirable acquisition target. Potential suitors have already made visits to the company’s headquarters inquiring about a purchase.
  3. Sterling Parts, Incorporated, sells auto parts mainly in the United States, but it also has manufacturing operations in Germany. The company has eight subsidiaries, one of which is the German production component. This entity has been cited for contaminating the Rhine river. The cost of cleanup and damages are not known. The foreign entity uses an accounting system that is entirely different from the other companies. A German accounting firm audits the manufacturing component.

Would you price the insurance for all three engagements the same? Certainly not. The City of Perfect is…well perfect. The second and third audits have risk elements.

So if we as auditors examine prospective audit clients purely with an eye on risk, there should be a premium (higher fee) for those with increased risk. Why? There is a higher probability that the audit firm will suffer loss. The inherent risks in examples 2 and 3 increase the chance of faulty financial reporting, which increases the possibility a suit against the audit firm.

From a project management perspective, will all three engagements take the same amount of time? Obviously no. The higher risk engagements will require more resources, effort, and time. (Higher risk audits can also increase your insurance rates.)

Client Risk Requires More Time

You might think of the additional time element in this way:

Risk = Additional Time = Higher Price

Too often, CPA firms fish for audits without giving appropriate consideration to risk. Then, the flat fee creates pressure to ignore risks, because, after all, the audit firm wants to make a profit. It is critical that auditors incorporate a pricing premium for identified client risk. So consider  the audit risk model even in the beginning of an audit.

Unidentified Audit Risk

But what about unknown risk (that which exists before starting the engagement)?

Well, that’s another story. Discovering fraud, for example, may require an expansion of the engagement scope. As with any project, when the scope increases, price increases. But the price increase is dependent upon the size and complexity of the theft. If the fraud is nominal and requires little additional time, then no price increase is necessary. But if the theft is broad and complex, a contract amendment may be in order.

Audit Client Acceptance And Continuance

Does your firm use any type of risk score in client acceptance or in your annual continuance decision? If no, consider scoring your clients in terms of price and risk. And while you’re at it, think about rating your entire book of business. Here’s how.

An Exercise to Evaluate Your Pricing in Light of Risk

In an Excel spreadsheet, list the following for all A&A clients:

  • Name of the client
  • The A&A service (e.g., audit, compilation)
  • Years you’ve provided the A&A service
  • Price
  • Time estimate
  • Average hourly rate
  • Describe any client risks
  • Score the client risk from 1 to 5 (with 5 being highest)

Once the list is complete, ask yourself if the pricing is appropriate. If the hourly rate is low but the risk is high, consider a price increase.

fences
May 31

How to Organize Your Computer Desktop with Fences

By Charles Hall | Technology

In this post, I explain how you can use Fences software to organize your computer desktop.

Most accountants like organization, yet I often see total chaos on computer monitors.

A typical CPA’s screen looks like this.

Organize desktop

We’d be much better off if our desktops looked like this.

fences

Creating Order on Your Desktop

So how can you bring order to your desktop?

Use Fences. The cost is $9.99, but well worth the iconic bliss.

Once Fences is downloaded, you simply right-click and drag on your screen to create a new fence (see below). Above you see a fence titled “Programs.” You can arrange the icons in whatever order you wish. To add an icon to a fence, you simply drag it to the desired location.

Create Fence

Once you arrange your icons, they stay that way. When you reboot your computer the next morning, you’ll find your icons in the same order. 

Fences YouTube Video

Here’s a video that provides additional information:

My Experience with Fences

I’ve used Fences for about eight years and have found it useful. I recommend it.

Other Office Suggestions

For helpful ideas in setting up your physical office, click here.

Auditing Debt
May 31

Auditing Debt: The Why and How Guide

By Charles Hall | Auditing

What are the keys to auditing debt?

While auditing debt can be simple, sometimes it’s tricky.  For instance, classification issues can arise when debt covenant violations occur. Should the debt be classified as current or noncurrent? Likewise, some forms of debt (with detachable warrants) have equity characteristics, again leading to classification issues. Is it debt or equity—or both? Additionally, leases can create debt, even if that is not the intent. 

Most of the time, however, auditing debt is simple. A company borrows money. An amortization schedule is created. And thereafter, debt service payments are made and recorded. 

Either way, whether complicated or simple, below I show you how to audit debt.

Auditing Debt

Auditing Debt — An Overview

In many governments, nonprofits, and small businesses, debt is a significant part of total liabilities. Consequently, it is often a significant transaction area.

In this post, we will cover the following:

  • Primary debt assertions
  • Debt walkthroughs
  • Debt-related fraud
  • Debt mistakes
  • Directional risk for debt
  • Primary risks for debt
  • Common debt control deficiencies
  • Risk of material misstatement for debt
  • Substantive procedures for debt
  • Common debt work papers

Primary Debt Assertions

The primary relevant debt assertions include:

  • Completeness
  • Classification
  • Obligation

I believe, in general, completeness and classification are the most important debt assertions. When a company shows debt on its balance sheet, it is asserting that it is complete and classified correctly. By classification, I mean it is properly displayed as either short-term or long-term. I also mean the instrument is debt and recorded as such (and not equity). By obligation, I mean the debt is legally owed by the company and not another entity.

Keep these three assertions in mind as you perform your transaction cycle walkthroughs.

Debt Walkthroughs

Early in your audit, perform a walkthrough of debt to see if there are any control weaknesses. As you perform this risk assessment procedure, what questions should you ask? What should you observe? What documents should you inspect? Here are a few suggestions.

Debt Walkthrough

As you perform your debt walkthrough ask or perform the following:

  • Are there any debt covenant violations?
  • If the company has violations, is the debt classified appropriately (usually current)?
  • Is someone reconciling the debt in the general ledger to a loan amortization schedule?
  • Inspect amortization schedules.
  • Does the company have any unused lines of credit or other credit available?
  • Inspect loan documents.
  • Has the company refinanced its debt with another institution? Why?
  • Who approves the borrowing of new money?
  • Who approves new leases? Who handles lease accounting and are they competent?
  • Does the company have any leases that should be recorded as debt?
  • Inspect new loan and lease approvals. 
  • How are debt service payments made (e.g., by check or wire)? Who makes those payments?
  • Are there any sinking funds? If yes, who is responsible for making deposits and how is this done?
  • Observe the segregation of duties for persons:
    • Approving new loans,
    • Receipting loan proceeds,
    • Recording debt in the general ledger, and
    • Reconciling the debt in the general ledger to the loan amortization schedules
  • Is the company required to file periodic (e.g., quarterly) reports with the lender? Inspect sample debt-related reports, if applicable.
  • Does the company have any convertible debt or debt with detachable warrants? Are they properly recorded?
  • Is the company following reporting framework requirements (e.g., FASB Codification) for debt?
  • Has collateral been pledged? If yes, what?
  • What are the terms of the debt agreements?
  • Has all debt of the company been recorded in the general ledger?
  • Have debt issuance costs been accounted for properly based on the reporting framework requirements? (FASB requires the netting of such costs with debt.)
  • Has the company guaranteed the debt of another entity?

If control weaknesses exist, create audit procedures to address them. For example, if—during the walkthrough—we see that one person approves loans, deposits loan proceeds, and records the related debt, then we will perform fraud-related substantive procedures.

Debt-Related Fraud

A company can fraudulently inflate its equity by intentionally omitting debt from its balance sheet. (Total assets equal liabilities plus equity. Therefore, if debt is not reported, equity increases.) 

As we saw with Enron, some entities place their debt on another company’s balance sheet. (Enron did so using special purpose entities.) So auditors need to consider that companies can intentionally omit debt from their balance sheets.

Another potential fraudulent presentation is showing short-term debt as long-term. When might this happen? When debt covenant violations occur. Such violations can trigger a requirement to classify the debt as current. If accounting personnel are aware of the requirement to classify debt as current and don’t do so, then the reporting can be considered fraudulent.  

Additionally, mistakes can lead to errors in debt accounting.

Debt Mistakes

Errors in accounting for debt can occur when debt service payments are misclassified as expenses rather than a reduction of debt. Also, debt can—in error—be presented as long-term when it is current. Why? Maybe the company’s accountant doesn’t understand the accounting rules.

Some forms of debt, such as certain types of leases, can be difficult to interpret. Consequently, a company might errantly fail to record debt when required. 

So, what is the directional risk for debt? An overstatement or an understatement?

Directional Risk for Debt

Auditing Debt

The directional risk for debt is an understatement. So, audit for completeness (and determine that all debt is recorded).

Primary Risks for Debt

Primary risks for debt include:

  1. Debt is intentionally understated (or omitted)
  2. Debt is recorded as noncurrent (due more than one year from the balance sheet date) though the amount is current (due within one year of the balance sheet date)

It’s obvious why a company might want to understate its debt. The company looks healthier. But why would a business desire to classify current debt as noncurrent? For the same reason: to make the company look stronger. By recording current debt as noncurrent, the company’s working capital ratio (current assets divided by current liabilities) improves. 

As you think about the above risks, consider the control deficiencies that allow debt misstatements.

Common Debt Control Deficiencies

In smaller entities, it is common to have the following control deficiencies:

  • One person performs two or more of the following:
    • Approves the borrowing of new funds,
    • Enters the new debt in the accounting system, 
    • Deposits funds from the debt issuance
  • Funds are borrowed without appropriate approval
  • Debt postings are not agreed to amortization schedules
  • Accounting personnel don’t understand the accounting standards for debt (including lease accounting)

Another key to auditing debt is understanding the risks of material misstatement.

Risk of Material Misstatement for Debt

In auditing debt, the assertions that concern me the most are classification, completeness, and obligation. So my risk of material misstatement for these assertions is usually moderate to high. 

Auditing Debt

My response to the higher risk assessments is to perform certain substantive procedures: namely, a review of debt covenant compliance and a review of debt and lease agreements—and the related accounting. Why?

As we saw above, debt covenant violations may require the company to reclassify debt from noncurrent to current. Doing so can be significant. The loan could be called by the lender, depending on the loan agreement. So, proper classification of debt can be critical. 

Also, some leases should be recorded as debt. If such leases are not recorded, the company looks healthier than it is. Our audit should include procedures that address the completeness of debt and the obligations of the company.

Once your risk assessment is complete, decide what substantive procedures to perform.

Substantive Procedures for Debt

My customary tests for auditing debt are as follows:

  1. Summarize and test debt covenants
  2. Review new leases to determine if debt should be recorded
  3. Confirm all significant debt with lenders
  4. Determine if all debt is classified appropriately (as current or noncurrent)
  5. Agree the end-of-period balances in the general ledger to the amortization schedules
  6. Agree future debt service payment summaries to amortization schedules 
  7. Review accruals of any significant interest 
  8. Review interest expense (usually comparing current and prior year interest)

In light of my risk assessment and substantive procedures, what debt work papers do I normally include in my audit files?

Common Debt Work Papers

My debt work papers normally include the following:

  • An understanding of debt-related internal controls 
  • Documentation of any internal control deficiencies related to debt
  • Risk assessment of debt at the assertion level
  • Debt audit program
  • A copy of all significant debt agreements (including lease and line-of-credit agreements)
  • Minutes reflecting the approval of new debt
  • A summary of debt activity (beginning balance plus new debt minus principal payments and ending balance)
  • Amortization schedules for each debt
  • Summary of all debt information for disclosure purposes (e.g., future debt service to be paid, interest rates, types of debt, collateral, etc.) 

If there are questions regarding debt agreements and their presentation, I include additional language in the representation letter to address the issues. For example, if an owner loans funds to the company but there is no written  debt agreement, the owner or management might verbally explain the arrangement. In such cases, I include language in the management representation letter to cover the verbal responses.

In Summary

In this article we’ve looked at the keys to auditing debt. Those keys include risk assessment procedures, determining relevant assertions, creating risk assessments, and developing substantive procedures. The most important issues to address are usually (1) the classification of debt (especially if debt covenant violations exist) and (2) lease accounting.

Next we’ll look at how to audit equity.


>