From time to time, I have clients ask me “What is funded depreciation?” And more importantly, they ask, “How can this technique make my organization more profitable and less stressful?”
Here’s a simple explanation.
Funded depreciation is the setting aside of cash in amounts equal to an organization’s annual depreciation. The purpose: to fund future purchases of capital assets with cash.
Funded Depreciation
Suppose you buy a $10,000 whiz-bang gizmo—a piece of equipment—that you expect to use for ten years, and at the end of the ten years you expect it to have no value. Your annual depreciation is $1,000.
In this example, a $1,000 depreciation expense is recognized annually on your income statement (depreciation decreases net income) even though no cash outlay occurs. The balance sheet includes the cost of the whiz-bang gizmo, but at the end of ten years, the equipment has a $0 book value, being fully depreciated.
The smart manager will annually set aside $1,000 in a safe investment—such as a certificate of deposit or money market account—for the future replacement of the whiz-bang gizmo.
If the company does not annually invest the $1,000, it has a few options at the end of the ten-year period:
Borrow the full amount for the replacement cost
Seek outside funding (e.g., grants)
Use other funds from within the organization
Lease the equipment
Ask U2 to do a special benefits concert—just kidding
Obviously, if you borrow money to replace the equipment, you will have to pay interest—another cash outlay. Suppose the rate is 10%. Now the organization must pay out $1,100 each year. So, if the organization funds the depreciation (invests $1,000 annually), it earns interest. But if the entity chooses not to fund depreciation, it pays interest.
Businesses that fund depreciation are always making money from interest (granted not much these days) rather than paying for it.
Another advantage to funding depreciation: you know you will have the money to purchase the capital asset. You’re not concerned with whether a creditor will lend you the money for the acquisition. You’re financially stronger.
Why Doesn’t Every Entity Fund Depreciation?
So why doesn’t everyone fund depreciation?
Some don’t understand the concept
Some had rather spend the cash flows for the ten years (e.g., owners taking too much in distributions)
Some need the money just to run the organization
In governments, elected officials desire to keep tax rates low while they are in office
In growing businesses, the owners may need the money to fund the growth of the company
Most importantly, it may require two cash payments
Concerning the last point, if the business had to borrow money to purchase the initial capital asset, then it must make debt service payments (cash outlay 1). If the company also funds depreciation for that same asset (making investments equal to the annual depreciation), another cash flow occurs (cash outlay 2). Nevertheless, if the business can ever get into a position where it pays cash for new equipment, it will be better off. Then only one cash outlay (investment funding) occurs, and the company is making–not paying–interest.
What if the organization cannot–due to cash flow constraints–fund depreciation for all new equipment purchases? Consider doing so for just one or two pieces of equipment–over time, the entity may be able to move into a fully funded position.
Who Should Fund Depreciation?
So, who should fund depreciation?
Organizations with sufficient cash flow and discipline. It’s the smart thing to do.
Imagine a world with no debt, a world where you don’t have to wonder how you will pay for equipment. Dreaming? Maybe, but funded depreciation is worth your consideration.
This article teaches you how to develop your audit plan and strategy. Once you complete your risk assessment, it’s time to build these critical pieces of your audit engagement.
Effectiveness and efficiently are both possible with a good audit plan. Below I explain how to do this. Additionally, we’ll also take a look at three common mistakes made in planning. See if you make any of these.
To be in compliance with audit standards, we need to develop:
Our audit strategy
Our audit plan
Developing Your Audit Strategy
What’s in the audit strategy? AU-C 300, Planning an Audit, states that the audit strategy should include the following:
The characteristics of the engagement (these define its scope)
The reporting objectives (these affect the timing of the audit and the nature of the reports to be provided)
The significant factors (these determine what the audit team will do)
The results of preliminary engagement activities (these inform the auditor’s actions)
Whether knowledge gained on other engagements is relevant (these potentially provide additional insight)
Think of the audit strategy as the big picture.
We are documenting:
The scope (the boundaries of the work)
The objectives (what the deliverables are)
The significant factors (e.g., is this a new or complex entity?)
The risk assessment (what are the risk areas?)
The planned resources (e.g., the engagement team)
Much can be achieved with the right strategy—even walking on the moon.
Strategy for Walking on the Moon
When NASA planned to put a man on the moon, a strategy was created. It could have read as follows:
We will put a man on the moon. The significant factors of our mission include mathematical computations, gravitational pull, thrust, and mechanics. The risks include threats to our astronauts’ lives, so we need to provide sufficient food, air, sound communications, and a safe vessel. The deliverable will be the placement of one man on the moon and the safe return of our three astronauts. The engagement team will include three astronauts, launch personnel at Kennedy Space Center, and mission-control employees in Houston, Texas.
A sound strategy led to Neil Armstrong’s historic walk on July 20, 1969.
Our audit strategy—in a more pedestrian pursuit—is a summary of objectives, resources, and risk. It’s the big picture. Our strategy leads to the successful issuance of our audit opinion (not quite as exciting as walking on the moon, but still important).
What’s in an Audit Strategy?
The audit strategy doesn’t have to be complicated or long, especially for smaller entities—it can be a short memo. What are we after? A summary of risks, needed resources, and objectives.
My firm uses an internally-developed strategy form—mainly, to ensure consistency. The form contains structure, such as references to risk assessment work and blank boxes in certain areas—such as partner directions—so it is flexible. As a result, the form has structure and flexibility.
Here are the main areas we cover:
Deliverables and deadlines
A time budget
The audit team
Key client contacts
New accounting standards affecting the audit
Problems encountered in the prior year
Anticipated challenges in the current year
Partner directions regarding key risk areas
References to work papers addressing risk
Who Creates the Audit Strategy?
Who should create the strategy? The in-charge can create it with the assistance of the engagement partner, or the partner can do so.
Audit Strategy as the Central Document
If you want to see one document that summarizes the entire audit, this is it. As you can see, the strategy is general in nature, but you also need a detailed plan to satisfy the demands of the strategy—this is the audit plan (commonly referred to as the audit program). NASA had a mission statement for Apollo 11, but—I’m sure—written guidelines directed the step-by-step execution of the project.
Audit Plan (or Audit Program)
Now we create the detailed planning steps—the audit program. Think of the audit program as the final stage of audit planning. What have we done to get to this stage of the audit?
The audit plan is the linkage between planning and further audit procedures.
What are “further audit procedures”? They are the tactical steps to address risk including substantive procedures and test of controls. The audit program links back to the identified risks and points forward to the substantive procedures and test of controls. Substantive procedures include tests of details and substantive analytical procedures.
Creating the Audit Program
How—in a practical sense—do we create the audit programs? Most auditors tailor the prior year audit programs. That works—as long as we revise them to address the current year risks. Audit programs are not—at least, they should not be—static documents. Even so, the current year audit program can be the same as last year—as long as the risks are the same.
Sufficient Audit Steps
How do we know if we have adequate audit program steps? Look at your risks of material misstatement (RMM)—which, hopefully, are assessed at the assertion level (e.g., completeness). An auditor assesses the risk of material misstatement because it informs the audit plan—or the steps to be performed. Audit steps should address all high and moderate RMMs.
Integrating Risk Assessment with the Audit Program
How else can we integrate our documentation? Put the relevant assertions next to each audit step—this makes the connections between the RMMs (at the assertion level) and the audit steps clear.
AU-C 330 says the auditor is required to apply substantive procedures to all relevant assertions related to each material class of transactions, account balance, and disclosure. So, the audit program should reflect steps for all material areas.
Creating Efficiency in the Audit Plan
Once you complete your risk assessment work, you want to ask, “Which is the more efficient route? Testing controls or performing substantive procedures.” Then go with your instincts.
Generally, I assess control risk at high. While we can’t default to a high control, we can—once the risk assessment work is complete—decide to assess control risk at high as an efficiency measure. Why? If we assess control risk at below high, we must test the controls as a basis for the lower risk assessment. The testing of controls can—sometimes—take longer than substantive procedures.
For example, is it better to test the controls related to fixed asset additions or is it more efficient to vouch the invoices for significant additions? Usually, the vouching of the invoices will get you to your desired destination quicker than testing controls. Generally—at least in my opinion—this line of reasoning is less true for more complex organizations. Larger organizations process more transactions and tend to have better controls. So it can be better to test controls for larger entities.
There you have it—the creation of the audit strategy and the audit plan. Your strategy includes the risks, needed resources, and objectives. And your audit program contains the tactical steps to address risks. You are set to go.
I find that auditors usually understand the above, but still make one of the following three audit planning mistakes.
Three Mistakes in Audit Planning
Auditors make three common planning mistakes: (1) not tailoring audit programs and (2) allowing prior year work papers to drive the audit process, and (3) using a balance sheet audit approach. Let’s see how these happen.
1. Not Tailoring Audit Programs
Where do most audit programs come from? They are purchased from forms providers, usually international publishing companies. These purchased programs are useful, but they can become a crutch, leading to canned audit approaches that are not responsive to risks.
If we use unrevised audit programs and if our audit approach is always the same, what good is risk assessment? Another way to say this is, If audit programs never change, why perform walkthroughs, preliminary analytics, and other risk assessment procedures?
Canned audit programs are one reason auditors give lip-service to risk assessment. In the auditor’s mind, he may be thinking, I already know what I’m going to do, so why waste time with risk assessment?This cookie-cutter approach is dangerous, but quite common. And why is it dangerous? Because it can lead to an intentional blindness toward internal controls and significant risks. And deficiencies in risk assessment lead to deficiencies in audit procedures. The result: material misstatements are not identified and an unmodified audit opinion is rendered. In other words, audit failure occurs.
Audit programs can be tailored: steps can be added, changed, or deleted. These steps can be amended based on the risk of material misstatement. But some auditors don’t change their audit plan.
And not tailoring audit programs can lead to several problems such as:
Audit team members signing off on steps not performed
Team members typing Not Applicable (N/A) next to several audit steps
Auditors performing unnecessary procedures
Auditors not performing necessary procedures
In addition to not tailoring audit programs, some auditors hit autopilot and use their prior year work papers as their current year plan.
2. Prior Year Work Papers as the Audit Plan
Audit documentation should develop sequentially:
Risk assessment
Audit programs
Audit work papers
But poor auditors tend to follow the prior year work papers and complete the audit program as an afterthought. Worse yet, the risk assessment work is completed at the end of the engagement, if at all. The tail wags the dog. This same-as-last-year approach leads to incongruities in risks of material misstatement and the procedures performed. In effect, the prior year work papers become the current year audit program.
Another common audit planning mistake is the use of a balance sheet audit approach.
3. Balance Sheet Audit Approach
Many auditors use a fully substantive approach, meaning they don’t test controls for effectiveness. Moreover, some auditors test balance sheet accounts and little else. But this approach can lead to problems.
I have heard auditors say: If I audit all of the balance sheet accounts, then the only thing that can be wrong is the composition of revenues and expenses. But is this true?
The accounting equation says:
Totals assets = Total liabilities plus Total equity
Another way to say this is:
Total equity = Total assets minus Total liabilities
If we disregard stock purchases and sales, equity is usually the accumulation of retained earnings. And retained earnings comes from the earnings or losses on the income statement. In other words, retained earnings comes from revenues and expenses. So the net income or loss (revenues minus expenses) has to fit into the accounting equation (equity equals assets minus liabilities).
Therefore, if we audit all assets and liability accounts, doesn’t it make sense that the only thing that can be wrong is the composition of revenues and expenses? Mathematically I see why someone might say this, but a flaw lurks in the construct.
Audit Failure Example
I once saw an audit firm sued for several million dollars. The CPAs audited the company for several years, issuing an unqualified opinion each year, but a theft was occurring all along.
So what were the audit firm’s mistakes? They relied too heavily upon a balance sheet audit approach, and they did not gain an understanding of the company’s key internal controls.
The auditors used substantive procedures such as:
Testing bank reconciliations
Sending receivable confirmations and vouching subsequent collections
Computing annual depreciation and agreeing it to the general ledger
Vouching additions to plant, property, and equipment
Performing a search for unrecorded liabilities in payables
Confirming debt
The balance sheet accounts reconciled to the general ledger, and no problems were noted in the audit of the balance sheet accounts. But millions were missing.
So what flaw lies in a balance sheet audit approach? Millions can go missing while the balance sheet accounts reconcile to the general ledger. Consequently, auditing the balance sheet accounts alone may not detect theft. Therefore, gaining an understanding of the internal controls and developing appropriate responses is critical to identifying material misstatements, especially when fraud is possible.
So as we plan our substantive procedures, we need to avoid the flawed balance sheet approach. Yes, substantive procedures for the balance sheet accounts are important, but fraud detection procedures are necessary when control weaknesses are present. A test of details is necessary when a significant risk (such as a fraud risk) is present.
In Summary
Develop an audit strategy and plan once you complete your risk assessments procedures. Then link the risks of material misstatement to your further audit procedures. Doing so will help ensure that your audit is successful. In other words, that no material misstatements are present when you issue an unmodified opinion.
Moreover, don’t make these three audit planning mistakes: (1) not tailoring audit programs and (2) allowing prior year work papers to drive the audit process, and (3) using a balance sheet audit approach.
See my audit series The Why and How of Auditingto learn even more about the full audit process, including how to audit transaction cycles such as cash, receivables, payables, and debt.
In this article, I provide information about various special purpose reporting frameworks (e.g., cash basis, modified-cash basis, and income tax basis) and how you can use them to create financial statements for your clients.
Suppose you’ve been contacted by your client to prepare their financial statements and issue a compilation report. At first, you think, I’ll create the financials in accordance with GAAP, but then you remember there are special purpose reporting frameworks. Maybe the cash basis or income tax basis is a better option.
In this article, I address audit assertions and why they are critical to the audit process. We'll look at assertion examples and how to you can leverage these in your audit plan. Do you desire to stop over auditing? Then read on.
All businesses make assertions in their financial statements. For example, when a financial statement has a cash balance of $605,432, the business asserts that the cash exists. When the allowance for uncollectibles is $234,100, the entity asserts that the amount is properly valued. And when payables are shown at $58,980, the company asserts that the liability is complete.
Reporting Frameworks
Of course assertions derive their meaning from the reporting framework. So before you consider assertions, make sure you know what the reporting framework is and the requirements therein. For example, the occurrence of $4 million in revenue means one thing under GAAP and quite another under the cash basis of accounting.
What is a Relevant Assertion?
For an auditor, relevant assertions are those where a risk of material misstatement is reasonably possible. So, magnitude (is the risk related to a material amount?) and likelihood (is it reasonably possible?) are both considered.
For cash, maybe you believe it could be stolen, so you are concerned about existence. Is the cash really there? Or with payables, you know the client has historically not recorded all invoices, so the recorded amount might not be complete. And the pension disclosure is possibly so complicated that you believe it may not be accurate. If you believe the risk of material misstatement is reasonably possible for these areas, then the assertions are relevant.
Some auditors refer to auditing by assertions as an assertions audit. Regardless of the name, we need to know what the typical assertions are.
Audit Assertions
Assertions include:
Existence or occurrence (E/O)
Completeness (C)
Accuracy, valuation, or allocation (A/V)
Rights and obligations (R/O)
Presentation, disclosure, and understandability (P/D)
Cutoff (CU)
Not all auditors use the same assertions. In other words, they might use assertions different from those listed above, or the auditor could list each assertion separately. Regardless, auditors need to make sure they address all possible areas of misstatement.
Assertions as Scoping Tool
Think of assertions as a scoping tool that allows you to focus on the important. Not all assertions are relevant to all account balances or to all disclosures. Usually, one or more assertions are relevant to an account balance, but not all. For example, existence, rights, and cutoff might be relevant to cash, but not valuation (provided there is no foreign currency) or understandability. For the latter two, a reasonable possibility of material misstatement is not present.
As you consider the significant account balances, transaction areas, and disclosures, specify the relevant assertions. Why? So you can determine the risk of material misstatement for each and create responses. Here’s an example for accounts payable and expenses.
Assertion
Inherent Risk
Control Risk
Risk of Material Misstatement
Response
E/O
Moderate
High
Moderate
Perform substantive analytics comparing expenses to budget and prior year
C
High
High
High
Perform search for unrecorded liabilities
CU
Moderate
High
Moderate
Substantive analytical comparison of the payable balance
Inherent Risk Support
Accounts payable is not complex and there are no new accounting standards related to it. There are no subjective judgments. Volume is moderate and directional risk is an understatement. Inherent risk is assessed at high for completeness (client has not fully recorded payables in prior years). Occurrence and cutoff have not been a problem areas in past years.
Inherent Risk as the Driver
Risk of material misstatement is the result of inherent risk and control risk. Auditors often assess control risk at high because they don’t plan to test for control effectiveness. If control risk is assessed at high, then inherent risk becomes the driver of the risk of material misstatement. In the table above, the auditor believes there is a reasonable possibility that a material misstatement might occur for occurrence, completeness, and cutoff. So responses are planned for each.
Fraud risks and subjective estimates can be (and usually are) assessed at the upper end of the spectrum of inherent risk. They are, therefore, significant risks. When a significant risk is present, the auditor should perform procedures beyond his or her normal approach. As we previously said, when the client’s risk increases, the level of testing increases.
Significant Risk
The payables/expenses assessment below incorporates an additional response due to a significant risk, the risk that fictitious vendors might exist.
Assertion
Inherent Risk
Control Risk
Risk of Material Misstatement
Response
E/O
High
High
High
Perform substantive analytics comparing expenses to budget and prior year; Perform fictitious vendor test
C
High
High
High
Perform search for unrecorded liabilities
CU
Moderate
High
Moderate
Substantive analytical comparison of the payable balance
Inherent Risk Support
Accounts payable is not complex and there are no new accounting standards related to it. There are no subjective judgments. The company suffered a fictitious vendor fraud during the year, so the occurrence assertion has uncertainty. Volume is moderate and directional risk is an understatement. Inherent risk is assessed at high for occurrence (significant risk) and completeness. Cutoff has not been a problem in past years.
Significant Risk Example
In auditing expenses, the auditor knows that a risk of fictitious vendors exists. In this scheme the payables clerk adds and makes payments to a nonexistent vendor. Additionally, the payments are usually supported with fake invoices. What is the result? Yes, additional expenses. Those fraudulent payments appear as expenses in the income statement. So the occurrence assertion is suspect.
If the auditor believes the risk of fictitious vendors is at the upper end of the inherent risk spectrum, then a significant risk is present in relation to the occurrence assertion. And such a risk deserves a fraud detection procedure. In this example, the auditor responds by adding a substantive test for detection of fictitious vendors. More risk, more work.
Additionally, notice the inherent risk for occurrence is assessed at high. Why? Because it’s at the upper end of the inherent risk spectrum. A significant risk is, by definition, a high inherent risk, never low or moderate.
As you can tell, I am suggesting that risk be assessed at the assertion level. But is it ever acceptable to assess risk at the transaction level?
Assessing Risk at the Transaction Level
Is it okay to assess audit risk in the following manner?
Assertion
Inherent Risk
Control Risk
Risk of Material Misstatement
E/O; CU; R/O; A/V; P/D
High
High
High
Yes, but if all assertions are assessed at high, then a response is necessary for each.
Those who assess risk at the transaction level think they are saving time. But is this a more efficient approach? Or might it be more economical to do so at the assertion level?
Assess the Risk of Material Misstatement at the Assertion Level
If the goal of assessing risk is to quickly complete a risk assessment document (and nothing else), then assessing risk at the transaction level makes sense. But the purpose of risk assessment is to provide planning direction. Therefore, we need to know the risk of material misstatement at the assertion level.
Why? Let’s answer that question with an accounts payable example.
Accounts Payable Risk Assessment Example
Suppose the auditor assesses risk at the transaction level, assessing all accounts payable assertions at high. What does this mean? It means the auditor should perform substantive procedures to respond to the high-risk assessments for each assertion. Why? The risk assessment for valuation, existence, rights and obligations, completeness, and all other assertions are high. Logically, the substantive procedures must now address all of these (high) risks.
Alternatively, what if the accounts payable completeness assertion is assessed at high and all other assertions are at low to moderate? How does this impact the audit plan? Now the auditor plans and performs a search for unrecorded liabilities. Additionally, he may not, for example, perform existence-related procedures such as sending vendor confirmations. The lower risk assertions require less work. So knowing the risk of material misstatement at the assertion level is critical.
Do you see the advantage? Rather than using an inefficient approach—let’s audit everything—the auditor pinpoints audit procedures.
As a peer reviewer, firms say to me, “I know I over-audit, but I don’t know how to lessen my work.” And then they say, “How can I reduce my time without reducing quality?”
Here’s my answer: Perform real risk assessments and document the risk of material misstatement at the assertion level. Then tailor—yes, change the audit program—to address the risks. Perform substantive procedures or a test of controls for effectiveness related to the identified risk areas—and slap yourself every time you even think about same as last year. (Your substantive procedures can be a test of details or substantive analytics.)
And what are the benefits of assessing risk at the assertion level?
Efficient work
Higher profits
Conformity with standards
You may be wondering if financial statement level risk can affect assertion level assessments. Let's see.
Risks at the Financial Statement Level
Financial statements have financial statement level risks such as management override or the intentional overstatement of revenues. These sometimes affect assertion level risk. For example, the intentional overstatement of revenues has a direct effect upon the existence assertion for receivables and the occurrence assertion for revenues. Therefore, even when you identify financial statement level risks, consider whether they might affect assertion level risks as well.
Now let's talk about homework based on this article. Let's make this useful.
Your Audit Assertion Documentation
Look at two or three of your audit files and review your risk assessments. Are you assessing risk at the transaction level or at the assertion level? Plan to spend more time in performing risk assessment procedures and documenting your risks at the assertion level—and possibly less time performing further audit procedures.
Today I give you seven steps to review financial statements on computer screens. I explain how to review financial statements in Word and in PDFs.
In another post titled How CPAs Review Financial Statements, I provide information about creating and reviewing financial statements, but it doesn’t provide information about doing so on computer screens. This article does.
Financial Statement Review in Word
First, open and visually scan the entire financial statement (spend two to three seconds per page) just to get a feel for the whole product. How do the parts fit together? Are the financial statements subject to the Yellow Book? Do they contain supplementary information? Are the statements comparative?
Second, use a large computer screen (22 inches or more) to compare your financial statement pages. If you are reviewing in Word, reduce the financial statement page size by holding the control key down and scrolling back with your mouse. As you do so, you will see multiple statements on the screen, for instance: balance sheet, income statement and cash flow statement. Now that you can see multiple statements, you can tick and tie your numbers. I use step 2. to compare the financial statement numbers. For example, I compare the net income number on the income statement to the same number on the cash flow statement. Then I use step 3. to compare the financial statements to the notes and the supplementary information.
Next, use two to three computer screens to compare your financial statements with the notes and supplementary information. Open the financial statement on each screen–for instance, the balance sheet on screen 1, the notes on screen 2, and the supplementary information on screen 3. In Word, click View, New Window and another instance of the document will open. Then you can move the new instance to a second screen. Alternatively, you can use the side-by-side feature in Word to place two open documents on one screen.
After completing your review of the notes, return to and take a second look at the balance sheet to see if the disclosures are complete. (Since you just reviewed the notes, it’s easier to compare them to the balance sheet. If, for example, you look at the balance sheet and see inventory but no disclosure for the same, you’ll more easily see the error.)
Use the find feature (in Word, click the Home tab, click Find, then key in the number–or word–you are looking for) to locate words or numbers. If you want to compare the long-term debt number on the balance sheet to the notes and to supplemental information, type that number into your search dialog box and you’re immediately taken to the same number in the notes. Click next, and you will see the next instance (in the supplementary information). You can do the same with words. (Note: If you embed Excel tables in the Word document, the find feature will not locate numbers in the embedded tables. Consider PDF review option below.)
When needed, take breaks. Never spend more than 1.5 hours reviewing statements without taking a short break. You get more done by relaxing periodically.
Finally, if you are reviewing financial statements in Word, consider turning on Track Changes and key in suggested revisions. Word reflects your modifications in a distinct color. That way, others can see your suggested changes. They can also see who made the suggested corrections. Thereafter, they can accept or reject the proposed changes.
Financial Statement Review with PDF Documents
You may find it easier to review financial statements after converting them to a PDF (rather than in Word). This makes all numbers and words fully searchable (no embedded Excel spreadsheet limitation issue).
You can use the split screen feature (click Windows, Split in Adobe Acrobat) to see the same financial statements on one screen. I usually do this on my center screen. This allows me to scroll and compare numbers in the financial statements. For instance, I compare total assets with total liabilities and equity. Or I compare equity on the balance sheet with my statement of changes in equity ending balances.
I also open a second instance of the PDF on my right-hand screen, mainly to compare my notes with the financial statements (on my center screen). Then I use control-f to locate numbers or words. For instance, if I see $456,856 for total plant, property, and equipment (on my center screen), I click on the right-hand screen, then control-f, then key in the number to find it in the notes.
I make review comments in the PDF using the comments feature in Adobe Acrobat. Then persons can respond with the reply feature in the comments field. That way, they can provide a response, whether they agree or not—and what they did if a correction was made.
