A Mandatory Meeting After Gathering Information

April 2007

After you have gathered information about the five mandatory areas discussed in last month’s newsletter, it is time to have a meeting!

This is a very similar meeting to the SAS 99 meeting. SAS 99—commonly known as the Fraud SAS—requires audit teams to get together and discuss what kind of fraud the entity could suffer.

The new risk assessment SASs require that auditors meet as a team after they have gathered information. They meet to discuss where the risks are and to decide how to respond to those risk.

Find the mandatory requirements in SAS 109

In the meeting required in SAS 109, all of the team members need to discuss the risks that the financial statements may be misstated. And then you must document the results of your meeting. You can even combine the meeting with the SAS 99 meeting if you like.

Here is what the SAS says:

SAS 109:
14. Members of the audit team, including the auditor with final responsibility for the audit, should discuss the susceptibility of the entity’s financial statements to material misstatements. This discussion can be held concurrently with the discussion specified in SAS 99 (Fraud SAS)

SAS 109:
17. The objective of the discussion is for members of the audit team to gain a better understanding of the potential for material misstatements of the financial statements resulting from fraud or error in the specific areas assigned to them AND to understand how the results of the audit procedures that they perform may affect other aspects of the audit, including decisions about the nature, timing, and extent of further audit procedures.

SAS 109:
18. The discussion provides an opportunity for

• More experienced team members to share insights based on prior experience
• Team members to exchange information about business risk
• How and where the entity’s financial statements may be susceptible to material misstatement and fraud

SAS 109:
20. There may be multiple discussions…

And, true to form—not wanting us to come up with our own—the AICPA pretty much spells out our meeting agenda:

SAS 109:
18. Auditors should discuss critical issues such as:

• Susceptibility to fraud
• Areas of significant audit risk
• Areas susceptible to management override of controls
• Unusual accounting procedures used by the client
• Important control systems
• Materiality at the financial statement level and at the account level
• How materiality will be used to determine the extent of testing
• Application of GAAP to the entity’s facts and circumstances and in light of the entity’s accounting policies.

And, you need to make a statement during the meeting to remind the audit team to remain skeptical. Skepticism is where you neither assume dishonesty or honesty—you gather facts to support your conclusions.

SAS 109:
19. Auditor should plan and perform the audit with an attitude of professional skepticism. The discussion among the audit team members should emphasize the need to:

• exercise professional skepticism throughout the engagement
• be alert for information or other conditions that indicate that a material misstatement due to fraud or error
• Be rigorous in following up on such indications

Document the meeting

And the bottom line documentation requirements are:

SAS 109:
122. The auditor should DOCUMENT:

• The discussion among the audit team regarding the susceptibility of the entity’s financial statements to material misstatement due to error or fraud
• Including how and where the discussion occurred
• The subject matter discussed
• Audit team members participating
• Significant decisions reached concerning planned responses

How do we use this information?

So now that you have done a lot of work understanding the entity, what is the point? The point is that you use it to assess risk and design further audit procedures.

SAS 109:
40. Auditors should use such knowledge to:

• Identify types of potential misstatements
• Consider factors that affect the risks of material misstatements
• Design tests of controls, when applicable, and substantive procedures

So we gathered all of this great information about the entity—now what?

• We do the risk assessment
• We refine our audit objectives
• We choose procedures
• We conclude and make sure we have gathered enough evidence to have reasonable assurance that the financial statements are presented fairly.

Step after step after step.

Next month—a discussion of controls.