The New Yellow Book Is Here

July 2007

http://www.gao.gov/govaud/d07731g.pdf

Yesterday, the GAO published the July 2007 version of the Yellow Book. This version finalizes the two unfinished general standards—quality control and peer review.

Here are some of the highlights:

Documentation of the audit organization’s policies and procedures for quality control

The standards now require that each audit organization document its quality control policies and procedures (3.52) and that these policies and procedures collectively address six topics:

• Leadership responsibility for quality
• Independence, legal, and ethical requirements
• Initiation, acceptance, and continuance of audit and attestation engagements
• Human resources
• Engagement performance, documentation, and reporting
• Monitoring of quality

Please read section 3.53 for details on each of the six areas.

Self-evaluate monitoring procedures every year

The new quality control standard also suggests that each audit organization self-evaluate every year.

3.54 The audit organization should analyze and summarize the results of its monitoring procedures at least annually, with identification of any systemic issues needing improvement, along with recommendations for corrective action. (Under GAGAS, reviews of the work and the report that are performed as part of supervision are not monitoring controls when used alone. However, these types of pre-issuance reviews may be used as a part of this analysis and summary.)

Everyone gets a peer review every three years

The timeline for peer reviews is set—for everyone—at three years. (3.55) For a while, the GAO was toying with the idea of matching the IIA standards and allowing five years for performance audits—but no more! Everyone’s timeline is set at three years.

Suggestion that external audit organizations put their peer review report on the web!

External audit organizations must make their most recent peer review report available to the public. (3.61) This does NOT include the letter of comment. The GAO suggests posting the report to a website.