The New Yellow Book: Focus on Internal Controls
Auditors who do their work in accordance with Government Auditing Standards, also known as the yellow book, will face increased responsibility for testing internal controls under new auditing standards proposed by the U.S. General Accounting Office (GAO). The new standards will focus auditors' judgment on two areas: the control environments and controls for safe-guarding assets. The GAO is seeking comments on an exposure draft containing these and other proposed changes to the yellow book. This article explains why the new yellow book will require additional internal control work in financial statement audits and what that additional work will be. The exhibit on page 85 highlights other proposed changes to the yellow book. WHY CHANGE INTERNAL CONTROL STANDARDS? The current yellow book standards for internal controls mirror the American Institute of CPAs generally accepted auditing standards. If auditors follow Statement on Auditing Standards no. 55, Consideration of the Internal Control Structure in a Financial Statement Audit, they effectively follow the yellow book. But after reviewing research done by the GAO staff and reflecting on their own experience, members of the Government Auditing Standards Advisory Council found mounting evidence SAS no. 55's minimum requirements were no longer enough: * Accounting professionals were calling for increased auditor involvement in internal controls to provide both "early warning" of potential problems and, among other things, assurance an entity is well controlled. * Bank audit committees were asking auditors or more information about the state of internal controls. * Congress and the Office of Management and Budget were enacting news laws and regulations calling for auditor assurance that internal controls in large banks and in federal agencies are effective. The council recognized that financial statement audits provided only so much information about internal controls. To meet the growing demand for the information, it realized auditors would have to examine controls (or perform agreed-upon procedures) separately from the financial statement audit. Still, the council believed the financial statement audit could partially satisfy this demand if it included work on internal controls beyond the minimum required by SAS no. 55 that would * Be within the boundaries of what auditors choose to do under SAS no. 55, which gives them considerable discretion over the extent of their consideration of internal controls. * Help auditors assess audit risk more precisely. * Focus auditor's attention on potential control weaknesses users of auditors' reports might want to know about. Using these criteria, the council recommended expanding the auditor's responsibilities in two areas: the control environment and controls for safeguarding assets. The GAO included these recommendations in its ED. (See the sidebar on page 86 for a discussion of the council's work.) ASSESSING THE CONTROL ENVIRONMENT The new yellow book will require auditors to assess the control environment in all financial statement audits. SAS no. 55 requires auditors to answer the questions: How important are internal controls to the board of directors and top management? What are their attitudes, awareness and actions regarding controls as reflected in * Management's philosophy and operating style? * Methods of assigning authority and responsibility? * Methods of monitoring and following up on performance, including internal auditing? The collective impact of these and other factors on the effectiveness of specific control policies and procedures makes up the control environment. The AICPA audit guide Consideration of the Internal Control Structure in a Financial Statement Audit, which provides guidance on implementing SAS no. 55, says auditors do not have to assess the control environment separately. …