AUD, Auditing and Attestation
Sources for Reporting on Compliance
Last reviewed
The standards and authorities behind PocketCPA's AUD lessons on Reporting on Compliance. The topic rests on AU-C 935.
About this topic
An entity often has to prove to somebody that it followed the rules: a bank's loan covenants, the terms of a federal grant, a regulator's requirements. Auditors are asked to report on that, and this topic covers how.
Key points
- Compliance attestation requires the practitioner to have audited the financial statements and issued an unqualified or qualified opinion.
- The report provides positive assurance on compliance as to form but not as to the sufficiency of the covenants.
- A covenant not subjected to audit procedures is excluded from or limited in the compliance report.
- Negative assurance on compliance may be given in connection with an underwriting agreement.
What the lessons cover
- Compliance in connection with an audit (AU-C 806)
- Government Auditing Standards (AU-C 935 and the Yellow Book)
- Single Audit (Uniform Guidance)
- Major program determination
- Audit findings and questioned costs
- Noncompliance encountered in a financial statement audit (AU-C 250)
- Choosing between the frameworks
Authoritative references
Where these requirements sit in the literature. The PCAOB and Uniform Guidance entries are paragraph-level because that text is public; the AU-C entries are section-level because AU-C is not, and this lesson does not manufacture paragraph numbers for it. Each entry names the standard, then breaks it out paragraph by paragraph.
- AU-C 806, Reporting on Compliance With Aspects of Contractual Agreements or Regulatory Requirements in Connection With Audited Financial Statements, permits negative assurance only in connection with an audit of those statements, only where the opinion was not adverse and not disclaimed, and only for matters subjected to audit procedures, with use restricted to specified parties.
- AU-C 935, Compliance Audits, governs a compliance audit performed in conjunction with or as required by a governmental audit requirement: a positive opinion on compliance in all material respects, materiality per government program, an understanding of internal control over compliance, and tailored representations, with management identifying the programs and maintaining that control.
- AU-C 250 splits laws in two. Direct-effect laws require sufficient appropriate audit evidence regarding compliance (AU-C 250.13). Other laws whose noncompliance may still be material require two specified procedures, inquiry and inspection of correspondence with the licensing or regulatory authorities (AU-C 250.14).
- AS 3305.19 is the PCAOB covenant report: negative assurance based on the audit, barred on an adverse opinion or a disclaimer, and barred from covenants relating to matters not subjected to the audit procedures applied. AS 3305.20 lists the separate report's elements. AS 3305.21 places the paragraph in the Opinion on the Financial Statements section when combined.
- AS 6110 is the PCAOB's compliance-auditing guidance for recipients of governmental financial assistance.
- AS 6110.09: GAGAS prescribes fieldwork and reporting standards beyond PCAOB requirements.
- AS 6110.18 requires projection of sample questioned costs, and AS 6110.19 requires reporting only known ones.
- AS 6110.22 and .23 require communication where the entity is subject to an audit requirement the engagement may not satisfy, documented if oral.
- AS 2405 is the issuer analogue for illegal acts.
- AS 2405.05 and .06 match error and fraud responsibility for direct-effect violations.
- AS 2405.07 limits directed procedures on indirect-effect violations to specific information.
- AS 2405.18, .19 and .20 run qualified or adverse, disclaimer, then withdrawal.
- AS 2405.24 confirms a Single Audit Act engagement carries greater responsibility.
- 2 CFR 200.501 sets the trigger at 1,000,000 expended (a), exempts entities below it (e), defines the program-specific election (c), and excludes contractor receipts (g) and for-profit organizations (i). 2 CFR 200.514 sets scope: GAGAS, the in-relation-to conclusion on the schedule of expenditures of federal awards, control over compliance tested to support a low assessed level of control risk with the relief at (c)(4), and follow-up on prior findings.
- 2 CFR 200.515 prescribes the four-part reporting package, of which only the opinion on the statements and the compliance opinion carry opinions. 2 CFR 200.516 lists the seven reportable findings, including known questioned costs when either known or likely exceed 25,000 for a major program (a)(3) and known costs above 25,000 for a non-major program (a)(4), and fixes the finding's anatomy at (b).
- 2 CFR 200.518 prescribes the four-step major program determination.
- (b)(1) the Type A threshold table.
- (c)(1) the low-risk Type A conditions.
- (d) the high-risk Type B ceilings.
- (e) the minimum programs.
- (f) the 20 versus 40 percent coverage rule.
- (g) documentation.
- (h) the presumption of correctness.
- 2 CFR 200.520 lists the low-risk auditee criteria, each holding for both preceding periods, and disqualifies biennial audits.
- AS 2201.03 states the objective of an audit of internal control over financial reporting as an opinion on the effectiveness of that control. It is the contrast that makes the GAGAS internal control report readable, because that report expresses no such opinion.
How PocketCPA uses these sources
Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.