31.4 Quality Management and External Peer Review

3. Quality Management and External Peer Review

Each audit organization conducting GAGAS engagements must establish and maintain an internal system of quality management. Furthermore, the organization must undergo an external peer review at least once every three years (triennial peer review) conducted by an independent review team.

• Peer Review Ratings: Financial audit peer reviews issue a rating of Pass, Pass with Deficiencies, or Fail.
• Transparency Requirement: The audit organization must provide a copy of its most recent peer review report to the audited entity during procurement and make the report publicly accessible.

---

The GAGAS Conceptual Framework for Auditor Independence

Independence is the cornerstone of government auditing. Under GAGAS, auditors must maintain independence across two vital dimensions:

1. Independence of Mind: The state of mind that permits the expression of an audit conclusion without being affected by influences that compromise professional judgment, allowing an individual to act with integrity, objectivity, and professional skepticism.
2. Independence in Appearance: The avoidance of circumstances that would cause a reasonable and informed third party, having knowledge of all relevant information, to conclude that the audit organization's or an auditor's integrity, objectivity, or professional skepticism has been compromised.

The Seven Threats to Independence

When evaluating potential independence impairments, auditors apply the GAGAS Conceptual Framework for Independence. The framework identifies seven core threats:

+-----------------------------------------------------------------------------------+
|                       THE SEVEN GAGAS THREATS TO INDEPENDENCE                     |
+-----------------------------------------------------------------------------------+
|  1. SELF-INTEREST THREAT                                                          |
|     • Financial or other personal interest will inappropriately influence an      |
|       auditor's judgment (e.g., owning stock in a government contractor).         |
+-----------------------------------------------------------------------------------+
|  2. SELF-REVIEW THREAT                                                            |
|     • An auditor will evaluate the results of services previously performed by    |
|       the auditor or audit organization (e.g., auditing ledgers they drafted).    |
+-----------------------------------------------------------------------------------+
|  3. BIAS THREAT                                                                   |
|     • Auditor takes a position that is not objective due to political convictions,|
|       preconceived biases, or advocacy on behalf of the auditee.                  |
+-----------------------------------------------------------------------------------+
|  4. FAMILIARITY THREAT                                                            |
|     • Close or long-standing relationship with auditee management or staff leads  |
|       to undue sympathy or uncritical acceptance of representations.              |
+-----------------------------------------------------------------------------------+
|  5. UNDUE INFLUENCE THREAT                                                        |
|     • External pressure or coercion from auditee leadership (e.g., threats of     |
|       contract termination, fee reductions, or aggressive hostility).             |
+-----------------------------------------------------------------------------------+
|  6. MANAGEMENT PARTICIPATION THREAT                                               |
|     • Auditor performs management functions or makes management decisions for the |
|       auditee, completely destroying independence in fact and appearance.         |
+-----------------------------------------------------------------------------------+
|  7. STRUCTURAL THREAT                                                             |
|     • Organizational placement of an internal audit group within government       |
|       hierarchy impairs objectivity (e.g., reporting to the person being audited).|
+-----------------------------------------------------------------------------------+

Applying Safeguards

If threats are identified, the auditor must assess whether they are at an acceptable level. If threats are not at an acceptable level, the auditor must apply safeguards—controls or mitigating measures that eliminate or reduce threats to an acceptable level (e.g., reassigning staff, obtaining secondary quality reviews from independent partners). If no safeguards can reduce threats to an acceptable level, the auditor must decline or terminate the engagement.

---

Strict Nonaudit Services Rules and Management Responsibilities (SKE)

Government agencies often request that external auditors perform nonaudit services (e.g., preparing draft financial statements, posting journal entries, setting up accounting software, calculating depreciation). The Yellow Book establishes rigorous standards governing nonaudit services.

The Absolute Prohibition: Management Responsibilities

Under GAGAS, an auditor is strictly prohibited from assuming management responsibilities for an audited entity. Assuming a management responsibility is a fatal impairment to independence for which no safeguards can mitigate the threat. Prohibited management responsibilities include:

• Setting policies and strategic direction for the entity;
• Authorizing, executing, or approving transactions or cash disbursements;
• Maintaining custody of auditee assets;
• Designing, implementing, or maintaining the entity's internal control system;
• Deciding which audit recommendations to accept or implement;
• Selecting or terminating vendors or IT software.

+-----------------------------------------------------------------------------------+
|                     PERMISSIBLE VS. PROHIBITED NONAUDIT ACTIVITIES                |
+-----------------------------------------------------------------------------------+
|  PERMISSIBLE (WITH SAFEGUARDS & SKE)       | PROHIBITED (MANAGEMENT RESPONSIBILITY)|
|-------------------------------------------|---------------------------------------|
|  Converting cash ledgers to accrual       | Authorizing or signing disbursements  |
|  statements based on management approvals | or contracts                          |
|  Drafting financial statement footnotes   | Deciding which accounting treatment to|
|  from management-provided ledgers         | adopt without management review       |
|  Providing routine IT security advisory   | Operating or supervising the entity's |
|  recommendations                          | IT systems or access permissions      |
|  Assisting in compiling depreciation      | Having custody of physical capital    |
|  schedules approved by management         | assets or maintaining official books  |
+-----------------------------------------------------------------------------------+

Documenting Management's Skill, Knowledge, and Experience (SKE)

Before an auditor agrees to perform any nonaudit service, GAGAS requires the auditor to confirm and document that auditee management possesses the Skill, Knowledge, and Experience (SKE) to:

1. Oversee the nonaudit service;
2. Evaluate the adequacy and results of the service performed; and
3. Accept full responsibility for the results of the service.

Exam Distinction: Management does not need to possess the technical expertise to perform the service itself; however, management must possess sufficient SKE to understand the service, review the auditor's work product, and take formal ownership of the final financial statements or records. If management lacks SKE, performing the nonaudit service impairs independence.

---

Practical Public Finance Scenario: Municipal Financial Statement Compilation and Independence Crisis

Scenario: The Town of Oakridge contracts with CPA Firm LLP to perform its annual financial statement audit under GAGAS. Oakridge has a total annual operating budget of $8,500,000. Due to recent staff turnover, the Town's only accounting employee is a junior bookkeeper who does not understand modified accrual accounting or GASB pension reporting. The Town Administrator requests that CPA Firm LLP:

1. Formulate and post all year-end adjusting journal entries to convert the Town's checkbook registers to accrual ledgers;
2. Draft the complete Annual Comprehensive Financial Report (ACFR), including all MD&A prose and footnote disclosures; and
3. Authorize vendor payments from the federal ARPA grant account while the Town searches for a new finance director.

Professional Independence Evaluation

1. Evaluation of Request 3 (Authorizing Disbursements):

   • Analysis: Authorizing vendor payments is an explicit management responsibility.
   • Ruling: Absolute Prohibition. CPA Firm LLP cannot authorize disbursements under any circumstances. Doing so creates an insurmountable management participation threat that immediately impairs independence. The Town Administrator or designated town official must approve all disbursements.

2. Evaluation of Requests 1 & 2 (Adjusting Entries & ACFR Compilation):

   • Threats Identified: Self-Review Threat (auditing records the firm created) and Management Participation Threat.
   • SKE Evaluation: The junior bookkeeper lacks the requisite Skill, Knowledge, and Experience (SKE) to oversee the conversion, understand GASB adjustments, or take ownership of the financial statements.
   • Ruling: If CPA Firm LLP performs these compilation services while the Town lacks an official with adequate SKE to oversee them, independence is impaired. Safeguards cannot reduce the threat to an acceptable level.
   • Remediation: The Town must contract with an independent third-party accounting consultant (separate from CPA Firm LLP) possessing adequate SKE to oversee the bookkeeping, make accounting decisions, and present completed draft statements to CPA Firm LLP for audit.