December 20, 2024

It’s Time For Year-End Audits

Are you prepared?

The end of the year traditionally starts the “busy season” for external auditors. But all of the hectic activity is no reason to neglect a highly-developed, measured, and methodical year-end strategic audit plan.

 

In addition to fulfilling the CPA firm’s own quality control policies and procedures, audit engagements are examined during peer review. A rating of Fail, or even Pass With Deficiencies, can shake the confidence of the firm’s leadership and its clients — to say nothing of the public’s confidence in the results.

 

Here are some of the key factors we’ve had to address while working with CPA firms that have received negative peer review results:

 

A thorough and well-crafted audit approach will have to address and satisfy seven basic issues:

 

  • Common peer review challenges
  • Audit planning and supervision
  • Audit risk and risk assessment procedures
  • Obtaining and documenting an understanding of the audit client and its environment, including its internal controls
  • Materiality considerations
  • Linking audit procedures to mitigate the risks identified and reach audit conclusions
  • Required auditor communications with those charged with governance

 

When conducting a risk-based audit approach to the financial statements, the auditor’s overall objective is to provide reasonable assurance that the financial statements, as a whole, are free from material misstatement by error or fraud. This permits the auditor to express an opinion on whether the financial statements are prepared, in all material respects, in accordance with it’s applicable financial reporting framework (e.g., Accounting Principles Generally Accepted in the United States of America (U.S. GAAP).

 

Right From the Start

 

It’s worth noting that if you’re going to bring in an engagement quality control reviewer (EQCR), the time to do it is right at the beginning of the engagement.

 

The idea is to make sure the EQCR hears what the engagement team is thinking and has their attention during planning, rather than at the end of the engagement when work is done and that person begins to review the financial statements and the work papers. That way the EQCR can chime in and give their perspective on things for the engagement team to think about rather than raising them after the fact, potentially delaying the issuance of the audit report.

 

Audit efficiency is another issue worth focusing on at the beginning, reminding engagement teams to focus on the areas with the most risk — that is, audit smarter and know when they’ve gotten a sufficient amount of audit evidence in an area to make further testing unnecessary.

 

The EQCR can also make sure the team is up to date on any new rules or requirements that have kicked in — and several have in the last year or so, such as the new standard on current expected credit losses, and the new AICPA standards on risk assessment and auditing of material accounting estimates.

 

Common Peer Review Problems

 

There are a number of common mistakes made in risk assessment, starting with the failure to link the substantive procedures performed to the results of the risk assessment.

 

Another is audit procedures failing to link the client’s financial statement and relevant assertion-level risks for significant classes of transactions, account balances, or disclosures.

 

A third is designing audit procedures with little regard for the results of those assessments as required by AU-C 315, Understanding the Entity and its Environment and Assessing Risks of Material Misstatements.

 

Risk Assessment Shortcomings

 

A commonly cited shortcoming by peer reviewers is auditors’ failure to understand the entity and its internal controls. When conducting risk assessment, it’s useful to remember that it will generally be more effective at the start of the engagement, and that internal control procedures may be performed before the risk assessment document is completed. The auditor, however, is required to obtain understanding of whether the client’s controls have been properly designed and implemented, not required to test internal controls unless mandated under certain circumstances.

 

AICPA Professional Standards have dramatically changed over the last decade or so due to the issuance of risk assessment standards and Clarity Standards.

 

 

Audit Documentation Problems


Audit documentation is defined as “the record of audit procedures performed, relevant audit evidence obtained, and conclusions the auditor reached.”

It is evidence that the audit was properly planned and performed in accordance with the U.S. Generally Accepted Auditing Standards (GAAS), as well as evidence of the auditor’s basis for a conclusion.

Audit documentation should be enough to enable an experienced auditor — one who is independent and competent enough to challenge the engagement team’s procedures and conclusions — to understand the nature, timing and extent of the audit. That applies to understanding the results of the audit procedures performed and any significant findings or issues.

Properly executed audit documentation should answer the basic questions of who, what, when, where, why and how without any verbal explanations from the auditor.

Improve Audit Quality

 

Audit documentation should provide sufficient and appropriate evidence that risk assessment procedures were performed and that there was appropriate response to address the risk of misstatement at the financial statement level.

 

It also requires proof that the nature, timing and extent of audit procedures performed were adequate for the engagement, and that those procedures were linked to the assessed risks.

 

The audit team must document the results of the audit procedures, the conclusions reached, and that significant risks were reasonably considered.

 

Any departures from presumptively mandatory requirements to Professional Standards must be justified. It must also identify the engagement team that performed the work, when it was completed, the person who reviewed the work, and the date and extent of the review.


Audit workpaper documentation should also identify characteristics of the specific items tested, and discuss significant findings or issues with management or those charged with governance. Any information that contradicted or was inconsistent with the final conclusion on a significant audit finding or issue that was addressed should also be documented.

 

Remember the Lawyers


Over the years we’ve worked with litigation attorneys who have shared some “flash points” with us about notes and other workpaper matters that can come back to haunt the auditor.

 

One key point is to be sure to avoid any extraneous or irrelevant comments on the work papers that could turn up to bite you later. You want to avoid leaving comments like “the client’s books are a complete mess” or “these expenses seem questionable.”

 

Also beware of statements that discredit the auditors’ work, like “close enough for government work.”

 

Don’t leave personal files containing memos, schedules and other matters related to an engagement, or superseded or outdated workpapers.

 

Properly prepare workpaper files by initialing and dating each audit program step. Sign off any audit program step determined to be not applicable “N/A,” or as not considered necessary “N/C/N”, followed by an explanation.

 

Any “Open Items Lists” should be reviewed and any conclusions regarding unique issues should be thoroughly documented. Additionally, time budgets explaining any overages and underages should be maintained, and the completion date should be documented.

 

Professional Standards require that workpapers should be retained for a minimum of five years from the report release date — although practice, legal, regulatory, or other factors may dictate a longer retention period. You should also consider the requirements by your State Board of Accountancy.

 


Don’t Forget Your Independence

The AICPA Code of Professional Conduct requires auditors to be independent in both fact and appearance. Auditor independence issues can be classified into four high-level areas:

  • Financial interest
  • Family relationship
  • Management function
  • Management decision making

 

If you plan to perform permissible non-attest services, the audit client must first agree to make all management decisions and perform all management responsibilities.

 

This begins with designating a person with suitable skills, knowledge, and/or experience (SKE requirement) — preferably within senior-level management — to oversee the performance of the permissible non-attest services.

 

The client must evaluate the adequacy of and accept responsibility for the results of the non-attest services, as well as establish and maintain internal controls, including monitoring ongoing activities.

 

Auditors should exercise caution when it comes to matters that can raise red flags about their independence in a peer review or in litigation. Areas of concern include:

 

  • Providing multiple non-attest services without adequate firm safeguards
  • Significant concentration of revenue coming from one audit client
  • Taking on management responsibilities
  • Providing consultation that goes beyond routine audit advice

 

Also be wary of inadvertently engaging in other non-compliance activities like performing non-attest services for a company before it becomes an attest client; loaning staff members to an attest client; certain mergers or purchase of a CPA firm; employment of, or association with, an attest client; performing attest services for a client with unpaid fees; and engaging a client employee.

 

Finally, other red-flag issues to consider include having a financial interest in an attest client and its affiliates, the adequacy of the fees charged, and the existence of a group audit.

 

Collemi Consulting leverages nearly three decades of experience to provide trusted technical accounting and auditing expertise when you need it the most. We regularly work with CPA firm leadership to help them reduce risk and maximize efficiencies. To schedule an appointment, contact us at (732) 792-6101.

 

AI Has Come to Auditing: Are You Ready?

December 1, 2025
Artificial intelligence (AI) is now becoming more of a part of the auditing process, and if you’re not using it, it’s time to start! The benefits are huge, starting with the ability to automate repetitive tasks, review all data rather than sampling, and allow real-time auditing. AI is not the future of auditing, it’s here now! AI is fundamentally changing the nature of auditing, and you’ve got to become comfortable with that. If your continuing professional education (CPE) schedule doesn’t include learning about AI and its strengths and weaknesses, it should. There are plenty of resources available from organizations like the Institute of Internal Auditors , the Center for Audit Quality (CAQ) and the American Institute of Certified Public Accountants’ (AICPA) CPA.com . Auditors must now understand how AI systems work, what data they use, and where biases might occur. That said, what AI is not is a replacement for human auditors along with their professional judgment and skepticism. It’s a tool for humans to use. A big, game-changing tool, but it’s a tool nonetheless. But the key to success is that auditors must remain central to the process. This changes everything Auditing is changing from a process defined by manual data checks, sampling, and periodic reviews to one based on automation, analytics and continuous insight. First of all, AI can automate routine work like data entry, reconciliation and report generation, reducing the risk of manual errors and freeing up auditors to spend more time on more complex activities that require critical thinking. Second, AI and machine learning tools can comb through mountains of data — including live data — and flag anomalies, spot unusual patterns and potential risks, and generally make compliance lapses and fraud signals easier to detect. AI also learns from the data it reviews, making it easier to flag suspicious patterns and transactions that are outside of the norm as its experience grows. Third is that AI means eventually the end of audit sampling, as AI tools can look at the whole data set in a way that human auditors cannot possibly do and immediately find the “needle in the haystack”! Fourth, that live data part is another key benefit of AI: real-time, continuous auditing is now possible. Instead of spending weeks or months reviewing records, exception reporting can happen immediately, giving management time to take corrective action before a material misstatement can occur. The result is that the relationship with clients changes from one of episodic annual reviews to continuous collaboration. That is shifting the auditor’s role from analyst to advisor. This changes nothing AI is radically changing how auditors work, but it hasn’t changed why they exist or the core responsibilities of the public accounting profession. Auditing is still focused on providing independent, reasonable assurance that financial statements do not contain any material misstatements, whether due to error or fraud. AI technology can add to auditors’ capabilities, but the core of the process still relies upon trust, transparency and accountability, which is why it is vital that auditors remain central to the process. The insights provided by AI are powerful, but their accuracy and completeness must still be determined by the review and validation of auditors applying professional skepticism and judgement. AI can flag anomalies but it cannot interpret intent, understand context or evaluate plausibility. AI can be taught to understand a client's business model, but it cannot interpret the realities that the business faces, like strategic shifts, market & cultural pressures, and regulatory environments. Data must be interpreted with human context. Also unchanged is that auditors are personally and professionally accountable for their opinions. AI is a wonderful tool, but auditors are still responsible for validating what the AI does, documenting their reliance upon those tools, and retaining control over final conclusions. Collemi Consulting leverages nearly three decades of experience to provide trusted technical accounting and auditing expertise when you need it the most. We regularly work with CPA firm leadership to help them reduce risk and maximize efficiencies. To schedule an appointment, contact us at (732) 792-6101.
Man in suit typing on laptop with

Group Audit Standards Are Changing. Are You Ready?

October 1, 2025
Generally speaking, group audits should be far more common than they actually are! On top of that, the new group audit requirements kick in next year, with some major changes: They have created a whole new class of “referred-to” auditors that must be considered when performing a group audit. And it’s time and past time to start preparing for that now. The American Institute of Certified Public Accountants’ (AICPA) Auditing Standards Board (ASB) issued SAS 149 that revises the definition of a “component auditor” and takes an updated risk-based approach to planning and performing a group audit. Issued in March 2023, SAS 149 goes into effect for audits of group financial statements for periods ending on or after December 15, 2026. Before we get into that, it’s vital to know that numerous times, auditors miss the fact that a group audit is necessary in the first place. That’s because determining what is and isn’t a “component” can be simple, but it’s not always obvious. Depending on how management runs its operations, a company can be a single entity with two or more different business activities means a group audit is necessary. When dealing with a single entity, many times, auditors see a single business or business line and miss what is really a separate “component” requiring a group audit, unless they have a consolidation of two or more subsidiaries staring them in the face. The question you should be asking yourself is, does the company have multiple product lines, service lines, branches, or anything else where the CFO and the CEO of the company manage their operations by tracking the performance of those multiple product or service lines? Are there multiple locations or divisions? It doesn't necessarily mean the company has to have a subsidiary or another legal entity that they control. Auditors are required to use professional judgment to determine whether a business activity represents a component, regardless of whether it is a separate legal entity. The current standard Group financial statements can include aggregated financial information from entities or business units like branches or divisions. If business units with separate management, locations, or information systems are aggregating financial information, you need a group audit. Here are some examples: Combined financial statements, when for example two companies are owned by the same person Consolidated financial statements, in which a company owns another company A joint venture A company organized by geography, for example American, Canadian and European units, each with their own general ledger A company with different business activities where performance is tracked separately A company that reports an equity method investment on its balance sheet Look at business activities first and determine if they are significant in terms of dollar amounts, or materiality, or if there’s a high risk in that part of the operations. Follow the flow of the numbers! SAS 149 kicks in Alongside the work of component auditors cited — for whose work the group auditor is responsible — there’s a new category: Referred-to auditors These are secondary auditors, brought in to issue their own opinion on a particular part of the operations that the group auditor will reference in their work. The new group audit standards make clear that the work of the referred-to auditor is relied upon in the final group audit, but was not carried out by the group auditor. These referred-to auditors are not component auditors under the terms of SAS 149, Special Considerations — Audits of Group Financial Statements (Including the Work of Component Auditors and Audits of Referred-to Auditors). SAS 149 is effectively telling group auditors to say very clearly, “Hey, we didn’t look at this part of the operation but we are referring to and relying upon this opinion.” The new standards also make clear that component auditors are part of the engagement team, whereas referred-to auditors are not. Risks grow For all that, the addition of referred-to auditors is not SAS 149’s most significant change: It provides an updated risk-based approach to planning and performing group audits. Under the existing standard a group engagement team is required to identify significant components at which to perform audit work. However, SAS No. 149 directs the group auditor to use professional judgment in determining the components at which to perform procedures, based on assessed risks. Just like the auditor is required to use professional judgment in determining what should or shouldn’t be a group audit. Collemi Consulting leverages over three decades of experience to provide trusted technical accounting and auditing expertise when you need it the most. We regularly work with CPA firm leadership to help them reduce risk and maximize efficiencies. To schedule an appointment, contact us at (732) 792-6101.
Business meeting: diverse group around a conference table, discussing, laptop in center.

Getting Involved with Boards and Committees

August 20, 2025
Once you reach a certain point in your career, say five to ten years in, it’s a good time to start getting involved with professional organizations ranging from associations, not-for-profits and state boards and committees. There are a lot of benefits to getting involved in professional organizations that start with making new relationships and even getting new clients, but go far beyond that. There are plenty of soft skills to be learned from being active in your profession. One is simply learning how to deal with businesses, professional boards and with non-profits. These are organizations that will ultimately be important to you and your practice, and knowing how to navigate them is a skill that will stand you in good stead throughout your career. A good place to start is with your local chapter of your State Society, the National Society of Accountants (NSA) and American Accounting Association (AAA), as well as your state board of accountancy . But there are others as well, even local and state Chambers of Commerce . Benefits include: Refining existing skills: You will utilize skills like financial management, budgeting and bookkeeping in new contexts. Gaining leadership and project management experience: Volunteering often means taking on leadership roles and overseeing projects. Staying current with industry trends and regulations: Staying up-to-date is a byproduct of getting involved. Expanding professional networks: Volunteering provides the opportunity to meet and build relationships with other accountants and business executives, work with leaders in your field, and meet potential mentors. Building a strong reputation: Actively contributing to a board or committee can enhance your standing within your field, which can be valuable for gaining new clients and career advancement. Increasing visibility: getting involved in projects and committees distinguishes you from peers and can demonstrate a commitment to your career. Professional development : Many organizations offer professional education courses, workshops and conferences that go beyond your required continuing professional education (CPE) requirements. Credentials and certifications: Many industry organizations offer professional certifications and credentials that can help differentiate you from your peers. All of these benefits can be tied back into your career and professional development. As your involvement grows over time, so will the benefits. You’ll develop a professional network of likeminded leaders in their fields of expertise that will help you advance your career both inside and outside of the organizations for which you volunteer. And as your commitment to these organizations grows over time, so will your leadership in them. Committee memberships will become committee leadership, with the resulting increase in visibility and prestige. Participation at events will turn into speaking opportunities and a higher professional profile. You’ll have the opportunity to influence policy and the direction of your whole industry. Your professional network will expand with higher-level and more advanced professionals within your field over time. You’ll also build a stronger resume, one that demonstrates both your commitment to your field and your expertise in it. Working with organizations outside your professional field like a chamber of commerce or local/state government can bring many of these benefits as well: Networking and meeting potential new clients, raising the profile of yourself and your firm, and simply learning how to interact with businesspeople and executives outside the profession. Five or ten years into your professional life is a good time to start branching out a little bit and do work that’s outside your firm. Beyond all this, there is a sense of personal fulfillment that giving back to your profession and community can bring. It’s important to get involved in issues that are important to you. Collemi Consulting leverages over three decades of experience to provide trusted technical accounting and auditing expertise when you need it the most. We regularly work with CPA firm leadership to help them reduce risk and maximize efficiencies. To schedule an appointment, contact us at (732) 792-6101. 
A hourglass is sitting on a table next to a dollar sign.

You Have Less Than Just Six Months Left to Implement the AICPA’s New SQMS and the PCAOB’s New QC 1000 Standards

July 16, 2025
Nine months ago, we warned that two new sets of quality control and management standards were coming due on December 15, 2025 and strongly advised public accounting firms not to wait until the last minute to begin implementing them. Well, it’s now the last minute. With just six months left until the the American Institute of Certified Public Accountants’ (AICPA) new Statements on Quality Management Standards (SQMS) and the Public Company Accounting Oversight Board’s (PCAOB) new QC 1000 quality control standards go into force, there’s no time left to delay or procrastinate. Here’s a short overview of each set of standards and what’s necessary, but you can find our full blog for the AICPA’s new SQMS here , and the PCAOB’s new QC 1000 standards here . Both will require extensive effort to come into compliance. The AICPA’s SQMS The SQMS are what we here at Collemi Consulting & Advisory Services like to call the “thinking standards.” This means you really have to think it through and customize it for your attest practice, based on the type of clients you have and the services you provide, as the SQMS now takes an entirely new, risk-based approach to quality. There are now eight SQMS components, including two completely new ones: Risk Control, and Information and Communication. The new risk assessment process requires firms to establish specific quality objectives, meaning they must “identify and assess quality risks, and then they must design and implement responses to those risks that are tailored to the firm’s unique circumstances.” Information and communication requires the establishment of processes that support the SQMS, including reliable internal and external sources of information. It also mandates the creation of a culture that supports and reinforces the responsibility for sharing information with colleagues and the firm. All of the six other quality objectives have new requirements as well: ● Governance and leadership ● Relevant ethical requirements ● Acceptance and continuance of client relationships and specific engagements ● Engagement performance ● Resources (formerly Human Resources) ● Monitoring Firms have three responsibilities between now and December 15: 1) Continue using the extant standard (Statement of Quality Control Standard (SQCS) No. 8 (Redrafted) 2) Perform the risk assessment and gap analysis, and then design and implement the new standards. 3) Consult with your peer reviewer before final implementation Firms then have until Dec. 15, 2026 to carry out an annual evaluation of their new quality management system. The PCAOB’s New QC 1000 Standards The PCAOB’s new QC 1000 standard is intended to make independent registered public accounting firms who audit issuers (public companies) and broker-dealers significantly improve their quality control (QC) systems. It applies to all PCAOB-registered member firms. Those that audit more than 100 issuer clients annually have more extensive requirements to contend with. The new standard enables firms to identify their specific risks and design a quality control system, including policies and procedures to guard against those risks. The goal is to create what the PCAOB refers to as a “a continuous feedback-loop for improvement.” QC 1000 has quality control requirements that do not appear in other QC standards. They tend to be more prescriptive and more tailored to the U.S. legal and regulatory systems. There are 10 areas in which the QC 1000 goes beyond what can be found in other existing standards. These are: ● Evaluation and Reporting ● Governance and Leadership ● Ethics and Independence ● Monitoring and Remediation ● Quality Objectives ● Information and communications ● Resources ● Risk Assessment Processes ● Roles and Responsibilities ● Documentation That’s not even an exhaustive list, and it’s coming into effect at the same time as the AICPA’s SQMS. Our recommendation is to make two completely separate documents rather than trying to roll it all into one giant document. It’ll be too confusing, especially for people who might not have to audit both public companies, broker-dealers and private companies. We also advise you to appoint a separate champion within the firm for each of the two different sets of standards. Otherwise it just gets too complex. Like we said, time is running out. It’s time to get it done or get help doing it. Collemi Consulting leverages over three decades of experience to provide trusted technical accounting and auditing expertise when you need it the most. We regularly work with CPA firm leadership to help them reduce risk and maximize efficiencies. To schedule an appointment, contact us at (732) 792-6101. 
More Posts