May 2, 2021

Successfully Preparing For Year-End Audits of Privately-Held Clients

Year-end is typically a busy time for external auditors, even without the added stress of the COVID-19 pandemic. But as most CPA firms know, the hectic atmosphere is not a reason to neglect a highly-developed, measured, methodical year-end audit strategy plan.

In addition to meeting a CPA firm’s quality control standards, audit engagements are subject to a peer review or outside monitoring process — and a peer review report with a rating of pass with deficiencies, or fail, may shake the core confidence of a CPA firm’s leadership, clients and the public interest. Collemi Consulting professionals have been called in when CPA firms have encountered negative peer review results, and we’ve been asked to address some commonly cited matters.
To begin with, a well-crafted audit will address and satisfy the following issues:


  • Common peer review challenges
  • Audit planning and supervision
  • Audit risk and risk assessment procedures
  • Obtaining and documenting an understanding of the audit client and its environment, including its internal controls
  • Materiality considerations
  • Linking audit procedures to mitigate the risks identified and reach audit conclusions
  • Required auditor communications


The auditor’s overall objective when conducting a risk-based approach to audits of financial statements is to provide reasonable assurance that the financial statements, as a whole, are free from material misstatement, enabling the auditor to express an opinion on whether the financial statements are prepared, in all material respects, in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP).


Avoidance of Common Peer Review Issues
Frequently cited mishaps with respect to risk assessment include:

  • Failure to link the substantive procedures performed to the results of the risk assessment
  • Audit procedures not linked to the client’s financial statement and relevant assertion-level risks for significant classes of transactions, account balances, or disclosures
  • Designing audit procedures with little regard for the results of that assessment as required by AU-C 315, Understanding the Entity and its Environment and Assessing Risks of Material Misstatements.


Risk Assessment Shortcomings

Peer reviewers often cite shortcomings in auditors’ understanding of the entity and its control environment. This includes a failure to understand the entity’s internal controls. When conducting your risk assessment, it’s useful to remember that your assessment will generally be more effective at the start of the engagement, and that internal control procedures may be performed before the risk assessment document is completed. The auditor, however, is not required to test internal controls unless mandated under certain circumstances.


Other critical points to keep in mind include the importance of having strong audit workpaper documentation; and that the risk assessment process is an iterative one: repetition in order to generate a sequence of outcomes. Also, the AICPA Professional Standards have changed over the last decade due to the issuance of the suite of risk assessment standards and Clarity requirements.


Please note that practice aids are no substitute for understanding the Professional Standards. Although auditors are only required to document their understanding of the factors that help them draw conclusions, auditors are still responsible for maintaining adequate documentation, and it’s their responsibility to meet Professional Standards.


Audit Documentation Dilemmas

Audit documentation is defined as “the record of audit procedures performed, relevant audit evidence obtained, and conclusions the auditor reached.” Audit documentation should be sufficient to enable an “experienced auditor” — one who is independent and competent enough to challenge the engagement team’s procedures and conclusions — to understand such characteristics as the nature, timing, and extent of the audit, the results of the audit procedures performed, and any significant findings or issues.


Properly executed, audit workpaper documentation can stand on its own without any verbal explanation by the auditor if it answers the 5 “W” and 1 “H” questions: Who?, What?, When?, Where?, Why?, How?


Audit documentation serves as:

  • Evidence that the audit was properly planned and performed in accordance with auditing standards generally accepted in the United States of America (U.S. GAAS) and Evidence of the auditor’s basis for a conclusion


To further increase audit quality, audit documentation should provide sufficient and appropriate evidence that:

  • Risk assessment procedures were performed
  • There was appropriate response to address the risk of misstatement at the financial statement level
  • The nature, timing and extent of audit procedures performed were adequate for the engagement
  • There was linkage of those procedures with the assessed risks
  • The results of the audit procedures
  • Conclusions reached
  • Significant risks were reasonably considered


Audit workpapers should also reflect justification for any departures from presumptively mandatory requirements. They should also identify individuals who performed the work, when it was completed, the person who reviewed the work, and the date and extent of the review.


Audit workpaper documentation should also identify characteristics of the specific items tested, and discuss significant findings or issues with management or those charged with governance. Any information that contradicted or was inconsistent with the final conclusion on a significant audit finding or issue that was addressed should also be documented.


Don’t Forget About Litigation Attorneys

Over the years we’ve worked with litigation attorneys who have shared some “flash points” with us about notes and other workpaper matters that can come back and haunt the auditor. To be on the safe side, these are some real-life phrases and other items that should not make an appearance in your audit workpaper files:

  • Extraneous remarks or irrelevant memoranda, like “the client’s books are a complete mess” or “these expenses seem questionable”
  • Auditor statements that discredit their own work: “close enough for government work”
  • Personal files containing memos, schedules, and other matters related to an engagement
  • Superseded or outdated workpapers


Elements of properly prepared workpaper files include: initialing and dating each audit program step, signing off any audit program step as not applicable “N/A,” or as not considered necessary “N/C/N”, followed by an explanation. Any “Open Items Lists” should be reviewed and any conclusions regarding unique issues should be thoroughly documented. Additionally, time budgets explaining any overages and underages should be maintained, and the completion date should be documented. Professional Standards require that workpapers should be retained for a minimum of five years from the report release date — although practice, legal, regulatory, or other factors may dictate a longer retention period.


Don’t Forget Your Independence

The AICPA Code of Professional Conduct requires auditors to be independent in both fact and appearance. Auditor independence issues can be classified into four high-level areas:

  • Financial interest
  • Family relationship
  • Management function
  • Management decision making


In order to perform permissible non-attest services, the audit client must first agree to:

  • Make all management decisions and perform all management responsibilities
  • Designate an individual with suitable skills, knowledge, and/or experience, preferably within senior-level of management, to oversee the performance of the non-attest services
  • Evaluate the adequacy and results of the non-attest services
  • Accept responsibility for the results of the non-attest services
  • Establish and maintain internal controls, including monitoring ongoing activities


Auditors should exercise caution when it comes to certain “independence” matters that can raise red flags about their independence in a peer review or litigation matter. Some areas include:


  • Providing multiple non-attest work products
  • Significant concentration of revenue coming from one audit client
  • Taking on management responsibilities
  • Providing consultation that goes beyond routine advice
  • Inadvertently engaging in other non-compliance activities like performing non-attest services for a company before it becomes an attest client; loaning staff members to an attest client; certain mergers or purchase of a CPA firm; employment of, or association with, an attest client; performing attest services for a client with unpaid fees; and engaging a client employee


Other red-flag issues include financial interests in an attest client and their affiliates, the adequacy of fees being charged, and the existence of group audits.

Learn More

You Have Less Than Just Six Months Left to Implement the AICPA’s New SQMS and the PCAOB’s New QC 1000 Standards

By Jennifer Ruf • July 16, 2025
Nine months ago, we warned that two new sets of quality control and management standards were coming due on December 15, 2025 and strongly advised public accounting firms not to wait until the last minute to begin implementing them. Well, it’s now the last minute. With just six months left until the the American Institute of Certified Public Accountants’ (AICPA) new Statements on Quality Management Standards (SQMS) and the Public Company Accounting Oversight Board’s (PCAOB) new QC 1000 quality control standards go into force, there’s no time left to delay or procrastinate. Here’s a short overview of each set of standards and what’s necessary, but you can find our full blog for the AICPA’s new SQMS here , and the PCAOB’s new QC 1000 standards here . Both will require extensive effort to come into compliance. The AICPA’s SQMS The SQMS are what we here at Collemi Consulting & Advisory Services like to call the “thinking standards.” This means you really have to think it through and customize it for your attest practice, based on the type of clients you have and the services you provide, as the SQMS now takes an entirely new, risk-based approach to quality. There are now eight SQMS components, including two completely new ones: Risk Control, and Information and Communication. The new risk assessment process requires firms to establish specific quality objectives, meaning they must “identify and assess quality risks, and then they must design and implement responses to those risks that are tailored to the firm’s unique circumstances.” Information and communication requires the establishment of processes that support the SQMS, including reliable internal and external sources of information. It also mandates the creation of a culture that supports and reinforces the responsibility for sharing information with colleagues and the firm. All of the six other quality objectives have new requirements as well: ● Governance and leadership ● Relevant ethical requirements ● Acceptance and continuance of client relationships and specific engagements ● Engagement performance ● Resources (formerly Human Resources) ● Monitoring Firms have three responsibilities between now and December 15: 1) Continue using the extant standard (Statement of Quality Control Standard (SQCS) No. 8 (Redrafted) 2) Perform the risk assessment and gap analysis, and then design and implement the new standards. 3) Consult with your peer reviewer before final implementation Firms then have until Dec. 15, 2026 to carry out an annual evaluation of their new quality management system. The PCAOB’s New QC 1000 Standards The PCAOB’s new QC 1000 standard is intended to make independent registered public accounting firms who audit issuers (public companies) and broker-dealers significantly improve their quality control (QC) systems. It applies to all PCAOB-registered member firms. Those that audit more than 100 issuer clients annually have more extensive requirements to contend with. The new standard enables firms to identify their specific risks and design a quality control system, including policies and procedures to guard against those risks. The goal is to create what the PCAOB refers to as a “a continuous feedback-loop for improvement.” QC 1000 has quality control requirements that do not appear in other QC standards. They tend to be more prescriptive and more tailored to the U.S. legal and regulatory systems. There are 10 areas in which the QC 1000 goes beyond what can be found in other existing standards. These are: ● Evaluation and Reporting ● Governance and Leadership ● Ethics and Independence ● Monitoring and Remediation ● Quality Objectives ● Information and communications ● Resources ● Risk Assessment Processes ● Roles and Responsibilities ● Documentation That’s not even an exhaustive list, and it’s coming into effect at the same time as the AICPA’s SQMS. Our recommendation is to make two completely separate documents rather than trying to roll it all into one giant document. It’ll be too confusing, especially for people who might not have to audit both public companies, broker-dealers and private companies. We also advise you to appoint a separate champion within the firm for each of the two different sets of standards. Otherwise it just gets too complex. Like we said, time is running out. It’s time to get it done or get help doing it. Collemi Consulting leverages over three decades of experience to provide trusted technical accounting and auditing expertise when you need it the most. We regularly work with CPA firm leadership to help them reduce risk and maximize efficiencies. To schedule an appointment, contact us at (732) 792-6101. 
A light bulb with a red question mark inside of it.

Consultations and Differences of Opinion

By Jennifer Ruf • June 12, 2025
When questions or technical issues arise, it’s important that they be resolved in a timely and efficient manner. That means consulting with other members of the engagement team or someone either in the firm or outside of the firm with more expertise or experience. This is especially important when there is a difference of opinion or uncertainty about a technical question, the application of Professional Standards procedure, the application of firm policy, or the application of a rule, regulation, or procedure from a regulatory agency. First off, a CPA firm should have an up-to-date library, as well as industry and other specialized materials related to their client’s industry. This is an important tool for answering questions or settling differences of opinion. As there are many issues/challenges that can cause this kind of question or difference of opinion to arise, and in many cases in-house library resources won’t be enough. When differences arise These difficult or contentious issues begin with any engagement in which a modified or adverse report is likely to be issued. Then there’s any engagement involving material litigation of a first-time or complex technical pronouncement. Other issues that can arise include industries with specialized accounting treatments, auditing or reporting requirements, or with complex or unusual transactions. Emerging practice problems also fall into this category. Having choices among accounting principles generally accepted in the United States of America (U.S. GAAP) either initially or when an accounting change is made is another situation in which questions can arise. So is the need to reissue an audit report, consider omitted procedures after a report has been issued, or the discovery of facts that were not known when the report was issued. More serious issues include any restatement to financial statements upon which a report was issued. These cases require consultation with the managing partner and quality control partner and their approval of the resolution. Restatements are considered contentious or difficult issues, and must be carefully documented at every stage. Then there are questions or differences of opinion about documents to be filed with a regulatory agency, and especially meetings with regulatory agencies in which the firm will be called upon to defend the application of U.S. GAAP or auditing standards generally accepted in the United States of America (U.S. GAAS) that have been questioned. When questions arise First of all, anytime there is a question requiring consultation or a difference of opinion arises either within the engagement team, or between the engagement partner and the engagement quality control reviewer (EQCR), the issues must be discussed between the parties involved. If any member of the team disagrees with the resolution, it should be escalated based on the CPA firm’s quality control policies and procedures. Second, look for people within the firm with the knowledge, seniority or experience to bring expertise to the question. The quality control partner will be a good resource for finding these experts. Third, if someone with the requisite know-how can’t be found within the firm, or that person is unable to satisfy the difference of opinion, it’s time to look outside the firm. CPAs at other firms, consultants, the AICPA Technical Hotline, AICPA Audit Quality Centers,and other professional and regulatory bodies are all sources of quality control services and expertise. When looking for an outside subject matter expert (SME), consider their professional certifications, licenses or other qualifications that demonstrate expertise. Also look at the reputation and standing of the person in question. Of course, look for any relationship with the client. Consulting specialists Certain audit or attestation engagements may require the firm to consult with specialists including actuaries, appraisers, attorneys, and even engineers or geologists, among others. Following the guidance in AICPA Professional Standards at AU‐C 620A and AT‐C 105 when such consultations are necessary is vital. The nature and scope of consultations on contentious or difficult issues should be agreed-upon by all parties. The results of those consultations must be well-documented so as to ensure that the issue which required outside expertise is clearly stated. So must the results of the consultation, the decisions made and the basis upon which they were made, and how those decisions were implemented. The documentation must show that the conclusions reached were understood by both the persons consulting and the consultant. When escalating isn’t enough If the difference of opinion cannot be resolved by any of the aforementioned steps, it’s time to bring the matter to the managing partner and/or quality control partner. The managing partner and/or quality control partner will resolve the dispute, possibly in consultation with other experts or regulatory entities. The resolution must be documented, and the report should not be released until differences of opinion are resolved. At this point, anyone who still disagrees with the outcome will document their difference of opinion on the matter. At every stage of this process, it is the engagement partner who has responsibility for ensuring that differences of opinion are resolved, and that they are properly documented. Collemi Consulting leverages over three decades of experience to provide trusted technical accounting and auditing expertise when you need it the most. We regularly work with CPA firm leadership to help them reduce risk and maximize efficiencies. To schedule an appointment, contact us at (732) 792-6101. 
A man in a suit and tie is holding a piece of paper that says be an active listener.

Soft Skills: How To Be an Active Listener

By Jennifer Ruf • May 16, 2025
Being an active listener takes a lot more than just paying attention. It requires understanding the other person, and then conveying that you understand them, are interested in what they are saying and are engaged in the conversation. There’s never been a more important time to be an active listener. With the post-COVID world making remote work conversations a daily occurrence, it’s harder than ever to make — or pick up on — subtle clues that your partner in the conversation is making. As a leader, it’s vital to make sure your reports feel listened to and your clients feel their needs and concerns are being heard. If they don’t they’ll stop sharing information with you — or stop working with you. Participants in a conversation have two goals. The first is to understand what the person is saying, both in terms of the content and the emotion behind it. The second is to convey interest and engagement in what they are saying. As a general rule of thumb, as an active listener you’ll want to spend 80% of the conversation listening and 20% talking. Active listening has three components. The first is paying attention to what is being said and comprehending it. The second is to stay calm and engaged during the conversation, not letting emotional responses break up the flow. The third is conveying that you are interested in what the speaker has to say and understand it, both verbally and non-verbally. Perhaps the most obvious — and possibly the hardest — rule is to actually stay focused on the conversation: Don’t multitask and don’t put yourself in a position to be interrupted or distracted. Here are six tips that will help you become a better listener: A simple but important technique is to repeat people’s last few words back to them. It makes people feel listened to and keeps the conversation on track while giving the speaker and listener a pause to regroup and collect their thoughts. At the same time, avoid interrupting the speaker. Keep your break-ins natural and brief. Don’t try to immediately fill a void while the speaker is collecting their thoughts. Putting what has been said in your own words shows comprehension. Paraphrasing is an effective way of being sure you actually understand what they are saying, and makes clear to the speaker that you are paying attention. Non-verbal clues are vital, both giving and receiving. As the listener you want to nod, use a facial expression, make and maintain eye contact, and use open body language to convey that you are interested in what is being said. At the same time, pay attention to the unspoken part of the conversation. Look for body language and tone of voice to see what the motivation is and what emotions are behind it. Ask questions. Then ask more questions. This not only conveys that you are listening and comprehending, it helps ensure that you actually are understanding what’s being said. Try not to ask questions with a simple yes or no answer as that can break the conversation’s flow. Instead ask open-ended questions like “can you tell me more about that?” or “what do you think is the best path moving forward?” Don’t be judgemental, display emotion or interrupt with counter-arguments, which can be frustrating to the speaker. Let them finish. Be open to new ideas. Becoming a good active listener takes time and practice, but you’ll find the benefits are worth the effort. Collemi Consulting leverages nearly three decades of experience to provide trusted technical accounting and auditing expertise when you need it the most. We regularly work with CPA firm leadership to help them reduce risk and maximize efficiencies. To schedule an appointment, contact us at (732) 792-6101.
Looking up at a group of tall buildings with a blue sky in the background.

The Siren Song of Private Equity Acquisitions

By Jennifer Ruf • April 30, 2025
The wave of mergers and acquisitions in the accounting industry over the past five years or so shows no sign of abating as small and mid-size public accounting firms seek to gain the size that lets them invest in new technology and recruitment, and gain other advantages of economies of scale. While there are lots of arguments to be made in favor of joining forces with other CPA firms, it’s still a fraught process with many potential hurdles. And it’s not just other public accounting firms doing the merging and acquiring. The private equity firms that have been rolling up small and mid-size CPA firms into larger ones come with plenty of benefits, notably the ability to make the investments needed to compete at a time when automation and artificial intelligence (AI) are bringing a sea change into the accounting business, and competitors are getting bigger. But they also come with their own baggage, such as questions of conflicts of interest and compliance with the auditor independence rules, as well as a focus on the more profitable tax and advisory service side of the firms. The money from an acquisition can be enticing, but it’s important to go into it knowing that there’s a price to be paid for it, and what that price is. And how to go about paying it if you do decide to join forces with a private equity firm. Private equity pros Private equity firms have been competing to invest in large public accounting firms, but also to buy out and roll up small and mid-size firms for two core reasons. One is a steady and predictable revenue stream, particularly on the audit side, which is very enticing to them. The other is the revenue potential of expanding the more lucrative tax and consulting side of the business. But they also see the opportunity to grow the CPA firms and make them more profitable by investing in things like staff training, recruitment and cutting edge technology like AI that can transform the accuracy and efficiency of audit processes. And, of course, strategic acquisitions that can further strengthen the business. Another thing they can do is centralize certain auditing tasks like data processing or routine testing, even moving it offshore for cost efficiency. This can give the core auditing team more time for the deep dive and the ability to focus on more value-added services. Private equity cons On the con side, the focus on consulting can lead to the auditing quality side being given less priority for investment and growth. With a focus on short-term profit, private equity funding can come with pressure to focus attention on the higher margin consulting side of the business. Private equity firms are often eager to scale up the tax and consulting sides of the business, to the point of sometimes creating an alternative practice structure (APS) by investing in or acquiring just those parts of a firm and leaving the audit side, with its need for independence and smaller margins, alone. Which calls into question the benefits of a private equity investment, at least on the auditing side of the business. Then there’s the threat to auditor independence of having an owner or partner with a large portfolio of companies like tech firms that can provide other services to audit clients. And even when there is no actual threat, these perceived conflicts of interest can be a red flag to audit regulators and standard-setters. Private equity questions When you’re looking at an investment or acquisition by private equity there are questions to be asked that aren’t always obvious, or at least that don’t have simple answers. It’s easy enough to start a conversation about auditor independence and the appearance of impairment or conflicts of interest with the auditing side of the business, but it’s also easy enough to promise that these issues won’t be a problem. You have to be aware of the other types of services that they're planning to provide to that same client, because that could have an impact on whether or not you can perform the audit or the review work that you’re doing without violating the AICPA’s Code of Professional Conduct. That’s particularly true with small CPA firms focused on the auditing side of the business instead of consulting, which will suddenly find themselves paired with a large and aggressive tax and consulting business. But whatever size your practice is, you’ll have to update policies and procedures and be cognizant of the need to create an infrastructure that acknowledges the potential conflicts that come with a private equity firm’s offer. Collemi Consulting leverages nearly three decades of experience to provide trusted technical accounting and auditing expertise when you need it the most. We regularly work with CPA firm leadership to help them reduce risk and maximize efficiencies. 
More Posts