Attestation Update – A&A for CPAs

Technical stuff for CPAs providing attestation services

SSARS #19 documentation requirements

with one comment

A series of posts addressing documentation requirements of SSARS 19 have been combined into this page.  This will allow you to read all the posts together and in logical sequence.  Hope it is helpful for you!

Documentation requirements for a compilation under SSARS 19

SSARS 19 has specific documentation requirements for compilations and reviews. I will discuss these requirements in a series of posts.

Compilations first. Reviews later.

The overall documentation requirement is that the accountant should prepare documentation in a compilation with sufficient detail to give a clear understanding of the work performed.

Two comments on that. First, the workpapers have to have enough ‘stuff’ so that someone else can understand what was done.  There does not have to be a lot done in a compilation, but someone else has to be able to figure out what you did based on the workpapers.  This doesn’t mean you have to confirm anything or do analytical reviews or review contracts. But what you do in the comp needs to be documented.

Second comment is the use of the word should. Under the SSARS, when the word should appears, it identifies a presumptively mandatory requirement.  Unconditional and presumptively mandatory requirements are discussed here.

When the word should is used, then you have to comply with that requirement unless:

  • you have a really, really good reason not to do so,
  • you document in the workpapers why you did not comply, and
  • you show you have complied with the objective of that requirement through some other means.

That is a pretty high hurdle to clear.

SSARS 19 has a helpful comment that the documentation for a compilation can rely on documents outside of that particular engagement. The specific examples are other engagement files or quality control files. Let’s say you are doing a monthly or quarterly compilation on a tax client. You would not have to have a copy of the engagement letter in the workpapers for every compilation during the year. You could instead put the engagement letter in the first compilation engagement or even in the tax files. Likewise if you wanted to document your understanding of the industry you could do so in the first compilation engagement or the tax files instead of every compilation. If there is a calculation you have to review for every compilation, then you could update a single workpaper which is in one of your files. That workpaper would document that issue for each of the compilations during the year.

Next, the specific documentation requirements for a compilation.

Documentation of compilation – on one hand and then on the other

The discussion of documentation requirements for a compilation under SSARS 19 has an open-ended comment allowing wide latitude on one hand and specific requirements on the other hand.

Paragraph 2.15 says the content and extent of documentation fora compilation depend on the specifics of the engagement, the technology used, the firm approach, and professional judgment.  That gives a lot of latitude.  That means you can determine the documentation based on your firm approach, the technology tools you choose, and what you believe is appropriate in the circumstances.

On the other hand…

SSARS 19 says the documentation should include a few specific items. Notice the use of that word should. Remember that says there is a presumptively mandatory requirement.

First, an engagement letter.  The purpose of an engagement letter is to document your understanding with your client. The goal is to make it clear what is going to be done and prevent misunderstandings.

So do you really, really have to get an engagement letter?  I talked about that here.   I still hear someone out there asking “do I really, really have to get an engagement letter for just a monthly comp?”  Okay, here’s the short answer: yeah, you gotta’ get one.  The only alternative is climbing a mountain to avoid a pond 2 inches deep .

Second, significant findings or issues should be in the documentation.  So what would be a significant finding or issue?  SSARS 19 indicates material adjustments to the financial statements would qualify along with what you did to address any such issues.

Some specific examples that come to mind might be checking on the billings-in-excess/cost-in-excess calculation for a construction client when the trial balances show there are none, asking about temporarily restricted contributions and net assets for a nonprofit organization when the numbers haven’t changed since last quarter, or documenting why you believe you are still independent when you perform the depreciation calculations.

Third, communications about fraud or illegal acts that come to your attention should be documented.  SSARS 19 doesn’t say you have to look for such things. However, if fraud or illegal acts jump out at you, then you need to address them.

What might jump out at you?  Oh, say after reading the financial statements you notice that there is no payroll tax expense or liability this quarter.  Asking a simple question about that anomaly produces the explanation that all of the office staff and managers were moved to independent contractor status this quarter. Oops. You may have an illegal act you need to talk about with the client and then document in your workpapers.  Again, you don’t have to go looking for fraud and illegal acts, but if something comes to your attention, you should document that in the workpapers.

On to the review requirements.

Documentation requirements for a review under SSARS 19

I discussed the documentation requirements for compilations previously here and here.  Now it is time to start the discussion of documenting a review.

Our starting point is to address the word should.  As I said in the discussion on compilations, when the word should is used in the SSARS literature it identifies a presumptively mandatory requirement.  When you see the word should, then you have to comply with that requirement unless:

  • you have a really, really good reason not to do so, and
  • you document in the workpapers why you did not comply, and
  • you show you have complied with the objective of that requirement through some other means.

That is a pretty high hurdle to clear.

The discussion of documentation for a review starts out saying that the accountant should have enough documentation to give a clear understanding of what was done.  This specifically includes the nature, timing, extent, and results of what you did along with what review evidence was obtained and where you got that evidence.

SSARS 19 goes on to explain two things that documentation accomplishes:

  • It gives the principal support for the accountant saying the review was performed in accordance with the SSARS.
  • It gives a principal support for the accountant’s conclusion that the financial statements don’t need any material modifications.

It’s time for a little tangent.  Remember that third bullet point above for how to get around a should requirement? (the comment that said you don’t have to comply with that requirement if the workpapers show that you have complied with the objective of the requirement some other way.)  By explaining what documentation accomplishes, the SSARS has given the objectives for accumulating that documentation.

If you decide not to comply with one of the should items, then you can look at the two previous bullet points to see the hurdle your workpapers have to clear – you have to show you complied with the SSARS and you have to show why you believe the financial statements don’t need any material modifications.  Wow.  If you decide not to follow some of the subsequent requirements, you have a mighty tall hill to climb for your alternate route.

Next, the specific requirements for a review.

Specific required documentation for a review under SSARS 19 – part 1

Yesterday’s post discussed the overall objective of accumulating documentation for a review.  This post gets into the specific requirements.

SSARS 19 says the documentation accumulated depends on the circumstances.  The form, content, and extent of what you document is determined by the circumstances of the engagement, the methodology used on your review, the technology tools you use in your firm, and your professional judgment.  That gives you a tremendous amount of latitude in determining what kind of documentation to accumulate and the methods used.

As you use your freedom provided by that idea, keep in mind those two overall documentation objectives discussed in the earlier post.

Just as soon as SSARS 19 gives tremendous latitude, it takes a lot of it back.  SSARS 19 provides a list of documentation that should be included (aha, that special word again):

Engagement letter – I previously discussed whether you really, really, really have to get an engagement letter for a compilation.  Same discussion applies to a review.  If you want a long answer to the question, read that post.  If you want a short answer, then here it is: yes.

Analytical procedures – These need be documented and should include the expectations which were developed before performing an analytical procedure.  You can’t just do an analytical procedure and look at the results.  You need to have some expectation for what you will see.  You need to document that expectation and why you have that expectation.

For example, you can’t just compare cost of sales from this year to last year.  You need to find out what happened to sales overall and cost factors in the market so that you have some reasonable basis for an expectation as to what the change in cost of sales ought to be.  It doesn’t make any sense for cost of sales to go up 15% unless you previously knew that sales increased something in the order of 10% to 20%.  If you know what happened to sales, then you can have a reasonable expectation for what will happen to cost of sales.  So you need to document your expectations and why you have those expectations.

          How did the analytical procedure turn out? Document the results of the analytical.

          What did management have to say about the fluctuations?  When you see the results of an analytical procedure that don’t make sense or a relationship that is inconsistent with your expectation, you obviously are going to ask management what happened.  Document their comments.  Document why the relationship that previously didn’t make sense now does make sense.

          What else did you do in response to unexpected difference from analytical procedures? If the results of the analytical are really odd and management cannot give a reasonable explanation, then you know that you have to go do some additional analysis.  You need to document that additional work.

Next post finishes the list of required documentation in a review.

Specific required documentation for a review under SSARS 19 – part 2

Previous post started  a discussion of the specific documentation required for a review.  Here is part 2.

SSARS 19 says the documentation for a review should include (remember should is a loaded word in the SSARS literature):

Inquiries – you need to document the significant items discussed during your inquiries.  Also need to document management response to your inquiries.  SSARS 19 provides latitude to document it in whatever format you desire – you could use checklists, memos, or something else.  I’m not sure what you would use other than a memo or the checklist from your 3rd party document provider, but if you come up with something, go for it.

Significant findings or issues – If you find something significant during a review, you need to document it.  The example in the literature is a review procedure that suggests the financial statements could be materially misstated.  If that happens, obviously requires accountant will address the anomaly, resolve whether the financial statements actually need to be modified, and propose any necessary modifications.  Those type of items should be documented.

“Significant unusual matters” – SSARS 19 doesn’t define what those are, but if you come across one of them, you need to document what it was and how you resolved it.  I think that if you see a significant unusual matter, you will know it.  You would already be highly inclined to documented that anyway, so this doesn’t really change much.

Fraud or illegal acts – SSARS 19 doesn’t require the accountant to do anything special or out of the ordinary to look for fraud or illegal acts in a review.  If something jumps out at you (the literature uses the old standby of something comes to your attention), then you need to document your communications with the appropriate level of management.

Representation letter – you gotta get one.

In the next post, a few other comments on documentation and oral explanations.

Documentation of reviews – time to stop saying ‘done’

The list of required documentation in the previous posts here and here doesn’t really seem to be a massive expansion of requirements, right?  Obviously the impact will depend on what the level of documentation has been in your firm.  For the firms I’m familiar with, those specifics are not going to open up a lot of new documentation requirements.

There is one place where a lot of firms may need to make a change:

There is one practical implication of documenting inquiries and management’s response to them.  The approach of marking “done” or “none” for an inquiry on a checklist probably won’t work anymore.  It will now be necessary to explain what management said and who said it instead of just writing down “none”.

Just one example. Let’s say you have step on your review work program that says something like

  • make inquiries of management concerning their knowledge of any fraud or suspected fraud affecting the entity involving management or others where the fraud could have a material effect on the financial statements.

In the past, you might have just written “none” or “done” and left it at that.

Such a response really doesn’t fit that requirement to document management’s response.  Something more is needed.  Perhaps the name of the person you spoke to who, when, and maybe more than just a one-word reply.

Perhaps a better response to that question would be something like:

  • none per discussion w/Joe Able, CFO on 1-15, and Caren Baker, EVP on 1-16
  • no actual, rumored or suspected fraud per inquiry of Anne (when the workpapers already show that the primary contact you have during the review is with Anne, the controller)

As allowed by SSARS 19, you can prepare the comment however you wish based on your professional judgment, but you really do need to document management’s response.

Documentation for a review can be located outside the review workpapers

One creative idea for your documentation – SSARS 19 has a helpful comment that the documentation for a review can rely on documents outside of that particular engagement.

The specific examples mentioned in SSARS 19 are other engagement files, quality control files, or consultation services.  This means documentation for your current review could be in another review or comp file or in a file of consultation discussions or projects.

Let’s say you are providing monthly or quarterly compilations to a client and then perform a review at the end of the year.  If there is a calculation you have to review for every compilation, then you probably have one worksheet that you roll forward every time you provide a compilation.  When you get to the annual review, you could roll that other workpaper forward again and use that workpaper as a part of the review.  The workpaper in the monthly comp file would be acceptable as documentation for the review.  You do not have to duplicate that workpaper in the review file.

It would probably be a really good idea to include a cross-reference to the other workpaper in your current review.  If you rolled that workpaper forward to the review in following years, you should keep in mind the timeline for document retention.

Oral explanations as documentation in a review under SSARS 19

SSARS 19 places some limits on how oral explanations can be used as documentation in a review.  It says an oral explanation just by itself is not sufficient support for the work performed during a review.  Oral explanations can be used to clarify or explain information that is already in the documentation.

What does that mean?  If there is nothing in your workpapers to support a particular procedure, analytical, or inquiry, then you cannot provide an oral explanation that you really did the procedure or reached the conclusion or got an acceptable response to the inquiry.  On the other hand, if what is already documented in your workpapers is unclear, incomplete, or just a little fuzzy, then you could provide an oral explanation to fill in the details.

What you can’t do is be in a situation where there is nothing in the workpapers and then come back and say you really did such-and-such procedure.

The ironic thing is that you would be in far better position for a confused, fuzzy, or illogical comment in the workpaper than for there to be nothing.  If there is anything in the workpapers, then an oral explanation would be allowed.

This could cause you problems in a peer review or internal inspection situation.  If there is nothing in the workpapers to address a particular inquiry, odd analytical or obviously odd relationship in the financials,  then the peer reviewer can not entertain your oral explanation to address the issue.  Not good.

Even worse.  Imagine being in a deposition and getting shut down by opposing counsel about some significant inquiry or analytical with you sputtering, “but I got a good answer to the question”.  Not a good place to be.

Far better to have something, anything in the workpapers.

Other posts on documentation for a compilation are here, for a review start here.

Written by Jim Ulvog

February 20, 2011, 15:11 pm at 3:11 pm

One Response

Subscribe to comments with RSS.

  1. […] Attestation Update  — A&A for CPAs blog has several posts about the SSARS 19 documentation requirements for compilation and reviews.  I would encourage you […]

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: