Review Engagements
Compliance with Standards
Requirement: Compliance with Standards
7.70
GAGAS establishes requirements for review engagements in addition to the requirements for reviews contained in the AICPA’s SSAEs. Auditors should comply with the additional GAGAS requirements, along with the applicable AICPA requirements, when citing GAGAS in their review engagement reports.
Licensing and Certification
Requirements: Licensing and Certification
7.71
Auditors engaged to conduct review engagements in the United States who do not work for a government audit organization should be licensed CPAs, persons working for licensed certified public accounting firms, or licensed accountants in states that have multiclass licensing systems that recognize licensed accountants other than CPAs.
7.72
Auditors engaged to conduct review engagements of entities operating outside of the United States who do not work for a government audit organization should meet the qualifications indicated in paragraph 7.71, have certifications that meet all applicable national and international standards and serve in their respective countries as the functional equivalent of CPAs in the United States, or work for nongovernment audit organizations that are the functional equivalent of licensed certified public accounting firms in the United States.
Noncompliance with Provisions of Laws, Regulations, Contracts, and Grant Agreements
Requirement: Noncompliance with Provisions of Laws, Regulations, Contracts, and Grant Agreements
7.73
Auditors should extend the AICPA requirements concerning consideration of noncompliance with laws and regulations to include consideration of noncompliance with provisions of contracts and grant agreements.61
Reporting Auditors’ Compliance with GAGAS
Requirement: Reporting Auditors’ Compliance with GAGAS
7.74
When auditors comply with all applicable requirements for a review engagement conducted in accordance with GAGAS, they should include a statement in the review report that they conducted the engagement in accordance with GAGAS.62
Application Guidance: Reporting Auditors’ Compliance with GAGAS
7.75
Because GAGAS incorporates by reference the AICPA’s attestation standards, GAGAS does not require auditors to cite compliance with the AICPA standards when they cite compliance with GAGAS. GAGAS does not prohibit auditors from issuing a separate report conforming only to the requirements of the AICPA or other standards setters.
7.76
Because review engagements are substantially less in scope than audits and examination engagements, it is important to include all required reporting elements contained in the standards used in conjunction with GAGAS. Including only those elements that the reporting standards for review engagements require or permit helps ensure that auditors comply with the standards and that users of GAGAS reports have an understanding of the nature of the work performed and the results of the review engagement.
Distributing Reports
Requirement: Distributing Reports
7.77
Distribution of reports completed in accordance with GAGAS depends on the auditors’ relationship with the audited organization and the nature of the information contained in the reports. If the subject matter or the assertion involves material that is classified or contains confidential or sensitive information, auditors should limit report distribution. Auditors should document any limitation on report distribution.
An audit organization in a government entity should distribute reports to those charged with governance, to the appropriate audited entity officials, and to the appropriate oversight bodies or organizations requiring or arranging for the engagements. As appropriate, auditors should also distribute copies of the reports to other officials who have legal oversight authority and to others authorized to receive such reports.
A public accounting firm contracted to conduct a review engagement in accordance with GAGAS should clarify report distribution responsibilities with the engaging party. If the contracting firm is responsible for the distribution, it should reach agreement with the party contracting for the engagement about which officials or organizations will receive the report and the steps being taken to make the report available to the public.