The 2003 revision of Government Auditing Standards (GAS) introduced several changes that affect how we conduct peer reviews. The peer review committee reviewed and evaluated the changes before issuing the updated peer review guide. The most significant changes expanded the scope of peer review – both in the types of work and types of procedures and supporting documents we review.

GAS now defines and prescribes standards for conducting attestation engagements and nonaudit services as well as financial and performance audits. GAS also recognizes that organizations may be conducting other types of work – such as investigations – that do not fall into any of these categories. GAS requires auditors to use professional judgment when deciding what types of work to do and what standards to apply (GAS 3.35). Because GAS has expanded the types of work that are covered by standards, peer review teams will be looking at the different types of work a shop is doing rather than focusing solely on audits.

• More disclosure of types of work performed is required. GAS specifically requires organizations undergoing a peer review to disclose to the peer review team all nonaudit services related to the engagements selected for review and to make the required documentation available for review (GAS 3.17 g). Our process goes a step further and requires the audit organization to describe its body of work, including nonaudit services and other types of work, to the peer review team before the team selects engagements for review. In this way, the team can better select a representative sample of engagements and types of work conducted throughout the review period.

• Peer review teams could review nonaudit work. If the organization under review conducts a material amount of nonaudit work, we recommend the peer review team review audits with related nonaudit work as part of its sample. We also recommend the team consider reviewing documentation for nonaudit work that isn’t related to audits in order to test whether the organization applied and documented the required safeguards.

• Peer review teams could review other types of work. “Other types of work” refers to work that doesn’t meet the definitions of audit, attestation or nonaudit services. In general, the team would not need to review other work if it is a small amount of the organization’s overall body of work and the organization has clear policies that describe how it decides whether GAS are applicable. In cases where the audit organization is conducting a substantial amount of work for which it has determined that GAS do not apply, the team should consider limited testing to assess whether standards really should be applicable.

GAS now requires audit organizations to have a process for recruiting, hiring, continuously developing and evaluating staff as part of the competence standard (GAS 3.40). GAS recognizes that the nature, extent and formality of the processes will vary depending on factors such as the size and structure of the organization.

• Additional policies and files are subject to review. Peer review teams will review personnel policies as well as audit policies. Teams may also spot check personnel management files related to hiring, evaluating and assigning employees.

The GAS revision provided more detail about what is required of peer review members and methods they should use for conducting a peer review.

• Peer reviewers need knowledge on how to conduct a peer review. GAS now requires each member of a peer review team to have knowledge on how to perform a peer review, which may be gained from on-the-job-training or training courses (GAS 3.53 a). We have revised our Independence and Qualifications Statement form to reflect this requirement. The peer review committee offers a training course in conjunction with ALGA’s annual conference. We have also worked with the education committee to develop a web-based video course in how to prepare for and conduct a peer review. Review coordinators often recruit peer review teams from class rosters.

• Reviewing policies and procedures and interviewing staff are required. GAS requires peer review teams to review: the audit organizations’ internal quality control policies and procedures; related monitoring procedures; a sample of audit and attestation engagement reports; audit and attestation documentation; and other records as necessary. The team is also required to interview various levels of the audit organization’s professional staff to assess their understanding of and compliance with relevant quality control procedures (GAS 3.54 a). Our peer review process has always followed these methods. We reiterate these requirements in the updated peer review guide.

Revisions related to independence and nonaudit services apply to all audits started after January 1, 2003. Nonaudit services that were completed prior to January 25, 2002, or initiated by June 30, 2002, and completed before June 30, 2003, were exempted from the requirement. The remaining revised standards are applicable for financial audits and attestation engagements of periods ending on or after January 1, 2004, and for performance audits beginning on or after January 1, 2004.

• Review periods could cover more than one set of standards. Our peer review guide covers the 2003 Revision. We have engagement review forms based on the 1994 Revision of GAS available. Reviewers should be aware of the standards that were in effect for different engagements that they are reviewing. Coordinators are recruiting experienced teams to work on peer reviews that cover several iterations of standards. Coordinators and committee members are available to answer questions before, during, and after the review.

So what do all of these changes mean on a practical level? Shops undergoing reviews can expect to take a little more time to prepare for the review and during the site visit. Reviewers will be asking more questions and reviewing some additional records, even for shops that have had several reviews. Two-person peer review teams may not be practical. The team leader can expect to have less time to review engagements. The team will need to prepare as much as possible in advance of the site visit, consider materiality in testing, and communicate frequently with each other and with the organization under review.