Does your team need more firepower to audit analytics?

Do you have the technical knowledge to conduct an audit of an analytic dashboard?  If not, you should go get it as soon as possible.  As of February 2017, all the most used audit standards allow us to bring specialists into our audit teams to train and enhance our capabilities.  If your team finds itself in need of some technical knowledge, find an expert and learn from them!

Standard: Yellow Book (Generally Accepted Government Auditing Standards)

Summary: Yellow Book audit standards are general standards that apply to financial, performance, and attestation agreements for both internal and external audits.  Yellow Book allows audit managers to staff their teams with “specialists” during planning to enhance the collective knowledge of the team.  Did you know that the Yellow Book even credits two specialists as members of their own team for writing those veru standards (Page 220)?

What the Yellow Book says:

General standards of the Yellow Book 3.72 state:

staff assigned to conduct an audit in accordance with GAGAS should collectively possess the technical knowledge, skills, and experience necessary to be competent for the type of work being performed before beginning work on that audit.

Section 3.72 D (4) then provides examples:

specialized audit methodologies or analytical techniques, such as the use of complex survey instruments, actuarial-based estimates, or statistical analysis tests, as applicable

In the performance audit chapter, Yellow Book Standards are even more specific at 6.42:

Some audits may necessitate the use of specialized techniques or methods that require the skills of a specialist.

And 6.45 elaborates on how audit management should staff audits to include specialists:

Audit management should assign sufficient staff and specialists with adequate collective professional competence to perform the audit.  Staffing an audit includes, among other things: (a) assigning staff and specialists with collective knowledge, skills, and experience appropriate for the job.

Standard: Red Book (International Standards for the Professional Practice of Internal Auditing)

Summary: The Red Book is an internal audit standard that applies to assurance services and advisory services that management structures to report within the organization.  The Red Book uses the term “External Service Provider” to define a person outside the organization that has specialized skills and experience in a particular discipline like analytics.  Red Book even allows for organizations to outsource their entire internal audit function to External Service Providers.

What the Red Book says:

Red Book defines an “External Services Provider” in the Glossary as:

A person or firm outside of the organization that has special knowledge, skill, and experience in a particular discipline.

Section 2050 enables the Chief Audit Executive to coordinate with and reply on the work of external service providers:

The chief audit executive should share information, coordinate activities, and relying upon the work of other internal and external assurance and service providers to ensure proper coverage and minimize duplication of efforts.

Standard: Clarified Generally Accepted Auditing Standards (GAAS)

Summary: The GAAS are financial audit standards issued by the American Institute of CPAs, the same organization that publishes Generally Accepted Accounting Practices.  The Securities and Exchange Commission requires the auditors of financial statements of publicly traded companies to follow GAAS.

What the GAAS says:  

 

AU-C Section 300, Planning an Audit, paragraph A18 provides auditors with the ability to seek specialists:

An auditor may decide to seek the assistance of a professional with specialized skills necessary to complete various aspects of the engagement.

AU-C Section 220 Quality Control for an Engagement Conducted in Accordance with Generally Accepted Auditing Standards, Section A22 allows obtaining specialized resources:

The engagement team may consult outside the firm (for example, when the firm lacks appropriate internal resources).

AU-C Section 620 Using the Work of an Auditor’s Specialist, Section .07 states:

If expertise in a field other than accounting or auditing is necessary to obtain sufficient appropriate audit evidence, the auditor should determine whether to use the work of an auditor’s specialist.

And paragraph A7 explains how specialized skills should be used when financial statements are prepared using skills other than accounting:

If the preparation of the financial statements involves the use of expertise in a field other than accounting, the auditor, who is skilled in accounting and auditing, may not possess the necessary expertise to audit those financial statements. The engagement partner is required by section 220 to be satisfied that the engagement team and any external auditor’s specialists who are not part of the engagement team, collectively, have the appropriate competence and capabilities to perform the audit engagement.

Standard: International Standards on Auditing (ISA)

Summary: The ISA are financial audit standards issued by the International Federation of Accountants.  The European Union requires financial audits to follow ISAs for all statutorily required audits.

What the ISA says:

ISA 220 Quality Control for an Audit of Financial Statements, paragraph A21 provides special steps to ensure technical consultants are effectively used:

Effective consultation on significant technical, ethical and other matters within the firm or, where applicable, outside the firm can be achieved when those consulted 1) Are given all the relevant facts that will enable them to provide informed advice; and 2) Have appropriate knowledge, seniority and experience.

And paragraph A22 of ISA 220 summarizes the need to consult to enhance the engagement team’s capabilities:

It may be appropriate for the engagement team to consult outside the firm, for example, where the firm lacks appropriate internal resources. They may take advantage of advisory services provided by other firms, professional and
regulatory bodies, or commercial organizations that provide relevant quality control services.

ISA 620 Using the Work of an Auditor’s Expert goes the furthest of all at Section .07 by allowing auditors to rely on the work of a non-auditor, given quality controls are used:

If expertise in a field other than accounting or auditing is necessary to obtain sufficient appropriate audit evidence, the auditor shall determine whether to use the work of an auditor’s expert.

And paragraph A7 explains how specialized skills may be used to prepare financial statements and reiterates ISA 220:

If the preparation of the financial statements involves the use of expertise in a field other than accounting, the auditor, who is skilled in accounting and auditing, may not possess the necessary expertise to audit those financial statements. The engagement partner is required by section 220 to be satisfied that the engagement team and any external auditor’s specialists who are not part of the engagement team, collectively, have the appropriate competence and capabilities to perform the audit engagement.

Please note that each of these standards require audit specialists to follow quality control processes and often require the specialist to implement some additional quality controls.  However, any expert with audit experience can easily document these additional controls.