Attest Documentation

GAO-03-673G Government Auditing Standards > Chapter 6 General, Field Work, and Reporting Standards for Attestation Engagements > Attest Documentation

6.22 The standard related to attest documentation for attestation engagements performed in accordance with GAGAS is:

Attest documentation related to planning, conducting, and reporting on the attestation engagement should contain sufficient information to enable an experienced auditor who has had no previous connection with the attestation engagement to ascertain from the attest documentation the evidence that supports the auditors’ significant judgments and conclusions. Attest documentation should contain support for findings, conclusions, and recommendations before auditors issue their report.

6.23 AICPA standards and GAGAS require that auditors prepare and maintain attest documentation. The form and content of attest documentation should be designed to meet the circumstances of the particular attestation engagement. The information contained in attest documentation constitutes the principal record of the work that the auditors have performed in accordance with professional standards and the conclusions that the auditors have reached. The quantity, type, and content of attest documentation are a matter of the auditors’ professional judgment.

6.24 Attest documentation serves to (1) provide the principal support for the auditors’ report, (2) aid auditors in conducting and supervising the attestation engagement, and (3) allow for the review of the quality of the attestation engagement. The preparation of attest documentation should be appropriately detailed to provide a clear understanding of its purpose and source and the conclusions the auditors reached, and it should be appropriately organized to provide a clear link to the findings, conclusions, and recommendations contained in the auditors’ report. Attest documentation for attestation engagements performed under GAGAS should contain the following additional items not explicitly addressed in the AICPA SSAEs or elsewhere in GAGAS:

a. the objectives, scope, and methodology of the attestation engagement, including any sampling and other selection criteria used;

b. the auditor’s determination that certain additional government auditing standards do not apply or that an applicable standard was not followed, the reasons therefor, and the known effect that not following the applicable standard had, or could have had, on the attestation engagement;

c. the work performed to support significant judgments and conclusions, including descriptions of transactions and records examined;¹

d. the auditors’ consideration that the planned attestation procedures are designed to achieve objectives of the attestation engagement when evidential matter obtained is highly dependent on computerized information systems and is material to the objective of the engagement, and the auditors are not relying on the effectiveness of internal control over those computerized systems that produced the information. The attest documentation should specifically address (1) the rationale for determining the nature, timing, and extent of planned audit procedures; (2) the kinds and competence of available evidential matter produced outside a computerized information system, and/or plans for direct testing of data produced from a computerized information system; and (3) the effect on the attestation engagement report if evidential matter to be gathered does not afford a reasonable basis for achieving the objectives of the engagement; and

e. evidence of supervisory reviews, before the report on the attestation engagement is issued, of the work performed that supports findings, conclusions, and recommendations contained in the report.

6.25 Underlying GAGAS attestation engagements is the premise that federal, state, and local governments and other organizations cooperate in auditing programs of common interest so that auditors may use others’ work and avoid duplication of efforts. Auditors should make arrangements to make attest documentation available, upon request, in a timely manner to other auditors or reviewers. Contractual arrangements for GAGAS attestation engagements should provide for full and timely access to attest documentation to facilitate reliance by others on the auditors’ work.

6.26 Audit organizations need to adequately safeguard the audit documentation associated with any particular engagement. Audit organizations should develop clearly defined policies and criteria to deal with situations where requests are made by outside parties to obtain access to audit documentation, especially in connection with situations where an outside party attempts to obtain indirectly through the auditor information that it is unable to obtain directly from the audited entity. In developing such policies, audit organizations need to consider applicable laws and regulations applying to the audit organizations or the audited entity.

1Auditors may meet this requirement by listing voucher numbers, check numbers, or other means of identifying specific documents they examined. Auditors are not required to include copies of documents they examined as part of the attest documentation, nor are auditors required to list detailed information from those documents.