Expertise Beyond the Numbers

Breaking Down the 2018 Changes to the Yellow Book Standards for Performance Audits

Nothing is music to the ears of standard-loving professionals like revisions to the Yellow Book standards—principles that hadn’t been updated since 2011.

Last year, the Government Auditing Standards (GAS) issued by Comptroller General of the United States, known as the Yellow Book, published revised standards[1], superseding the last GAS edition in 2011 and declaring that performance audits beginning on or after July 1, 2019 are subject to the new standards.

While is this huge news in the performance audit world, it’s not always common knowledge across the risk management space, so let’s unpack the “glossary” a bit to provide the proper context.

What is a performance audit?

In short, a performance audit is similar to an internal audit, but conducted for governmental entities. The nature of the audit types is similar, however each align with different standards: performance audits with Yellow Book, and internal audits with the International Standards for the Professional Practice of Internal Auditing from the Institute of Internal Auditors (IIA). In fact the IIA published supplemental guidance in 2012 that compared the two audit types titled, “Supplemental Guidance: IIA International Standards/Government Audit Standards (GAGAS) – A Comparison, 2nd Ed.[2]” While this comparison is based on the 2011 Yellow Book edition, the comparisons still provide a wealth of information.

Per Yellow Book, “Performance audits provide objective analysis, findings, and conclusions to assist management and those charged with governance and oversight with, among other things, improving program performance and operations, reducing costs, facilitating decision making by parties responsible for overseeing or initiating corrective action, and contributing to public accountability.”

Similar to internal audits, performance audits have different objectives based on the specific scope of work. Yellow Book states it well, “Performance audit objectives vary widely and include assessments of program effectiveness, economy, and efficiency; internal control; compliance; and prospective analyses.”

Or in short, as I like to put it: VALUE. This is one of the many reasons performance audit are so interesting; they can differ in scope and focus on providing the most value to the governmental entity.

Yellow Book has been updated and your upcoming performance audits need to continue aligning with the standards. What next? The following are suggestions on transitioning to the new edition.  We won’t get too technical today; let’s focus on audit process updates.

Organization: This one is more of an exercise for your audit approach. 2018 Yellow Book updated/clarified its content and reorganized the chapters and sections. For instance:

  1. The standards contain different/updated information in certain sections.
  2. The standards now separate and organize the actual requirements vs. guidance on how the requirements should be applied during audit engagements.
  3. Performance audits are now chapters 8 (fieldwork) and 9 (reporting), vs. 6 and 7 in the 2011 edition.

Internal control: The standards build upon internal control application during performance audits. Internal control considerations do exist in both editions. However, the 2018 edition includes updates to fieldwork and reporting chapters. In summary, these include:

  1. Considering internal control deficiencies when developing “cause” when identifying findings.
  2. Identifying within the scope of the performance audit which components of internal controls and underlying principles are significant to the audit objectives.

Waste: This relates to both financial audits and performance audits. With the focus being performance audits, the following are updates to the standards:

  1. Waste is now specifically defined as, “The act of using or expending resources carelessly, extravagantly, or to no purpose. Waste can include activities that do not include abuse and does not necessarily involve a violation of law.”
  2. Waste is now included in the fieldwork procedures along with abuse. Similar to abuse:
    1. Due to the subjectivity of determining waste, auditors are not required to perform specific procedures to detect it. However, auditors may consider communicating waste if they become aware of it.
    2. Auditors may discover that waste may suggest fraud or noncompliance with laws, regulations, etc.

To Do:

An overall reassessment of your practices will help ensure you align with the revised requirements. You should map your prior process (2011 edition) with the new process (2018 edition). While many of the sections contain the same/similar terminology and content, requirements are refined and the numbering schemes are reorganized. Further, you should evaluate your current audit procedures and determine if you need to adjust your methodology and audit approach.

These are not the only items to consider. Additional updates to the 2018 Yellow Book include revised independence requirements, management assertions, and audit criteria; however, the above-mentioned should get you started on an effective transition.

If you’re interested in learning more about how SC&H can help ensure your organization’s continued adherence to the revised standard, please reach out to a member of our Risk Management team today.