GAO-22-105894, Financial Audit Manual: Volume 1, June 2022

Financial Audit Manual

Volume 1

Updated May 2023

GAO-22-105894

COUNCIL OF THE INSPECTORS GENERAL

ON INTEGRITY AND EFFICIENCY

Page 1 GAO-22-105894 GAO/CIGIE Financial Audit Manual

June 2022

To Audit Officials, Federal Entity Chief Financial Officers, and Others Interested in Federal

Financial Auditing and Reporting

This letter transmits the U.S. Government Accountability Office (GAO) and the Council of the

Inspectors General on Integrity and Efficiency’s (CIGIE) revised Financial Audit Manual (FAM),

volumes 1 and 2. The FAM presents a methodology for performing financial statement audits of

federal entities in accordance with professional standards and consists of three volumes. FAM

volume 1 contains the audit methodology. FAM volume 2 provides detailed implementation

guidance. FAM volume 3 contains the Federal Financial Reporting Checklist, which has been

updated as of June 2022.

The current revision reflects changes in auditing financial statements in the U.S. government

since the last revisions of FAM volume 1 (issued in April 2020) and FAM volume 2 (issued in

March 2021). The revisions are primarily based on changes in (1) professional auditing

standards of the Auditing Standards Board of the American Institute of Certified Public

Accountants (Statements of Auditing Standards Nos. 134, 135, 137, 138, 140, and 141) and (2)

audit guidance in the Office of Management and Budget’s Bulletin No. 21-04, Audit

Requirements for Federal Financial Statements, issued on June 11, 2021. Users should also

consider any subsequently issued standards or guidance.

To help the FAM continue to meet the needs of the federal audit community and the public it

serves, GAO and CIGIE worked jointly to update the FAM. In May 2022, CIGIE distributed an

exposure draft of FAM volumes 1 and 2 for a comment period that ended May 31, 2022. All

comments we received were considered in the final FAM.

This revision supersedes previously issued versions of FAM volumes 1 and 2 and should be

used beginning with audits of fiscal year 2022 federal entity financial statements.

Should you need additional information, please contact us at [email protected].

Beryl H. Davis Hannibal “Mike” Ware

Managing Director Chair, Audit Committee

Financial Management and Assurance Council of the Inspectors General on

U.S. Government Accountability Office Integrity and Efficiency

Enclosures

Page 2 GAO-22-105894 GAO/CIGIE Financial Audit Manual

GAO Team

Project Team

Beryl H. Davis, Managing Director

Robert F. Dacey, Chief Accountant

Dawn B. Simpson, Director

Joshua Y. Marcus, Assistant Director

Carrie J. Morrison, Assistant Director

Lien T. To, Senior Auditor

Significant Contributors

Sharon O. Byrd, Audit Sampling Specialist

Lauren S. Fassler, Senior Attorney

CIGIE FAM Working Group Members

Kelly McFadden, Office of the Inspector General, U.S. Department of Justice

Anna Elias, Office of Inspector General, U.S. Agency for International Development

Sandra John, Office of Inspector General, U.S. Department of Homeland Security

Todd Jones, Office of Inspector General, U.S. Department of State

Financial Audit Manual Volume 1 – Summary of Significant Changes

Updated May 2023 GAO/CIGIE Financial Audit Manual Changes-1

Summary of Significant Changes

This summary lists significant changes from the June 2022 revision of FAM volume 1.

Change Description

Section or paragraph

reference

Replaced “legal letter” or “legal representation letter” with “legal

counsel response

.” Replaced “legal letter request” with “legal

counsel request

.” Replaced “legal letter materiality” with “legal

counsel materiality.”

Throughout

(primarily 230, 280,

550)

Deleted “taken” from “financial statements taken as a whole.”

Throughout

Added requirements related to changes in the terms of an audit

engagement.

215.24–.25

Revised language in sample audit engagement letters.

215 A

Revised guidance for determining materiality level(s) to be applied,

in specific circumstances

, to particular classes of transactions,

account balances, or note disclosures.

230.08

Revised and added guidance related to the Federal Managers’

Financial Integrity Act of 1982 (FMFIA).

260.67–.69, .72, .74

295 B.19

Reorganized section paragraphs.

280

Revised guidance related to litigation, claims, and assessments.

280.02–.05

550.01–.03

Revised guidance related to the Federal Financial Management

Improvement Act of 1996 (

FFMIA) and moved detailed guidance to

FAM 701 (volume 2).

295 B.19

350.23–.26

360.05

Clarified guidance related to multiple-location audits.

295 C.08e

Revised and added guidance related to inquiry, observation,

inspection

, recalculation, and external confirmation.

295 I.02g, I.08b

350.10–.12

470.08, .09, .14

475.02

Clarified guidance on IDEA inputs for monetary unit sampling.

480.23

495 D

Moved detailed guidance related to service organizations to

FAM 640 (volume 2).

310

Revised descriptions for commitment, expended authority, and

outlay.

395 E

Revised requirements and guidance based on Statement on Auditing

Standards

(SAS) No. 142, Audit Evidence.

410.01–.03, 420.03,

440.04–.05 , 470.08,

Glossary

Added guidance related to preliminary assessment of risks in the

testing phase.

470.01

Replaced “audit completion date” with “auditor’s report date.”

495 B.03

Updated selection methods flowcharts.

495 D

Financial Audit Manual Volume 1 – Summary of Significant Changes

Updated May 2023 GAO/CIGIE Financial Audit Manual Changes-2

Change Description

Section or paragraph

reference

Replaced “adequacy” with “appropriateness” when referring to audit

evidence.

530.06

Revised the Statement of Budgetary Resources section of the

further evaluation of audit risk template.

545 A

Deleted detailed guidance related to obtaining management

representations

that was already covered in FAM 1001 (volume 2)

and referred the auditor to FAM 1001 for additional guidance.

550.10

Added requirement to communicate to those charged with

governance

suspected noncompliance, and matters involving

identified or suspected noncompliance, with

contracts or grant

agreements.

550.16k, .16m

Added requirements related to comparative financial statements

and comparative information.

580.12, .13, .18, .20

Clarified guidance for inclusion of an alert in the auditor’s report on

compliance.

580.96

Revised guidance related to auditor’s report date, report release

date, and documentation completion date.

580.103–.109

590.03

Added documentation requirements for circumstances in which

the auditor (1) performs new or additional audit procedures

or draws

new conclusions

, after the auditor’s report date or (2) modifies

existing audit documentation

, or adds new audit documentation,

after

the documentation completion date.

590.02, .04

Revised language in auditor’s report examples.

595 A, 595 B

Revised or added definitions or terminology for

appropriateness,

audit documentation, audit evidence, audit file,

audit plan,

auditor’s report date, comparative financial statements,

comparative information, documentation completion date,

engagement letter, internal control over financial reporting,

management’s specialists, materiality for the financial statements as

a whole,

nonstatistical sampling, notification letter, overall audit

strategy,

probable, reasonably possible, reimbursable activity,

remote, reporting phase, report release date, service auditor,

and

sufficiency (of audit evidence).

Glossary

Added or revised the following abbreviations:

U.S. GAAP, U.S. GAAS

, USSGL, and Yellow Book

Abbreviations

CONTENTS

Contents of FAM Volume 1 – Audit Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Contents-1

Contents of FAM Volume 1 – Audit Methodology

100 INTRODUCTION

110 Overview of the FAM Methodology

200 PLANNING PHASE

210 Overview of the Planning Phase

215 Perform Preliminary Engagement Activities

220 Understand the Entity’s Operations

225 Perform Preliminary Analytical Procedures

230 Determine Materiality

235 Identify Significant Line Items, Accounts, and Assertions

240 Identify Significant Accounting Applications, Cycles, and Financial Management

Systems

245 Identify Significant Provisions of Applicable Laws, Regulations, Contracts, and

Grant Agreements

250 Identify Relevant Budget Restrictions

260 Identify Risk Factors

270 Determine Likelihood of Effective Information System Controls

275 Identify Relevant Operations Controls to Evaluate and Test

280 Plan Other Audit Procedures

285 Plan Locations to Test

290 Documentation

Appendixes to FAM 200

295 A Potential Inherent Risk Conditions

295 B Potential Control Environment, Entity Risk Assessment, Communication, and

Monitoring Deficiencies

295 C An Approach for Multiple-Location Audits

295 D Considerations for Performing Interim Substantive Testing

295 E Effect of Risk of Material Misstatement on Extent of Audit Procedures

295 F Types of Information System Controls

295 G Budget Controls

295 H List of General Laws

295 I Examples of Auditor Responses to Fraud Risks

295 J Steps in Assessing Information System Controls

300 INTERNAL CONTROL PHASE

310 Overview of the Internal Control Phase

320 Understand Information Systems

330 Identify Control Objectives

340 Identify and Understand Relevant Control Activities

350 Determine the Nature, Extent, and Timing of Tests of Controls and Compliance

with FFMIA

360 Perform Tests of Controls and Compliance with FFMIA

370 Assess Internal Control on a Preliminary Basis

Contents of FAM Volume 1 – Audit Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Contents-2

380 Other Considerations

390 Documentation

Appendixes to FAM 300

395 A Typical Relationships of Accounting Applications to Line Items/Accounts

395 B Financial Statement Assertions, Potential Misstatements, and Control Objectives

395 C Typical Control Activities

395 D Selected Statutes Relevant to Budget Execution

395 E Budget Execution Process

395 F Budget Control Objectives

395 G Specific Control Evaluation Worksheet

395 H Line Item Risk Analysis Form

400 TESTING PHASE

410 Overview of the Testing Phase

420 Design the Nature, Extent, and Timing of Further Audit Procedures

430 Design Tests

440 Perform Tests and Evaluate Results

450 Perform Sampling Control Tests

460 Perform Compliance Tests

470 Perform Substantive Procedures – Overview

475 Perform Substantive Analytical Procedures

480 Perform Substantive Detail Tests

490 Documentation

Appendixes to FAM 400

495 A Determine Whether to Perform Substantive Analytical Procedures

495 B Example Procedures for Tests of Budget Information

495 C Guidance for Interim Testing

495 D Selection Methods

500 REPORTING PHASE

510 Overview of the Reporting Phase

520 Perform Overall Analytical Procedures

530 Reassess Materiality and Risks of Material Misstatement

540 Evaluate Effects of Misstatements on Financial Statements and Auditor’s Reports

545 Audit Exposure (Further Evaluation of Audit Risk)

545 A Further Evaluation of Audit Risk Template

550 Perform Other Reporting Phase Audit Procedures

560 Determine Whether Financial Statement Presentation Is in Accordance with U.S.

Generally Accepted Accounting Principles

570 Determine Compliance with GAO/CIGIE Financial Audit Manual

580 Draft Reports

590 Documentation

Contents of FAM Volume 1 – Audit Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Contents-3

Appendixes to FAM 500

595 A Example Unmodified Auditor’s Reports

595 B Example of Reporting Material Weakness or Significant Deficiency on Internal

Control over Financial Reporting

595 C Uncorrected Misstatements and Adjusting Entries

GLOSSARY

ABBREVIATIONS

SECTION 100

Introduction

100 – Contents of the Introduction

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 100-1

Contents of the Introduction

Introduction FAM

• Overview of the FAM Methodology 110

Planning Phase FAM

• Overview of the Planning Phase 210

• Perform Preliminary Engagement Activities 215

• Understand the Entity’s Operations 220

• Perform Preliminary Analytical Procedures 225

• Determine Materiality 230

• Identify Significant Line Items, Accounts, and Assertions 235

• Identify Significant Accounting Applications, Cycles, and Financial Management Systems 240

• Identify Significant Provisions of Applicable Laws, Regulations, Contracts, and Grant Agreements 245

• Identify Relevant Budget Restrictions 250

• Identify Risk Factors 260

• Determine Likelihood of Effective IS Controls 270

• Identify Relevant Operations Controls to Evaluate and Test 275

• Plan Other Audit Procedures 280

• Plan Locations to Test 285

• Documentation 290

Internal Control Phase FAM

• Overview of the Internal Control Phase 310

• Understand Information Systems 320

• Identify Control Objectives 330

• Identify and Understand Relevant Control Activities 340

• Determine the Nature, Extent, and Timing of Tests of Controls and Compliance with FFMIA 350

• Perform Tests of Controls and Compliance with FFMIA 360

• Assess Internal Control on a Preliminary Basis 370

• Other Considerations 380

• Documentation 390

Testing Phase FAM

• Overview of the Testing Phase 410

• Design the Nature, Extent, and Timing of Further Audit Procedures 420

• Design Tests 430

• Perform Tests and Evaluate Results 440

• Perform Sampling Control Tests 450

• Perform Compliance Tests 460

• Perform Substantive Procedures -- Overview 470

• Perform Substantive Analytical Procedures 475

• Perform Substantive Detail Tests 480

• Documentation 490

Reporting Phase FAM

• Overview of the Reporting Phase 510

• Perform Overall Analytical Procedures 520

• Reassess Materiality and Risks of Material Misstatement 530

• Evaluate Effects of Misstatements on Financial Statements and Auditor’s Reports 540

• Audit Exposure (Further Evaluation of Audit Risk) 545

• Perform Other Reporting Phase Audit Procedures 550

• Determine Whether Financial Statement Presentation is in Accordance with U.S. GAAP 560

• Determine Compliance with GAO/CIGIE Financial Audit Manual 570

• Draft Reports 580

• Documentation 590

Introduction

110 – Overview of the FAM Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 110-1

110 – Overview of the FAM Methodology

.01 This introduction provides an overview of the methodology of the Government

Accountability Office (GAO) and the Council of the Inspectors General on

Integrity and Efficiency (CIGIE) for performing financial statement audits of

federal entities. It describes how the methodology in the Financial Audit Manual

(FAM) relates to relevant professional auditing and attestation standards and

Office of Management and Budget (OMB) audit guidance and outlines key issues

to be considered in using the methodology.

.02 The purposes of performing financial statement audits of federal entities include

• providing decision makers (financial statement users) with assurance as to

whether the financial statements are reliable (presented fairly in all material

respects, in accordance with U.S. generally accepted accounting principles

(U.S. GAAP));

• reporting deficiencies in internal control over financial reporting or, in certain

circumstances, providing an opinion on the effectiveness of internal control

over financial reporting; and

• reporting on noncompliance with significant provisions of applicable laws,

regulations, contracts, and grant agreements (see FAM 245 for guidance on

identifying such provisions).

To achieve these purposes, the FAM approach to federal financial statement

audits involves four phases—planning, internal control, testing, and reporting—

which are outlined in the rest of this section. In broad terms, the auditor does the

following:

• adequately plans the audit to obtain sufficient appropriate evidence;

• understands the design of the entity’s internal control, determines

whether the controls were implemented as designed, assesses the risks

of material misstatement, designs appropriate tests of controls and

substantive procedures, and for the 24 Chief Financial Officers Act of

1990 (CFO Act) agencies, determines whether financial management

The OMB audit guidance in effect as of the publication date of this version of the FAM is OMB Bulletin No. 22-01,

Audit Requirements for Federal Financial Statements, issued on August 26, 2022. OMB audit guidance is periodically

updated, and the current version can be found on the OMB website at https://www.whitehouse.gov/omb/bulletins

(accessed on May 1, 2023).

The American Institute of Certified Public Accountants (AICPA) has recognized the Federal Accounting Standards

Advisory Board (FASAB) as the accounting standards-setting body for federal government entities under the AICPA's

Code of Professional Conduct. Thus, FASAB standards are recognized as U.S. GAAP for federal entities. Statement

of Federal Financial Accounting Standards (SFFAS) 34, The Hierarchy of Generally Accepted Accounting Principles,

Including the Application of Standards Issued by the Financial Accounting Standards Board, establishes the U.S.

GAAP hierarchy for federal reporting entities. SFFAS 34 recognizes that it is appropriate for certain federal reporting

entities to prepare and publish financial reports pursuant to the accounting and reporting standards issued by the

Financial Accounting Standards Board (FASB). SFFAS 34 provides that financial statements prepared in conformity

with accounting standards issued by FASB also may be regarded as in conformity with U.S. GAAP for such entities.

SFFAS 47,

Reporting Entity, allows consolidation entities (that is, the consolidated government-wide reporting entity

or consolidated component reporting entity) to consolidate component or subcomponent reporting entity financial

statements prepared in accordance with FASB under SFFAS 34 without conversion for any differences in accounting

policies among the audit organizations.

Introduction

110 – Overview of the FAM Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 110-2

systems comply substantially with the three requirements of the Federal

Financial Management Improvement Act of 1996 (FFMIA):

º federal financial management systems requirements,

º applicable federal accounting standards, and

º the U.S. Standard General Ledger at the transaction level;

• tests the significant assertions related to the financial statements, internal

control effectiveness, and compliance with significant provisions of

applicable laws, regulations, contracts, and grant agreements (see FAM

235.04 for further details); and

• reports the results of audit procedures performed and performs other

audit procedures to complete the audit in accordance with generally

accepted government auditing standards (GAGAS).

The FAM audit phases are illustrated in the FAM methodology overview in the

contents and are summarized in the following pages of this section.

Planning Phase

.03 Although planning continues throughout the audit, the objectives of this phase

are to gain an understanding of the entity to be audited; to understand its

environment, including internal control; to identify significant areas for audit; and

to design effective and efficient audit procedures. To accomplish this, the

methodology includes guidance in the following:

a. performing preliminary engagement activities relating to (1) acceptance and

continuance of client relationships and audit engagements; (2) compliance

with relevant ethical requirements; and (3) establishing an understanding of

the terms of the engagement with management and, when appropriate, those

charged with governance, including establishing that certain preconditions for

an audit are present;

b. understanding the entity’s operations and its environment, including its

organization, management style, internal control, and internal and external

factors influencing its operating environment;

c. performing analytical procedures to assist in planning the audit;

d. identifying significant accounting applications, cycles, and financial

management systems; relevant budget restrictions; significant provisions of

applicable laws, regulations, contracts, and grant agreements; and relevant

internal controls;

e. determining the likelihood of effective information system (IS) controls;

f. identifying significant items, accounts, and assertions and using them in

planning the audit;

Testing for substantial compliance with FFMIA’s three financial management systems requirements is efficiently

accomplished, for the most part, as part of the work done in understanding entity systems in the internal control

phase of the audit.

The methodology presented is for a financial statement audit. If the auditor is to use the work of another auditor, see

FAM 600 sections.

Introduction

110 – Overview of the FAM Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 110-3

g. determining materiality for the financial statements as a whole, including

performance materiality, which is the portion of materiality that the auditor

allocates to line items, accounts, or classes of transactions;

h. performing a preliminary risk assessment to determine the risk of material

misstatement due to error or fraud; and

i. establishing the overall audit strategy and developing an audit plan, including

entity field locations to test.

Based on evidence obtained throughout the audit, the auditor should monitor and

revise, if needed, preliminary assessments made during the planning phase for

risk of material misstatement and the likelihood of control effectiveness. The

auditor should revise audit procedures as needed.

Internal Control Phase

.04 This phase entails understanding, testing, and assessing internal control over

financial reporting to conclude on whether the following internal control

objectives have been achieved:

• Reliability of financial reporting—transactions are properly recorded,

processed, and summarized to permit the preparation of the financial

statements in accordance with U.S. GAAP, and assets are safeguarded

against loss from unauthorized acquisition, use, or disposition.

• Compliance with significant provisions of applicable laws,

regulations, contracts, and grant agreements—transactions are

executed in accordance with significant provisions of applicable laws,

including those governing the use of budget authority, regulations

contracts, and grant agreements, noncompliance with which could have a

material effect on the financial statements.

.05 According to OMB audit guidance, for those controls that have been suitably

designed and implemented, the auditor should perform sufficient tests of such

controls to conclude whether the controls are operating effectively (i.e.,

sufficient tests of controls to support a low level of assessed control risk).

OMB audit guidance does not require the auditor to express an opinion on

the effectiveness of internal control.

As required by GAGAS (2018) 6.42, if the auditor does not express an opinion on

internal control, the auditor should state in the report whether tests performed

provided sufficient, appropriate evidence to express an opinion on the

effectiveness of internal control over financial reporting.

GAO auditors

should design the audit to express an opinion on internal

control over financial reporting.

For audits that GAO performs, the internal

The FAM refers specifically to objectives for GAO auditors in various sections. Such objectives are optional for other

audit organizations.

If the auditor plans to report on internal control effectiveness, the AICPA’s Clarified Statement on Auditing Standards

(AU-C) 940 allows the auditor to express an opinion directly on internal control or on management’s assessment

about the effectiveness of internal control over financial reporting. However, when internal control is not effective

because one or more material weaknesses exist, the auditor is prohibited from expressing an opinion on

management’s assessment and should report directly on the effectiveness of internal control over financial reporting.

The example 1 auditor’s report in FAM 595 A illustrates expressing an opinion on internal control directly.

Introduction

110 – Overview of the FAM Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 110-4

control testing described in the OMB audit guidance and in the FAM typically

is sufficient to provide an opinion on internal control effectiveness. Sufficiency

and appropriateness of audit evidence is a matter of auditor judgment.

.06 The FAM also provides guidance on evaluating internal controls related to

operating objectives that the auditor elects to evaluate. Such controls include

those related to safeguarding assets from waste or preparing statistical reports.

.07 To evaluate internal control, the auditor identifies and understands the

relevant controls and tests their effectiveness. Where the auditor determines

controls to be effective, the extent of substantive procedures can be reduced.

.08 The FAM also includes guidance on

• assessing specific levels of control risk;

• selecting controls to test;

• determining the effectiveness of IS controls; and

• testing controls, including coordinating control tests in the testing phase

for efficiency.

.09 Also, during the internal control phase, in regard to FFMIA, auditors should follow

OMB audit guidance, if applicable.

Testing Phase

.10 The objectives of this phase are to (1) obtain reasonable assurance about

whether the financial statements are presented fairly, in all material respects,

in accordance with U.S. GAAP; (2) determine whether the entity complied

with significant provisions of applicable laws, regulations, contracts, and grant

agreements; and (3) assess the effectiveness of internal control over financial

reporting through testing controls, often in coordination with other tests.

.11 To achieve these objectives, the FAM includes guidance on

• designing and performing substantive, compliance, and control tests;

• designing and evaluating audit samples;

• correlating risk of material misstatement, audit risk, and materiality with

the nature, timing, and extent of substantive procedures; and

• designing multipurpose tests that use a common sample to test several

different controls, specific accounts or transactions, and audit assertions.

Although the FAM distinguishes between internal control objectives related to reliability of financial reporting and to

compliance with significant provisions of applicable laws, regulations, contracts, and grant agreements, compliance

controls tested as part of federal financial statement audits are limited to controls over compliance with selected

significant provisions of laws, regulations, contracts, and grant agreements applicable to the entity that have a direct

effect on the determination of material amounts and disclosures in the entity’s financial statements. Consequently,

compliance controls in federal financial statement audits are considered to be the equivalent of financial reporting

controls for purposes of reporting on control effectiveness.

Introduction

110 – Overview of the FAM Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 110-5

Reporting Phase

.12 This phase completes the audit based on the results of audit procedures

performed in the preceding phases. This involves developing the auditor’s report

on the entity’s

• financial statements, required supplementary information (RSI) (including

management’s discussion and analysis (MD&A)), and other information

included in the annual report;

• internal control over financial reporting;

• financial management systems’ substantial compliance with the three FFMIA

requirements (for CFO Act agencies); and

• compliance with significant provisions of applicable laws, regulations,

contracts, and grant agreements.

To assist in this process, the FAM includes guidance on forming an opinion on

the financial statements and conclusions on internal control, as well as reporting

findings. Included in FAM 595 A are two examples of auditor’s reports. The first

example shows when the auditor expresses an opinion on internal control, and

the second when the auditor issues a report on internal control.

Relationship to Applicable Standards

.13 This section describes the FAM’s relationship to applicable auditing

standards, OMB audit guidance, and other policy requirements. This section

is organized into three areas:

• relevant auditing standards and OMB audit guidance,

• audit guidance beyond the Government Auditing Standards (also known

as GAGAS or the Yellow Book) issued by the Comptroller General of the

United States, and

• auditing standards and policies not addressed in this manual.

Relevant Auditing Standards and OMB Audit Guidance

.14 The FAM provides a framework for performing financial statement audits of

federal entities in accordance with GAGAS and OMB audit guidance. GAGAS

incorporates, by reference, U.S. generally accepted auditing standards (U.S.

GAAS) and attestation standards established by the Auditing Standards Board of

the American Institute of Certified Public Accountants (AICPA). The Yellow Book

is available at www.gao.gov

.15 The FAM is an audit methodology that both integrates the requirements of the

standards and provides implementation guidance based on practical

experience. The FAM is designed to achieve the following:

• Effective audits, by considering compliance with GAGAS; significant

provisions of applicable laws, regulations, contracts and grant

agreements; and OMB audit guidance.

• Efficient audits, by focusing audit procedures on areas of higher risk and

materiality and by providing an integrated approach designed to gather

audit evidence efficiently.

Introduction

110 – Overview of the FAM Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 110-6

• Quality control, through an agreed-upon framework that is documented

and that all personnel can follow.

• Consistency of application, through a documented methodology.

.16 The FAM supplements GAGAS and OMB audit guidance and includes

references to the AICPA’s Clarified Statements on Auditing Standards (AU-C)

and Clarified Statements on Standards for Attestation Engagements (AT-C). The

AU-C references cited in the FAM are based on standards issued by the AICPA

through Statement on Auditing Standards (SAS) No. 141. These references may

differ from current references which are based on SASs issued subsequent to

SAS No. 141. The AICPA standards are incorporated by reference into GAGAS.

Audit Guidance beyond GAGAS

.17 In addition to complying with GAGAS, for audits to which OMB audit guidance

applies, the auditor should

• perform sufficient tests of internal controls over financial reporting that

have been suitably designed and implemented to support a low level of

assessed control risk;

• evaluate and test controls related to budget execution and compliance

with selected significant provisions of applicable laws, regulations,

contracts, and grant agreements;

• understand the design of the entity’s process for complying with

31 U.S.C. § 3512 (c), (d) (commonly known as the Federal Managers’

Financial Integrity Act of 1982) and whether the design has been

implemented;

• perform tests to report on the entity’s financial management systems’

substantial compliance with the three FFMIA requirements, as required by

OMB audit guidance (for CFO Act agencies);

• test for compliance with significant provisions of applicable laws,

regulations, contracts, and grant agreements;

• read the required supplementary information, including management’s

discussion and analysis, for conformity with Federal Accounting

Standards Advisory Board standards and OMB reporting guidance;

and

• read the other information for conformity with OMB reporting guidance.

.18 Auditors may design procedures to consider and report whether

misstatements and internal control weaknesses could affect the achievement

of operations objectives or the accuracy of reports prepared by the entity.

.19 GAO auditors generally should design audits to express an opinion on the

entity’s internal control over financial reporting. When an auditor is engaged to

perform an audit of internal control over financial reporting that is integrated with

an audit of financial statements, it is referred to as an integrated audit. AU-C 940

The OMB reporting guidance in effect as of the publication date of this version of the FAM is OMB Circular No. A-

136, Financial Reporting Requirements, issued on June 3, 2022. OMB reporting guidance is updated annually and

the current version can be found on the OMB website at https://www.whitehouse.gov/omb/information-for-

agencies/circulars/ (accessed on May 1, 2023).

Introduction

110 – Overview of the FAM Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 110-7

addresses integrated audits and certain requirements have been included in the

FAM, but auditors should refer to AU-C 940 as needed for more detailed

guidance.

Auditing Standards and Policies Not Addressed in the Manual

.20 The FAM supplements financial audit standards and policies that GAO and the

inspectors general (IG) have adopted. It is not intended to address all standards

or policies. For example, report processing is not addressed. Further, IGs may

use other methodologies that are equivalent to the FAM for conducting financial

statement audits in accordance with GAGAS, including AICPA auditing standards

and OMB audit guidance.

.21 Throughout the FAM, there are references to various laws, regulations, OMB

audit guidance, and other government requirements that are subject to

change periodically. Auditors should monitor any changes and ensure that

they are using the most updated versions.

Key Implementation Considerations

.22 In applying the FAM, the auditor considers

• audit objectives;

• exercise of professional judgment and professional skepticism;

• form, content, and extent of audit documentation;

• references to positions;

• using the work of others;

• compliance with policies in the FAM;

• use of technical terms; and

• reference to sections of the FAM.

These items are discussed in more detail below.

Audit Objectives

.23 For audits of entities not subject to OMB audit guidance, the auditor should

evaluate whether to conduct those audits in accordance with OMB audit

guidance to achieve the audits’ objectives. The FAM generally assumes that

the objectives of an audit are to express an opinion on the current-year

financial statements as part of a 2-year opinion on comparative financial

statements, to issue a report (or opinion) on internal control over financial

reporting, and to issue a report on compliance. When these are not the

objectives, the auditor uses judgment in applying the FAM guidance. In some

circumstances, the auditor may expect to issue a disclaimer on the current-

year financial statements because of scope limitations, including the

auditability of information. In these circumstances, the auditor may develop a

Under the CFO Act, as amended, an IG may perform the agency’s financial statements audit with OIG staff or

contract the audit to an independent external auditor (IPA firm). See FAM 670, IG Oversight of Audits Performed by

Contracted IPA Firms, for details.

Introduction

110 – Overview of the FAM Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 110-8

multiyear plan in order to express a future opinion when the financial

statements are expected to become auditable.

Exercise of Professional Judgment and Professional Skepticism

.24 The auditor should exercise professional judgment in planning and

performing an audit of the financial statements (AU-C 200.18), including in

evaluating the quantity and quality of audit evidence, and thus its sufficiency

and appropriateness, in determining the audit opinion. Although the auditor

may find it necessary to rely on audit evidence that is persuasive rather than

conclusive to obtain reasonable assurance, the auditor must not be satisfied

with audit evidence that is less than persuasive. The auditor should tailor the

guidance in the FAM, if needed, to respond to specific situations encountered

during an audit. However, the auditor must, at a minimum, meet professional

standards. Proper application of professional judgment and skepticism may

result in more extensive audit work than described in the FAM. The auditor

should document these decisions.

.25 The auditor should plan and perform an audit with professional skepticism,

recognizing that circumstances may exist that cause the financial statements to

be materially misstated (AU-C 200.17). The auditor’s past experience, or a belief

that management and those charged with governance are honest and have

integrity, does not relieve the auditor of the need to maintain professional

skepticism (AU-C 200.A26 and 240.12). Professional skepticism includes

questioning contradictory audit evidence and the reliability of documents and

responses to inquiries (AU-C 200.A24). If the auditor believes that a document

may have been altered or is not authentic, then the auditor should investigate

further (AU-C 240.13).

.26 When exercising judgment, particularly when tailoring FAM guidance, the

component auditor should consider the needs of, and consult in a timely

manner with, the group auditors who plan to use the work being performed so

that the judgments exercised can satisfy the needs of both auditors. For

example, group auditors of a consolidated entity (such as the U.S.

government or an entire department or entity) are likely to plan to use the

work of component auditors of subsidiary entities (such as individual

departments and entities or bureaus and components of departments). This

coordination can result in more effective government audits and avoid

duplication of effort.

.27 Many aspects of a financial statement audit involve technical judgments. The

auditor is responsible for making these judgments. The audit organization

should have or contract for personnel with adequate technical expertise to

provide technical assistance to the auditor, including the following example

areas, as necessary:

a. quantifying materiality for the financial statements as a whole, performance

materiality, and using tolerable misstatement in determining the extent of

substantive sampling procedures (see FAM 230);

b. identifying risk factors to assess risks of material misstatement (see

FAM 260);

c. assessing the effectiveness of IS controls (see FAM 270);

Introduction

110 – Overview of the FAM Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 110-9

d. specifying a minimum level of substantive assurance based on the assessed

risk of material misstatement, substantive analytical procedures, and

substantive detail tests (see FAM 470, 475, and 480);

e. determining whether selections are statistical samples (representative of, and

statistically projectable to, the population), nonstatistical samples

(representative of, but not statistically projectable to, the population), or

nonstatistical selections (not representative of, and not projectable to, the

population) (see FAM 430);

f. using audit sampling methods, such as monetary unit sampling, classical

variables estimation sampling, or classical probability proportional to size

sampling, for substantive or multipurpose testing (including nonstatistical

sampling) (see FAM 480);

g. using audit sampling for control testing, other than attribute sampling, and

using the tables in FAM 450 to determine sample size when not performing a

multipurpose test;

h. using audit sampling for compliance testing of significant provisions of

applicable laws, regulations, contracts, and grant agreements, other than

attribute sampling using the tables in FAM 460, to determine sample size

when not performing a multipurpose test; and

i. placing complete or partial reliance on analytical procedures, using

performance materiality to calculate the limit, which is the amount of

difference between the expected and recorded amounts that can be accepted

without further investigation (see FAM 475).

Form, Content, and Extent of Audit Documentation

.28 Each phase of the FAM methodology includes documentation requirements (see

FAM 290, 390, 490, and 590). In addition, the auditor should prepare

documentation that ensures the following:

• The auditor should prepare audit documentation that is sufficient to

enable an experienced auditor, having no previous connection with the

audit, to understand (1) the nature, timing, and extent of the audit

procedures performed to comply with GAGAS; (2) the results of the audit

procedures performed and the audit evidence obtained; and (3)

significant findings or issues arising during the audit, the conclusions

reached thereon, and significant professional judgments made in

reaching those conclusions (AU-C 230.08).

• In documenting the nature, timing, and extent of audit procedures

performed, the auditor should record (a) the identifying characteristics of

the specific items or matters tested, (b) who performed the audit work and

the date such work was completed, and (c) who reviewed the audit work

performed and the date and extent of such review (AU-C 230.09). For

GAO, see Financial Audit Practice Memo #6 (Supplemental Financial

Audit Manual Guidance Applicable Only to GAO Engagements) for further

information on GAO’s policies regarding audit documentation and

reviews.

• The auditor should prepare audit documentation on a timely basis

(AU-C 230.07).

Introduction

110 – Overview of the FAM Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 110-10

• The auditor should adopt reasonable procedures to maintain the

confidentiality of client information (AU-C 230.19), such as physical

safeguards over hard copy client information and access restrictions to

information systems containing client information.

References to Positions

.29 Various sections of the FAM refer to consultation with audit management,

persons with the technical expertise to obtain approval or additional

guidance, or both. The auditor should document key consultations. Each

audit organization should have written evidence, in the audit documentation

or in its audit policy manual, of the specific positions of persons who will

perform these functions.

The following are references to positions at GAO; however, descriptions of

position responsibilities in relation to the audit are included so that the positions

or roles can be identified in other audit organizations. IGs performing audits or

using firms to perform audits in accordance with the FAM should clarify and

document the positions of the persons that the auditor should consult in various

circumstances.

a. The audit director (engagement partner or first partner) is responsible for the

quality of the financial statement audit and the audit report, reporting to the

assistant IG for the audit or, at GAO, to the managing director.

b. The assistant director is responsible for the operational conduct of the audit

and generally for preparation of the audit report. In public accounting firms,

the audit manager may have these responsibilities.

c. The reviewer (engagement quality control reviewer or second partner) is

responsible for providing negative assurance about the quality of the audit

and reports to the assistant IG for audit (or higher position) or, at GAO, is the

chief accountant or designee. The reviewer may consult with other personnel

as needed.

d. The audit sampling specialist is a statistician or other person the auditor

consults for technical expertise in areas such as audit sampling, audit sample

evaluation, and selecting entity field locations to test.

e. The IS controls auditor has technical expertise in information systems,

general controls, application controls, and information security. This person is

involved with the planning, directing, or performing of audit procedures

related to IS controls.

f. The information technology specialist possesses special skills or

knowledge in the information technology field that extend beyond the skills

and knowledge normally possessed by those working in specialized fields of

auditing, such as an IS controls auditor.

g. The technical accounting and auditing expert reports to the assistant IG

for audit or higher. At GAO, this is the chief accountant or other designated

expert. This expert advises on accounting and auditing professional matters

App. V of GAO, Federal Information System Controls Audit Manual (FISCAM), GAO-09-232G (Washington, D.C.:

February 2009), provides examples of the knowledge, skills, and abilities that an IS controls auditor should possess.

Introduction

110 – Overview of the FAM Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 110-11

and government-related issues. This person also may be the reviewer or may

review reports on financial statements and reports that express opinions on

financial information for compliance with professional auditing standards.

h. The Office of the General Counsel (OGC) advises the auditor in

(1) identifying significant provisions of applicable laws and regulations to test;

(2) identifying budget restrictions; and (3) identifying and resolving legal

issues encountered during the financial statement audit, such as evaluating

potential instances of noncompliance.

i. The Special Investigator Unit investigates specific allegations involving

conflict-of-interest and ethics matters, contract and procurement irregularities,

official misconduct and abuse, and fraud in federal programs or activities. In

the offices of the IGs, this is the investigation unit; at GAO, it is the Forensic

Audits and Investigative Service team. The Special Investigator Unit provides

assistance to the auditor by (1) informing the auditor of relevant pending or

completed investigations of the entity and (2) investigating possible instances

of fraud, waste, and abuse.

Using the Work of Others

.30 The auditor should consider whether specialized skills are needed to perform

the audit. If specialized skills are needed, the auditor should seek the

assistance of a professional possessing such skills, who either may be a

member of the auditor’s staff or an outside professional. In such

circumstances, the auditor should have sufficient knowledge to communicate

the objectives of the other professional’s work; evaluate whether the specified

audit procedures will meet the auditor’s objectives; and evaluate the results of

the audit procedures applied as they relate to the nature, timing, and extent of

further planned audit procedures (AU-C 300.12). See FAM 600 for guidance

in using the work of others.

Compliance with Policies in the FAM

.31 The following terms are used throughout the FAM (all volumes) to describe

the degree of compliance with the standard or policy:

• Must: Compliance is mandatory when the circumstances exist to which

the requirement is relevant. Most “musts” indicate unconditional

requirements that come directly from professional auditing standards,

while other instances of “must” are unique needs for the government

environment and, therefore, GAO/CIGIE determined them to be required.

• Should: Compliance is mandatory when the circumstances exist to which

the requirement is relevant, except in rare circumstances when the

specific procedure to be performed would be ineffective in achieving the

intent of the requirement (AU-C 200.26). The auditor must document

(1) the justification for any departure and (2) how the alternative audit

procedures performed were sufficient to achieve the intent of the

Audit organizations obtain legal counsel in a variety of ways, and each audit organization’s OGC size and

configuration can vary. In that regard, the designation of OGC in the FAM could include legal counsel in IG offices

that employ or hire their own legal counsel as well as the entity’s legal counsel.

Introduction

110 – Overview of the FAM Methodology

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 110-12

requirement or policy (AU-C 230.13). The documentation should be

approved by the reviewer.

• Generally should: Compliance is strongly encouraged when the

circumstances exist to which this policy is relevant. The auditor should

discuss any departure with the assistant director (or equivalent, such as

the audit manager in a public accounting firm) and document such

discussions.

• May, might, could: These terms are used in the FAM to provide further

explanation of and guidance for implementing audit requirements.

Compliance is optional. The auditor need not document compliance.

Use of Technical Terms

.32 The FAM uses many existing technical auditing terms and includes a

glossary of significant terms at the end of volume I.

Reference to Sections of the FAM

.33 When cited in audit documentation, correspondence, or other communication,

“FAM” may precede section or paragraph numbers. For example, this

paragraph is referred to as FAM 110.33.

Similar to the AICPA auditing standards, if the FAM states that a procedure or action is one that the auditor “should

consider,” determining whether to perform the procedure or action is required; however, performing the procedure or

action is not. Because this is a “should,” the auditor should document any reasons for not performing this procedure

and the alternative procedures performed to meet the objective. When the FAM lists factors that the auditor should

evaluate when making a judgment, the auditor is expected to use these factors to make an informed judgment.

However, the auditor may also consider other factors.

SECTION 200

Planning Phase

200 – Contents of the Planning Phase

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 200-1

Contents of the Planning Phase

Introduction FAM

• Overview of the FAM Methodology 110

Planning Phase FAM

• Overview of the Planning Phase 210

• Perform Preliminary Engagement Activities 215

• Understand the Entity’s Operations 220

• Perform Preliminary Analytical Procedures 225

• Determine Materiality 230

• Identify Significant Line Items, Accounts, and Assertions 235

• Identify Significant Accounting Applications, Cycles, and Financial Management Systems 240

• Identify Significant Provisions of Applicable Laws, Regulations, Contracts, and Grant Agreements 245

• Identify Relevant Budget Restrictions 250

• Identify Risk Factors 260

• Determine Likelihood of Effective IS Controls 270

• Identify Relevant Operations Controls to Evaluate and Test 275

• Plan Other Audit Procedures 280

• Plan Locations to Test 285

• Documentation 290

Internal Control Phase FAM

• Overview of the Internal Control Phase 310

• Understand Information Systems 320

• Identify Control Objectives 330

• Identify and Understand Relevant Control Activities 340

• Determine the Nature, Extent, and Timing of Tests of Controls and Compliance with FFMIA 350

• Perform Tests of Controls and Compliance with FFMIA 360

• Assess Internal Control on a Preliminary Basis 370

• Other Considerations 380

• Documentation 390

Testing Phase FAM

• Overview of the Testing Phase 410

• Design the Nature, Extent, and Timing of Further Audit Procedures 420

• Design Tests 430

• Perform Tests and Evaluate Results 440

• Perform Sampling Control Tests 450

• Perform Compliance Tests 460

• Perform Substantive Procedures -- Overview 470

• Perform Substantive Analytical Procedures 475

• Perform Substantive Detail Tests 480

• Documentation 490

Reporting Phase FAM

• Overview of the Reporting Phase 510

• Perform Overall Analytical Procedures 520

• Reassess Materiality and Risks of Material Misstatement 530

• Evaluate Effects of Misstatements on Financial Statements and Auditor’s Reports 540

• Audit Exposure (Further Evaluation of Audit Risk) 545

• Perform Other Reporting Phase Audit Procedures 550

• Determine Whether Financial Statement Presentation is in Accordance with U.S. GAAP 560

• Determine Compliance with GAO/CIGIE Financial Audit Manual 570

• Draft Reports 580

• Documentation 590

Planning Phase

210 – Overview of the Planning Phase

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 210-1

210 – Overview of the Planning Phase

.01 The objective of the auditor is to plan the audit so that it will be performed in an

effective manner (American Institute of Certified Public Accountants’ Clarified

Statements on Auditing Standards (AU-C) 300.04). The auditor should develop

effective and efficient ways to obtain the sufficient appropriate evidence

necessary to report on the entity’s

• financial statements, required supplementary information (RSI) (including

management’s discussion and analysis (MD&A)), and other information

included in the annual report;

• internal control over financial reporting;

• financial management systems’ substantial compliance with the three

requirements of the Federal Financial Management Improvement Act of 1996

(FFMIA) (for Chief Financial Officers Act of 1990 (CFO Act) agencies); and

• compliance with significant provisions of applicable laws, regulations,

contracts, and grant agreements.

The nature, extent, and timing of planning vary based on factors, such as the

entity’s size and complexity, the auditor’s experience with the entity, and the

auditor’s knowledge of entity operations.

.02 The FAM methodology overview in the contents outlines the procedures

performed in the planning phase of a financial audit to develop an overall

strategy for the audit. The engagement partner and other key members of the

engagement team should be involved in planning the audit, including planning

and participating in the discussion among engagement team members (AU-C

300.05). The engagement partner may delegate portions of the planning and

supervision of the audit to other members of the team (AU-C 300.A4).

.03 The auditor should establish an overall audit strategy that sets the scope, timing,

and direction of the audit and that guides the development of the audit plan

(AU-C 300.07). Although concentrated in the planning phase, planning is an

iterative process performed throughout the audit. For example, findings from the

internal control phase directly affect planning the substantive audit procedures.

Also, the results of control and substantive tests may require changes in the audit

strategy or audit plan. Thus, the auditor should update and change the overall

audit strategy and audit plan, as necessary, during the course of the audit

(AU-C 300.10).

.04 The auditor should consider whether specialized skills are needed in performing

the audit. If specialized skills are needed, the auditor should seek the assistance

of a professional possessing such skills who either may be a member of the

auditor’s staff or an outside professional. In such circumstances, the auditor

should have sufficient knowledge to communicate the objectives of the other

professional’s work; evaluate whether the specified audit procedures will meet

the auditor’s objectives; and evaluate the results of the audit procedures applied

In the FAM, “applicable laws, regulations, contracts, and grant agreements” refers to those laws, regulations,

contracts, and grant agreements that are applicable to the audited entity.

Planning Phase

210 – Overview of the Planning Phase

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 210-2

as they relate to the nature, timing, and extent of further planned audit

procedures (AU-C 300.12). See FAM 620 for guidance on the auditor's use of the

work of specialists in an audit. The engagement team and any specialists should,

collectively, have the appropriate competence and capabilities to perform the

audit in accordance with GAGAS and applicable legal and regulatory

requirements, and enable an auditor’s report that is appropriate in the

circumstances to be issued (AU-C 220.16).

.05 The auditor should plan the nature, timing, and extent of direction and

supervision of engagement team members and review of their work. The nature,

timing, and extent of the direction and supervision of the engagement team

members and review of their work vary, depending on many factors, including:

the size and complexity of the entity, the area of the audit (such as fraud and

accounting estimates), the assessed risks of material misstatement, and the

capabilities and competence of the individual team members performing the work

(AU-C 300.11 and AU-C 300.A18).

.06 The auditor should consider the needs of, and consult in a timely manner with,

other auditors who plan to use the work being performed, especially when

exercising significant professional judgment.

Planning Phase

215 – Perform Preliminary Engagement Activities

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215-1

215 – Perform Preliminary Engagement Activities

.01 The auditor should undertake the following activities at the beginning of the audit

(AU-C 300.06):

• Perform procedures regarding acceptance and continuance of the client

relationships and the audit engagement, as required by AU-C 220.

• Evaluate auditor’s compliance with relevant ethical requirements in

accordance with AU-C 220 and Government Auditing Standards, chapter 1,

“Foundation and Principles for the Use and Application of Government

Auditing Standards.”

• Establish an understanding of the terms of the engagement with

management

and, when appropriate, those charged with governance,

including establishing that certain preconditions for an audit are present, as

required by AU-C 210.

.02 In the federal environment, the “client” may include

• the management of the entity to be audited, including senior executives and

financial managers;

• the inspector general (IG), if the IG has contracted for the audit;

• the members of a board or commission responsible for the entity;

• the audit committee; or

• a combination of these.

The auditor should identify and document who is the client and those charged

with governance for each federal audit. The client and those charged with

governance may include multiple entities from this list. See FAM 215.27 for

additional guidance on identifying those charged with governance.

.03 For most entities, the Congress (including its committees) has an oversight role,

but typically it is not specifically responsible for or involved in overseeing the

entity’s financial reporting process and is not considered to be part of the entity’s

internal control. In these circumstances, the Congress (including its committees)

is not considered to be part of those charged with governance or an oversight

body for purposes of financial statement audits. Auditors should follow their audit

organization’s protocols or other policies for communicating with the Congress or

its committees. The auditor may decide to include some of the items listed in

Management refers to the persons with executive responsibility for the conduct of the entity’s operations. For some

entities, management includes some or all of those charged with governance, for example, senior executives.

Those charged with governance refers to those who have the responsibility for overseeing the strategic direction of

the entity and obligations related to the accountability of the entity, including overseeing the entity’s financial reporting

process. Accordingly, for these purposes, those charged with governance are considered part of the entity’s internal

control and may be members of a board or commission, an audit committee, the secretary of a cabinet-level

department, or senior executives and financial managers responsible for the entity. Although Standards for Internal

Control in the Federal Government (known as the Green Book) uses “oversight body” (defined as “Those responsible

for overseeing management’s design, implementation, and operation of an internal control system (paragraph

OV2.14).”), the FAM uses “those charged with governance” throughout.

Planning Phase

215 – Perform Preliminary Engagement Activities

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215-2

FAM 550.16 in the communication to the Congress or its committees, but the

auditor is not required to communicate these items.

.04 The auditor should communicate with management, those charged with

governance, and individuals contracting for or requesting the audit. When

auditors perform the audit pursuant to a law or regulation or they conduct the

work for the congressional committee that has oversight of the entity, the auditor

also should communicate with the congressional committee (GAGAS (2018)

6.06).

.05 Audits may be conducted under various legal authorities. For example, the audit

may be

• mandated by law;

• performed under an audit organization’s discretionary statutory legal

authority;

• performed under contract authority to procure audit services; or

• requested by a congressional committee(s), subcommittee(s), or member(s).

Acceptance and Continuance of Client Relationships and Audit

Engagements and Relevant Ethical Requirements

.06 The engagement partner should be satisfied that appropriate procedures

regarding the acceptance and continuance of client relationships and audit

engagements have been followed (AU-C 220.14). The audit organization

establishes these procedures as part of its system of quality control (AICPA

Professional Standards, Quality Control Section 10). The engagement partner

should also determine that the conclusions reached in performing the procedures

are appropriate (AU-C 220.14). The following information assists the

engagement partner in making this determination (AU-C 220.A7):

• the integrity of the principal owners, key management, and those charged

with governance of the entity;

• whether the engagement team is competent to perform the audit engagement

and has the necessary capabilities, including time and resources;

• whether the audit organization and the engagement team can comply with

relevant ethical requirements (AU-C 200.16); and

• significant findings or issues that have arisen during the current or previous

audit engagement and their implications for continuing the relationship.

.07 Relevant ethical requirements are those to which the engagement team and

engagement quality control reviewer are subject. These consist of generally

accepted government auditing standards (GAGAS), the American Institute of

Certified Public Accountants (AICPA) Code of Professional Conduct, and rules of

applicable state boards of accountancy and regulatory agencies (AU-C 220.09).

At the beginning of the engagement, the auditor should evaluate whether the

audit organization can comply with the legal and relevant ethical requirements in

performing the audit engagement (AU-C 300.06 and QC Section 10.27).

Throughout the audit engagement, the engagement partner and other members

of the engagement team should remain alert for evidence of noncompliance with

relevant ethical requirements by members of the engagement team (AU-C

Planning Phase

215 – Perform Preliminary Engagement Activities

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215-3

220.11). If matters come to the engagement partner's attention that indicate that

members of the engagement team have not complied with relevant ethical

requirements, the engagement partner, in consultation with others in the audit

organization as appropriate, should determine that appropriate action has been

taken (AU-C 220.12).

.08 The engagement partner should form a conclusion on compliance with

independence requirements that apply to the audit engagement by

• obtaining relevant information from the audit organization and, when

applicable, other audit organizations to identify and evaluate circumstances

and relationships that create threats to independence;

• evaluating information on identified breaches, if any, of the audit

organization’s independence policies and procedures to determine whether

they create a threat to independence for the audit; and

• taking appropriate action to eliminate such threats or reduce them to an

acceptable level by applying safeguards or, if considered appropriate, to

withdraw from the audit engagement when withdrawal is possible under

applicable law or regulation.

The engagement partner should promptly report to the audit organization any

inability to resolve the matter so that the organization may take appropriate

action. (AU-C 220.13 and GAGAS (2018) 3.27)

.09 In the federal environment, auditors may be appointed in accordance with law or

regulation, and as such, certain of the requirements and considerations regarding

the acceptance and continuance of client relationships and audit engagements

may not be relevant. Nonetheless, information gathered as a result of the

process described may be valuable in planning the audit, performing risk

assessments, and carrying out reporting responsibilities (AU-C 220.A8).

.10 The auditor’s consideration of client continuance and relevant ethical

requirements, including independence, occurs throughout the audit engagement

as conditions and changes in circumstances occur. Performing initial procedures

on both client continuance and evaluation of relevant ethical requirements

(including independence) at the beginning of the current audit engagement

means that they are completed prior to the performance of other significant

activities for the current audit engagement. For continuing audit engagements,

such initial procedures often begin shortly after (or in connection with) the

completion of the previous audit (AU-C 300.A8).

.11 For an initial audit engagement or reaudit engagement (financial statements

previously audited by a predecessor auditor), the auditor should request

management, or the organization that contracted the previous year’s audit (i.e.,

engaging party), to authorize the predecessor auditor to respond fully to the

auditor’s inquiries regarding matters that will assist the auditor in determining

whether to accept the engagement. If management refuses or limits the

response, the auditor should inquire about the reasons and consider the

implications in deciding whether to accept the engagement. The auditor should

also evaluate the predecessor auditor’s response, or consider the implications of

no response or a limited response, in determining whether to accept the

engagement (AU-C 210.11 through .12).

Planning Phase

215 – Perform Preliminary Engagement Activities

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215-4

.12 The communication with the predecessor auditor may be either written or oral.

Matters subject to the auditor’s inquiry of the predecessor auditor may include

the following (AU-C 210.A33):

• information that might bear on the integrity of management;

• disagreements with management about accounting policies, auditing

procedures, or other similarly significant matters;

• communications to those charged with governance regarding fraud and

noncompliance with significant provisions of applicable laws, regulations,

contracts, and grant agreements by the entity;

• communications to management and those charged with governance

regarding significant deficiencies and material weaknesses in internal control;

• the predecessor auditor’s understanding about the reasons for the change of

auditors; and

• the predecessor auditor’s understanding of the nature of the entity’s

relationships and transactions with disclosure entities, related parties, and

public-private partnerships,

and significant unusual transactions.

.13 The auditor should document the following related to acceptance and

continuance of clients and audit engagements and relevant ethical requirements

(AU-C 220.25 and GAGAS (2018) 3.107):

• conclusions reached regarding acceptance and continuance of the client

relationship and audit engagement;

• any issues identified with respect to compliance with relevant ethical

requirements and how they were resolved, including any threats to

independence and the safeguards applied; and

• conclusions on compliance with independence requirements that apply to the

audit engagement and any relevant discussions with the audit organization

that support the conclusions.

Preconditions for an Audit

.14 To establish whether the preconditions for an audit are present, the auditor

should determine whether the financial reporting framework to be applied in the

preparation of the financial statements is acceptable (AU-C 210.06a). An

applicable financial reporting framework (U.S. GAAP) provides the criteria for

management to present the financial statements of an entity, including the fair

presentation of those financial statements (AU-C 210.A2). The AICPA has

Under Federal Accounting Standards Advisory Board (FASAB) standards, organizations are considered to be

related parties if the existing relationship or one party to the existing relationship has the ability to exercise significant

influence over the other party’s policy decisions. In the federal government, there are additional relationships that

present risks similar to related parties, as defined by FASAB. These include disclosure entities and public-private

partnerships. Consequently, while the AICPA auditing standards address only related parties, the auditor should

apply audit procedures required for related parties to disclosure entities and public-private partnerships. Note that

FASAB and the Financial Accounting Standards Board (FASB) provide different definitions for related parties.

Procedures pertaining to disclosure entities and public-private partnerships do not apply to entities issuing financial

statements in accordance with FASB accounting standards.

Planning Phase

215 – Perform Preliminary Engagement Activities

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215-5

designated the Federal Accounting Standards Advisory Board (FASAB) as the

source of U.S. generally accepted accounting principles (U.S. GAAP) for federal

reporting entities. Effective for periods beginning after September 30, 2017,

federal reporting entities, currently defined in Statement of Federal Financial

Accounting Concepts 2, will be defined in Statement of Federal Financial

Accounting Standards (SFFAS) 47, Reporting Entity. As permitted by SFFAS 34,

The Hierarchy of Generally Accepted Accounting Principles, Including the

Application of Standards Issued by the Financial Accounting Standards Board,

some federal entities, including government corporations, prepare financial

statements in accordance with standards promulgated by the Financial

Accounting Standards Board (FASB). For further information on the requirements

for applying the FASB standards, see SFFAS 34.

Factors that are relevant to the auditor’s determination of the acceptability of the

financial reporting framework to be applied in the preparation of the financial

statements include the following (AU-C 210.A4):

• the nature of the entity (for example, whether it is a business enterprise, a

governmental entity, or a not-for-profit organization);

• the purpose of the financial statements (for example, whether they are

prepared to meet the common financial information needs of a wide range of

users);

• the nature of the financial statements (for example, whether the financial

statement are a complete set of financial statements or a single financial

statement); and

• whether law or regulation prescribes the applicable financial reporting

framework (U.S. GAAP).

.15 Additionally, the auditor should obtain the agreement of management that it

acknowledges and understands its responsibilities in a financial statement audit,

including responsibility for

• the preparation and fair presentation of the financial statements in

accordance with U.S. GAAP (or other applicable financial reporting

framework);

• the design, implementation, and maintenance of internal control relevant to

the preparation and fair presentation of financial statements that are free from

material misstatement, whether due to fraud or error (AU-C 210.06b); and

• compliance with provisions of laws, regulations, contracts, and grant

agreements applicable to the entity.

The auditor should also obtain the agreement of management that it

acknowledges and understands its responsibility to provide the auditor with

• access to all information of which management is aware that is relevant to the

preparation and fair presentation of the financial statements, such as records,

documentation, and other matters;

• additional information that the auditor may request from management for the

purpose of the audit; and

Planning Phase

215 – Perform Preliminary Engagement Activities

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215-6

• unrestricted access to persons within the entity from whom the auditor

determines it necessary to obtain audit evidence (AU-C 210.06b).

The example audit engagement letters in FAM 215 A include these and other

management responsibilities.

.16 Management’s agreement should be in writing and may be incorporated as part

of the audit engagement letter, as shown in the examples in FAM 215 A

(AU-C 210.10 and .A44). This agreement should generally be obtained from the

same officials whom the auditor will ask to sign the management representation

letter.

.17 If the preconditions for an audit, as discussed in FAM 215.14 through .15, are not

present, the auditor should discuss the matter with management. If the

preconditions for an audit have not been met, the auditor should not accept the

proposed audit engagement, unless required by law or regulation to do so

(AU-C 210.08). For federal financial statement audits, executive branch

departments, agencies, and other entities are required to prepare audited

financial statements under such laws as the Chief Financial Officers Act of 1990

(CFO Act), the Government Management Reform Act of 1994, or the

Accountability of Tax Dollars Act of 2002. Government corporations are required

to prepare audited financial statements under the Government Corporation

Control Act.

Agreement on the Terms of the Engagement

.18 The auditor should agree upon the terms of the engagement with management,

those charged with governance, or both, as appropriate (AU-C 210.09). When

the agreement on the terms of the engagement is only with those charged with

governance, the auditor is required to obtain management’s agreement that it

acknowledges and understands its responsibilities (AU-C 210.06 and .A21). The

auditor should document the agreed-upon terms in an audit engagement letter or

other suitable form of written agreement. The letter or written agreement should

include

• the required elements and wording in AU-C 210.10, related to the objectives

and scope;

• the responsibilities of both management and the auditor;

• a statement that because of the inherent limitations of an audit and internal

control, an unavoidable risk exists that some material misstatements may not

be detected, even though the audit is properly planned and performed in

accordance with GAGAS;

• identification of the applicable financial reporting framework for the

preparation of the financial statements (U.S. GAAP); and

• expected form and content of reports, including a statement that

circumstances may arise in which a report may differ from its expected form

and content.

Additionally, the letter generally states that the auditor will conduct the audit in

accordance with GAGAS, and if applicable, Office of Management and Budget

(OMB) audit guidance. Those standards and OMB audit guidance require that

the auditor plans and performs the audit to obtain reasonable, rather than

Planning Phase

215 – Perform Preliminary Engagement Activities

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215-7

absolute, assurance about whether financial statements are free of material

misstatement. Examples of an audit engagement letter are provided in

FAM 215 A.

.19 At a minimum, an audit includes obtaining an understanding of internal control

sufficient for planning the audit and determining the nature, timing, and extent of

audit procedures to be performed. Additional procedures may be required related

to testing the effectiveness of internal control if the audit is being conducted

under OMB audit guidance or if the auditor is providing an opinion on the

effectiveness of internal control over financial reporting. An auditor either

expresses an opinion on the effectiveness of internal control over financial

reporting or reports on the results of procedures performed, as discussed in FAM

580. The engagement letter or written agreement should include the auditor’s

responsibilities for testing and reporting on internal control over financial

reporting, including whether the auditor plans to express an opinion on the

effectiveness of internal control over financial reporting or report on the results of

procedures performed.

.20 The engagement letter or written agreement should include the auditor’s

responsibility for

• testing and reporting on compliance with significant provisions of laws,

regulations, contracts, or grant agreements applicable to the entity and

performing other limited procedures;

• testing and reporting on the entity’s financial management systems’

substantial compliance with the three Federal Financial Management

Improvement Act of 1996 (FFMIA) requirements (for CFO Act agencies); and

• applying certain limited procedures to any RSI, reading other information and

considering whether a material inconsistency exists between the other

information and the financial statements, and reporting the results.

.21 The letter may also communicate additional matters, such as the involvement of

others and fee and billing arrangements, although these may be addressed in

separate contractual documents.

.22 The engagement letter or written agreement is designed to avoid

misunderstandings between the entity to be audited, the IG if the audit is

contracted out by the IG, and the auditor. Where there is a contract, an

engagement letter may be unnecessary if all of the required elements in

AU-C 210.10 are included in the contract. If management is not a party to the

contract, the auditor should obtain management’s agreement with the terms of

the engagement, as discussed in FAM 215.18. If both an engagement letter and

a contract are prepared, the information that appears in these documents should

be consistent.

.23 The engagement letter or written agreement may provide that if management of

the entity to be audited does not agree with the terms of the audit reached

between the party contracting for the audit and the auditor, as documented in the

contract or engagement letter, entity management should promptly notify the

auditor. If management does not agree with the terms of the audit, the auditor

should promptly inform the party contracting for the audit.

.24 The auditor should not agree to a change in the terms of the audit engagement

when no reasonable justification for doing so exists (AU-C 210.14). If, prior to

Planning Phase

215 – Perform Preliminary Engagement Activities

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215-8

completing the audit engagement, the auditor is requested to change the audit

engagement to an engagement for which the auditor obtains a lower level of

assurance, the auditor should determine whether reasonable justification for

doing so exists (AU-C 210.15). If the terms of the audit engagement are

changed, the auditor and management should agree on and document the new

terms of the engagement in an engagement letter or other suitable form of written

agreement (AU-C 210.16).

.25 Based on AU-C 210.17, if the auditor concludes that no reasonable justification

for a change of the terms of the audit engagement exists and is not permitted by

management to continue the original audit engagement, the auditor should

• withdraw from the audit engagement when possible under applicable law or

regulation;

• communicate the circumstances to those charged with governance; and

• determine whether any obligation (e.g., legal, contractual, or ethical) exists to

report the circumstances to other parties.

Communicating with Those Charged with Governance

.26 The auditor should communicate clearly with those charged with governance.

Clear communication of specific matters required to be communicated is an

integral part of every audit. However, the auditor is not required to perform

procedures specifically to identify other significant matters to communicate with

those charged with governance (AU-C 260.05a and .A3).

.27 The auditor should determine the appropriate persons within the entity’s

governance structure with whom to communicate (AU-C 260.07). The

appropriate persons may vary depending on the matter to be communicated.

When the appropriate persons with whom to communicate are not clearly

identifiable, the auditor and the engaging party may need to discuss and agree

on the relevant persons within the entity’s governance structure with whom the

auditor will communicate (AU-C 260.A8). In situations where there is not a single

individual or group that both oversees the strategic direction of the entity and the

fulfillment of its accountability obligations, or in other situations where the identity

of those charged with governance is not clearly evident, the auditor should

document the process followed and conclusions reached for identifying

appropriate individuals to receive the required auditor communications.

.28 If the auditor communicates with a subgroup of those charged with governance,

such as an audit committee, or with an individual, the auditor should determine

whether it also needs to communicate with the governing body (AU-C 260.08).

AU-C 260.A10 through .A11 outline matters to consider when making this

judgment. When all of those charged with governance are involved with

managing the entity, the auditor should be satisfied that communication with

person(s) with management responsibilities adequately informs all of those with

whom the auditor would otherwise communicate in their governance capacity

(AU-C 260.09, .A10, and .A11).

.29 The auditor should communicate to those charged with governance (1) the

auditor’s responsibilities under GAGAS (see FAM 215.30 and .31); (2) an

overview of the planned scope and timing of the audit, including the significant

risks identified by the auditor (see FAM 215.32); (3) the nature of planned work

Planning Phase

215 – Perform Preliminary Engagement Activities

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215-9

and level of assurance provided related to internal control over financial reporting

and compliance with significant provisions of applicable laws, regulations,

contracts, and grant agreements; and (4) the form, timing, and expected general

content of communications. These matters may be communicated either orally or

in writing. The auditor may use the engagement letter, contract, or other written

communication, such as the example letter in FAM 215 B, as part of this

communication (AU-C 260.10, .11, .15, and .A48). (Note: GAO auditors should

use the engagement letter.)

.30 The auditor should communicate with those charged with governance the

auditor’s responsibilities under GAGAS, including that

• the auditor is responsible for forming and expressing an opinion about

whether the financial statements that have been prepared by management,

with the oversight of those charged with governance, are prepared, in all

material respects, in conformity with U.S. GAAP and

• the audit of the financial statements does not relieve management or those

charged with governance of their responsibilities (AU-C 260.10).

If the entity includes other information in its annual report, such as in a

performance and accountability report (PAR), agency financial report (AFR), or

annual management report (AMR), the auditor should communicate with those

charged with governance the auditor’s responsibility with respect to such other

information, the procedures performed relating to the other information, and the

results (AU-C 720.15).

.31 The auditor may also communicate to those charged with governance the

auditor’s responsibilities that were communicated with management, as

discussed in FAM 215.18 through .20. Additionally, the auditor may communicate

the auditor’s responsibility for communicating significant matters as well as the

limitations on this responsibility discussed in FAM 215.26 (AU-C 260.A13).

.32 The auditor should communicate with those charged with governance an

overview of the planned scope and timing of the audit (AU-C 260.11). However, it

is important for the auditor not to compromise the effectiveness of the audit,

particularly when some or all of those charged with governance are involved with

managing the entity. For example, communicating the nature and timing of

detailed audit procedures may reduce the effectiveness of those procedures by

making them too predictable. AU-C 260.A19 through .A24 provide guidance on

communicating the planned scope and timing of the audit, including additional

matters that the auditor may discuss with those charged with governance.

As part of communicating the planned scope and audit timing with those charged

with governance, the auditor should communicate the significant risks identified

by the auditor. Such communication helps those charged with governance

understand those matters and why they require special audit consideration. The

communication about significant risks may assist those charged with governance

in fulfilling their responsibility to oversee the financial reporting process (AU-C

260.11 and .A20). See FAM 260.44 for a discussion of significant risks.

.33 The auditor should communicate significant findings and issues from the audit to

those charged with governance, as discussed in FAM 550.16 and FAM 580. This

communication should be in writing if, in the auditor’s professional judgment, oral

communication would not be adequate. Matters that arose during the audit that

Planning Phase

215 – Perform Preliminary Engagement Activities

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215-10

were communicated to those charged with governance and satisfactorily

resolved do not need to be included in the communication. Factors that may

affect whether to communicate orally or in writing, the extent of detail or

summarization in the communication, and the formality of the communication are

discussed in AU-C 260.A48 through .A50 (AU-C 260.12, .13, .14, and .16).

.34 Management’s communication of these matters to those charged with

governance does not relieve the auditor of the responsibility to also communicate

with them. However, communication of these matters by management may affect

the form or timing of the auditor’s communication (AU-C 260.A2).

.35 The auditor’s clear communication of these matters helps establish the basis for

effective two-way communication. Matters that may contribute to the

effectiveness of two-way communication are included in AU-C 260.A44. As

discussed in FAM 550.19, the auditor should evaluate whether the two-way

communication between the auditor and those charged with governance has

been adequate for the purpose of the audit (AU-C 260.20).

.36 When matters in AU-C 260 discussed above are communicated in writing, the

auditor should describe in the communication the purpose of the auditor’s written

communication and state that the auditor’s written communication is not suitable

for any other purpose (AU-C 905.11).

.37 The auditor should communicate with those charged with governance on a timely

basis. AU-C 260.A51 through .A52 discuss factors relevant for determining the

timing of these communications (AU-C 260.19, .A51, and .A52).

.38 The auditor should document all required communications with those charged

with governance. If the communication was oral, the auditor should include in the

audit documentation when and to whom communication was made. If the

communication was written, the auditor should retain a copy of the

communication with the audit documentation. If, as part of its communication to

those charged with governance, management communicated some or all of the

matters the auditor is required to communicate, and as a result, the auditor did

not communicate these matters at the same level of detail as management, the

auditor should include a copy or summary of management’s communications

provided to those charged with governance in the audit documentation (AU-C

260.21).

Intent, Notification, and Commitment Letters

.39 The auditor’s internal procedures may provide for additional communication with

others in the form of an intent, notification, or commitment letter, as discussed

below. The auditor should send intent, notification, or commitment letters as

provided by the auditor’s protocols. The engagement letter may be able to be

used in place of certain of these letters.

.40 An intent letter is used by some auditors to acknowledge a congressional request

for any type of work. This letter may include

• acknowledgment of a meeting with congressional staff to understand the

request;

• indication of a survey of work or planning phase to understand the entity,

identify accounting or auditing issues, and determine the availability and

access to books and records, particularly for an initial engagement;

Planning Phase

215 – Perform Preliminary Engagement Activities

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215-11

• an estimated completion date for the planning phase;

• the auditor team performing the audit; and

• auditor contact names, phone numbers, and email addresses.

.41 A notification letter is used by some auditors to notify entities of new

engagements for any type of work. This letter may include

• the source of work (mandate, request, or auditor’s statutory discretionary

authority);

• objective(s) of the work;

• entities and locations to be contacted;

• the estimated start date;

• the estimated date of entrance conference;

• the auditor team performing the audit;

• auditor contact names, phone numbers, and email addresses; and

• engagement (job) code or other tracking number.

.42 A commitment letter is used by some auditors, either after a survey of work or the

planning phase has been completed, or to confirm a commitment to perform an

audit based on a congressional request, mandate, or auditor’s statutory

discretionary authority for any type of work. This letter may include

• a confirmation of the auditor’s commitment to perform work and issue a

report;

• an overview of the engagement approach, objective(s), and key aspects of

the work, including a separate survey of work or planning phase, if

conducted;

• the planned report issuance date;

• the auditor team performing the audit; and

• auditor contact names, phone numbers, and email addresses.

.43 For an agreed-upon procedure engagement, as discussed in FAM 710.04, the

auditor may issue an engagement letter unless covered by contract or other

written communication. An example letter for agreed-upon procedure

engagements is presented in FAM 710 A.

Planning Phase

215 A – Sample Audit Engagement Letter

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215 A-1

215 A – Sample Audit Engagement Letter

.01 As discussed in FAM 215.18, the engagement letter documents the audit’s

objectives and scope, the roles and responsibilities of both management and the

auditor, and other matters. Example 1 presents a sample audit engagement letter

when the auditor plans to provide an opinion on the effectiveness of an entity’s

internal control. Example 2 presents a sample audit engagement letter when the

auditor plans to report on the entity’s internal control and will not provide an

opinion.

In both sample letters, the audited entity has a fiscal year ending September 30.

The auditor should modify the sample letters, as needed, for the specific

circumstances of each audit.

Planning Phase

215 A – Sample Audit Engagement Letter

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215 A-2

Example 1 – Auditor Provides an Opinion on Effectiveness of an

Entity’s Internal Control over Financial Reporting

[Auditor letterhead]

[Date]

[Address to entity management; those charged with governance; the inspector

general if the audit has been contracted out to a certified public accounting firm;

or others, such as congressional committees, as appropriate.]

Dear _________________:

Pursuant to the [cite legal or contract authority for audit], the [name of auditor] will

audit, for fiscal year [20X2

], the financial statements of the [full name of the entity

(entity abbreviation)]. The job code for this audit is [XXXXXX] [non-GAO auditors

should omit or modify identifier as appropriate]. We confirm our acceptance and our

understanding of this audit engagement by means of this letter. The objectives and

scope of our integrated audits are as follows:

1. Express an opinion on whether [entity’s] financial statements as of and for the fiscal

years ended [September 30, 20X2, and 20X1], are presented fairly, in all material

respects, in accordance with U.S. generally accepted accounting principles.

2. Express an opinion on whether [entity] maintained, in all material respects, effective

internal control over financial reporting as of [September 30, 20X2], based on the

criteria established under 31 U.S.C. § 3512 (c), (d), commonly known as the Federal

Managers’ Financial Integrity Act of 1982 (FMFIA) [or other appropriate criteria].

3. Report on the results of our tests of [entity’s] compliance with selected provisions of

applicable laws, regulations, contracts, and grant agreements for fiscal year [20X2].

4. Report whether [entity’s] financial management systems comply substantially with

the three requirements of the Federal Financial Management Improvement Act of

1996 (FFMIA) as of [September 30, 20X2]. [If applicable]

Upon completion of our audit, we will issue a written report consistent with these

objectives. Circumstances may arise in which our report may differ from its expected

form and content based on the results of our audit. Depending on the nature of these

circumstances, it may be necessary for us to modify our opinions or add emphasis-of-

matter or other-matter paragraphs to our auditor’s report.

The purpose of our report[s] on compliance with laws, regulations, contracts, and grant

agreements [and financial management systems’ substantial compliance with

FFMIA requirements, if applicable] solely will be to describe the scope of our testing of

compliance with selected provisions of applicable laws, regulations, contracts, and grant

agreements [and financial management systems’ substantial compliance with

FFMIA requirements, if applicable], and the results of that testing, and not to provide

an opinion on compliance with applicable laws, regulations, contracts, and grant

agreements [or on financial management systems’ substantial compliance with

FFMIA requirements, if applicable]. Accordingly, our report[s] on compliance with

laws, regulations, contracts, and grant agreements [and financial management

Note to auditor: 20X2 denotes the current year, and 20X1 denotes the prior year, under audit.

Planning Phase

215 A – Sample Audit Engagement Letter

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215 A-3

systems’ substantial compliance with FFMIA requirements, if applicable] will not be

suitable for any other purpose.

[Modify the previous paragraph, as shown, if the auditor is engaged to provide an

opinion on compliance with applicable laws, regulations, contracts, and grant

agreements, or on the entity’s financial management systems’ substantial

compliance with FFMIA.]

Management’s Responsibilities

Our audit will be conducted on the basis that [entity’s] management acknowledges and

understands that it has responsibility for the following:

1. The preparation and fair presentation of [entity’s] financial statements, including

related notes, in accordance with U.S. generally accepted accounting principles.

2. Designing, implementing, and maintaining effective internal control over financial

reporting relevant to the preparation and fair presentation of financial statements that

are free from material misstatement, whether due to fraud or error.

3. Evaluating the effectiveness of [entity’s] internal control over financial reporting

based on the criteria established under FMFIA [or other appropriate criteria].

4. Its assessment about the effectiveness of internal control over financial reporting as

of [September 30, 20X2]. This includes providing management’s written

representation that it did not use the auditor’s procedures performed during the

integrated audits as part of the basis for its assessment on the effectiveness of

[entity’s] internal control over financial reporting.

5. Supporting its assessment about the effectiveness of [entity’s] internal control over

financial reporting with sufficient evaluations and documentation.

6. Complying with laws, regulations, contracts, and grant agreements applicable to

[entity].

7. Preparing, measuring, and presenting the required supplementary information (RSI)

in accordance with prescribed guidelines established in U.S. generally accepted

accounting principles.

8. Preparing and presenting other information included in [entity’s] [insert name of

annual report, e.g., agency financial report], and ensuring the consistency of that

information with the audited financial statements and RSI.

9. Designing, implementing, and maintaining effective internal controls to prevent and

detect fraud. This includes providing management’s written representation that it has

disclosed to the auditor the results of its assessment of the risk that the financial

statements may be materially misstated as a result of fraud.

10. Maintaining adequate accounting records, selecting and applying appropriate

accounting policies, and safeguarding U.S. government assets related to [entity’s]

operations.

11. [For entities that conform to FASB standards (see FAM 550.28 and .29)]

Evaluating whether there are conditions or events, considered in the aggregate, that

raise substantial doubt about [entity’s] ability to continue as a going concern for a

reasonable period of time.

12. Ensuring that [entity’s] financial management systems comply substantially with

FFMIA requirements [if applicable].

Planning Phase

215 A – Sample Audit Engagement Letter

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215 A-4

In addition, [entity’s] management acknowledges and understands that it has the

responsibility to provide us with

1. access to all information, such as records, documentation, and other matters, of

which management is aware that is relevant to the (1) preparation and fair

presentation of the financial statements, including related notes; (2) measurement,

preparation, and presentation of the RSI; and (3) preparation and presentation of

other information;

2. additional information that we may request from management for the purpose of the

audit, including but not limited to

a. minutes of meetings, or summaries of actions of recent meetings for which

minutes have not been prepared, of the [Board of Directors or other similar

bodies of those charged with governance] and

b. any communications from the Office of Management and Budget (OMB) or the

Department of the Treasury’s Bureau of the Fiscal Service concerning

noncompliance with, or deficiencies in, financial reporting practices;

3. unrestricted access to and full cooperation of personnel within [entity] from whom

we determine it necessary to obtain audit evidence; and

4. any reports obtained from [entity]’s service organizations.

[Entity] management agrees to communicate to us

1. the discovery of any material misstatement that would affect the fair presentation of

its fiscal year [20X2] or prior fiscal year’s financial statements;

2. any deficiencies in the design or operation of internal control over financial reporting

as of [September 30, 20X2], including separately identifying any deficiencies

management believes to be significant deficiencies or material weaknesses;

3. a description of fraud or suspected fraud that affects [entity] and involves (1)

management, (2) employees who have significant roles in internal control over

financial reporting, or (3) others when the fraud could have a material effect on the

financial statements;

4. any instances of noncompliance or suspected noncompliance with laws, regulations,

contracts, and grant agreements applicable to [entity] whose effects should be

considered when preparing the financial statements;

5. any violations, or potential violations, of the Antideficiency Act for the years ended

[September 30, 20X2, and 20X1] and through the date of the management

representation letter. Potential violations are limited to those that, if true, could have

a material effect on the financial statements;

A deficiency in internal control exists when the design or operation of a control does not allow management or

employees, in the normal course of performing their assigned functions, to prevent, or detect and correct,

misstatements on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal

control over financial reporting that is less severe than a material weakness yet important enough to merit attention

by those charged with governance. A material weakness is a deficiency, or a combination of deficiencies, in internal

control over financial reporting, such that there is a reasonable possibility that a material misstatement of the entity’s

financial statements will not be prevented, or detected and corrected, on a timely basis.

Planning Phase

215 A – Sample Audit Engagement Letter

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215 A-5

6. any known actual or possible litigation, claims, and assessments, including those

related to treaties and other international agreements, whose effects should be

considered when preparing the financial statements;

7. the identities of [entity’s] disclosure entities, related parties, and public-private

partnerships, and all the relationships and transactions related to them;

8. any events or transactions subsequent to the date of the financial statements, and

for which U.S. generally accepted accounting principles require adjustment or

disclosure;

9. whether, subsequent to [September 30, 20X2], there were any changes in internal

control over financial reporting or other conditions that might significantly affect

internal control over financial reporting, including any corrective actions taken with

regard to material weaknesses or significant deficiencies; and

10. any planned inclusion of our auditor’s reports and the audited financial statements in

documents prepared by [entity] and to provide a copy of any such documents prior

to issuance.

As part of our audit process, we will request from [entity] management written

confirmation concerning representations made to us in connection with the audit of the

financial statements, including internal control over financial reporting; compliance with

applicable laws, regulations, contracts, and grant agreements; and other related matters.

[Optional – The auditor may choose to make management aware of other specific

required written management representations. Factors to consider include initial

audits, changes in senior management, or changes in required representations.]

Definition and Inherent Limitations of Internal Control over Financial Reporting

An entity’s internal control over financial reporting is a process effected by those charged

with governance, management, and other personnel. The objectives of internal control

over financial reporting are to provide reasonable assurance that (1) transactions are

properly recorded, processed, and summarized to permit the preparation of financial

statements in accordance with U.S. generally accepted accounting principles, and

assets are safeguarded against loss from unauthorized acquisition, use, or disposition,

and (2) transactions are executed in accordance with provisions of applicable laws,

including those governing the use of budget authority, regulations, contracts, and grant

agreements, noncompliance with which could have a material effect on the financial

statements.

Because of its inherent limitations, internal control over financial reporting may not

prevent, or detect and correct, misstatements due to fraud or error. We also caution that

projecting any evaluation of effectiveness to future periods is subject to the risk that

controls may become inadequate because of changes in conditions or that the degree of

compliance with the policies or procedures may deteriorate.

Auditor’s Responsibilities

We are responsible for conducting our audits in accordance with U.S. generally

accepted government auditing standards [and OMB audit guidance, if applicable].

Those standards require that we plan and perform the audits to obtain reasonable

assurance about whether (1) the financial statements as a whole are free from material

Note to auditor: Procedures related to disclosure entities and public-private partnerships do not apply to entities

issuing financial statements in accordance with FASB accounting standards.

Planning Phase

215 A – Sample Audit Engagement Letter

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215 A-6

misstatement, whether due to fraud or error, and (2) effective internal control over

financial reporting was maintained in all material respects. Reasonable assurance is a

high level of assurance but is not absolute assurance and therefore is not a guarantee

that an audit of the financial statements or an audit of internal control over financial

reporting conducted in accordance with U.S. generally accepted government auditing

standards will always detect a material misstatement or a material weakness when it

exists.

The risk of not detecting a material misstatement resulting from fraud is higher

than for one resulting from error, as fraud may involve collusion, forgery, intentional

omissions, misrepresentations, or the override of internal control. Misstatements,

including omissions, are considered to be material if there is a substantial likelihood that,

individually or in the aggregate, they would influence the judgment made by a

reasonable user based on the financial statements.

We are required to be independent of [entity] and to meet our other ethical

responsibilities, in accordance with the relevant ethical requirements relating to our

audits.

In performing an audit of the financial statements and an audit of internal control over

financial reporting in accordance with U.S. generally accepted government auditing

standards, we will do the following:

1. Exercise professional judgment and maintain professional skepticism throughout the

audits.

2. Identify and assess the risks of material misstatement of the financial statements,

whether due to fraud or error, and design and perform audit procedures responsive

to those risks. Such procedures include examining, on a test basis, evidence

regarding the amounts and disclosures in the financial statements in order to obtain

audit evidence that is sufficient and appropriate to provide a basis for our opinion.

3. Obtain an understanding of internal control relevant to the financial statement audit in

order to design audit procedures that are appropriate in the circumstances.

4. Obtain an understanding of internal control over financial reporting relevant to the

audit of internal control over financial reporting, assess the risks that a material

weakness exists, and test and evaluate the design and operating effectiveness of

internal control over financial reporting based on the assessed risk. Our audit of

internal control will also consider [entity’s] process for evaluating and reporting on

internal control over financial reporting based on criteria established under FMFIA

[or other appropriate criteria]. We will not evaluate all internal controls relevant to

operating objectives as broadly established under FMFIA [or other appropriate

criteria], such as those controls relevant to preparing performance information and

ensuring efficient operations. We will limit our internal control testing to testing

controls over financial reporting. Our internal control testing will be for the purpose of

expressing an opinion on whether effective internal control over financial reporting

was maintained, in all material respects, as of [September 30, 20X2]. Consequently,

our audit may not identify all deficiencies in internal control over financial reporting

that are less severe than a material weakness.

Note to auditor: Statement of Federal Financial Accounting Concepts (SFFAC) 1 issued by FASAB provides a

slightly different definition of materiality. Since SFFACs are nonauthoritative, and in SFFAC 1, the board recognizes

differences from the audit definition, the FAM is based on the definition provided in AU-C 200.07.

Planning Phase

215 A – Sample Audit Engagement Letter

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215 A-7

5. Evaluate the appropriateness of accounting policies used and the reasonableness of

significant accounting estimates made by management, as well as evaluate the

overall presentation of the financial statements.

6. Perform other procedures we consider necessary in the circumstances.

7. [For entities that conform to FASB standards (see FAM 550.28 and .29)]

Conclude, based on the audit evidence obtained, whether there are conditions or

events, considered in the aggregate, that raise substantial doubt about [entity’s]

ability to continue as a going concern for a reasonable period of time.

Because of the inherent limitations of an audit, together with the inherent limitations of

internal control, an unavoidable risk exists that some material misstatements in the

financial statements may not be detected, even though the audit is properly planned and

performed in accordance with U.S. generally accepted government auditing standards.

We will communicate all deficiencies of which we become aware. We are responsible for

communicating in writing to those charged with governance any significant deficiencies

and material weaknesses in internal control that come to our attention as a result of the

audit. If we identify deficiencies in [entity’s] internal control that we do not consider to be

material weaknesses or significant deficiencies, we will communicate these matters in

writing to management and, where appropriate, will report on them separately.

In accordance with U.S. generally accepted government auditing standards, we are

responsible for testing compliance with selected provisions of laws, regulations,

contracts, and grant agreements applicable to [entity] that have a direct effect on the

determination of material amounts in [entity’s] financial statements and performing

certain other limited procedures as part of our audits.

We will not test compliance with

all laws, regulations, contracts, and grant agreements applicable to [entity]. We caution

that noncompliance may occur and not be detected by these tests.

We are also responsible for (1) testing and reporting on whether [entity’s] financial

management systems comply substantially with the three FFMIA requirements [if

applicable] and (2) applying certain limited procedures to any RSI, reading other

information included in [entity’s] [insert name of annual report, e.g., agency financial

report] and considering whether a material inconsistency exists between the other

information and the financial statements, and reporting the results.

Audit Coordination and Other Matters

To use audit resources efficiently and expedite audit completion, we will work with

[entity] staff to obtain information needed for the audit. Assistance needed from [entity]

staff may include preparing schedules or analyses; locating, copying, and providing

selected documents; and participating in meetings. We will need draft financial

statements, including all information relevant to their preparation and fair presentation,

whether obtained from within or outside of the general and subsidiary ledgers (including

all information relevant to the preparation and fair presentation of note disclosures), and

any other information to be included in [entity’s] [insert name of annual report, e.g.,

agency financial report] in sufficient time for us to complete our audit in accordance

with the proposed timetable. We will discuss this assistance with [entity] staff and arrive

at mutually acceptable time frames.

Note to auditor: If applicable, include sentence to add tests of laws and regulations listed in OMB audit guidance that

the auditor deems applicable to the financial statements.

Planning Phase

215 A – Sample Audit Engagement Letter

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215 A-8

We will conduct an entrance conference with [entity] staff on [or by] [date]. We plan to

issue our report on a mutually agreed-upon date. [Insert any additional details as

appropriate regarding report timing.] We will also provide periodic status reports on

our work upon your request. If we encounter problems that will affect the reporting date,

we will discuss them with you in a timely manner. We look forward to working with

[entity] and appreciate its cooperation in working with us to complete the audit in a

timely manner.

Pursuant to [include reference to audit reimbursement authority], our audit of

[entity] is performed on a reimbursable basis. The total cost to perform the fiscal year

[20X2] audit will depend on the nature of the issues we identify and the amount of staff

resources needed to complete the audit. [Consider including additional details as

appropriate for any contracted services to be reimbursed, such as those for

information systems controls or specialists.] We plan to submit a bill to you each

month reflecting the actual costs incurred.

This assignment will be conducted under my direction, with assistance from [name and

title of manager], who can be reached at [phone number] or by email at [email], and

[name and title of site auditor], who can be reached at [phone number] or by email at

[email].

The attached acknowledgment page should be signed by management [and the

addressee, if contracting party is other than management] and returned to us to

indicate your acknowledgment of, and agreement with, the terms and arrangements of

our audit of the financial statements and to indicate management’s acknowledgment and

understanding of our respective responsibilities.

Should this letter not represent your understanding of the nature of this engagement, or

should you have any questions or need further information, please contact me at [phone

number] or by email at [email].

We look forward to a successful engagement.

Sincerely yours,

[Auditor’s name and title]

cc: CFO of [entity]

Inspector General of [entity]

[Others, as applicable]

Planning Phase

215 A – Sample Audit Engagement Letter

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215 A-9

Management’s Acknowledgment of the Audit Engagement Terms

On behalf of [entity] and its management, I acknowledge and agree to the (1) terms and

arrangements described above for the audit of [entity]’s financial statements, including

our respective responsibilities, and (2) auditor’s scope of work and related reporting on

[entity]’s

• financial statements, required supplementary information (including management’s

discussion and analysis) [omit if not applicable], and other information to be

included in [entity’s] [insert name of annual report, e.g., agency financial report]

[omit if not applicable];

• internal control over financial reporting;

• financial management systems’ substantial compliance with the three requirements

of the Federal Financial Management Improvement Act of 1996 [omit if not

applicable]; and

• compliance with laws, regulations, contracts, and grant agreements.

_______________________________________ _____________________

Signature Date

[Name and Title]

_______________________________________ _____________________

Signature Date

[Name and Title]

[NOTE: REQUIRED TO BE SIGNED BY MANAGEMENT. SIGNERS SHOULD

GENERALLY BE THE SAME OFFICIALS WHOM THE AUDITOR WILL REQUEST

SIGN THE MANAGEMENT REPRESENTATION LETTER. MAY INCLUDE

ADDITIONAL PARTIES INVOLVED WITH CONTRACTING FOR THE AUDIT.]

Planning Phase

215 A – Sample Audit Engagement Letter

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215 A-10

Example 2 – Auditor Does Not Provide an Opinion on Entity’s

Internal Control over Financial Reporting

[Auditor letterhead]

[Date]

[Address to entity management; those charged with governance; the inspector

general if the audit has been contracted out to a certified public accounting firm;

or others, such as congressional committees, as appropriate.]

Dear _________________:

Pursuant to the [cite legal or contract authority for audit], the [name of auditor] will

audit, for fiscal year [20X2

], the financial statements of the [full name of the entity

(entity abbreviation)]. The job code for this audit is [XXXXXX] [non-GAO auditors

should omit or modify identifier as appropriate]. We confirm our acceptance and our

understanding of this audit engagement by means of this letter. The objectives and

scope of our audits are as follows:

1. Express an opinion on whether [entity]’s financial statements as of and for the fiscal

years ended [September 30, 20X2, and 20X1], are presented fairly, in all material

respects, in accordance with U.S. generally accepted accounting principles.

2. Report any significant deficiencies and material weaknesses in internal control over

financial reporting for fiscal year [20X2] that come to our attention as a result of the

audit.

3. Report on the results of our tests of [entity’s] compliance with selected provisions of

applicable laws, regulations, contracts, and grant agreements for fiscal year [20X2].

4. Report whether [entity’s] financial management systems comply substantially with

the requirements of the Federal Financial Management Improvement Act of 1996

(FFMIA) as of [September 30, 20X2]. [If applicable.]

Upon completion of our audit, we will issue a written report consistent with these

objectives. Circumstances may arise in which our report may differ from its expected

form and content based on the results of our audit. Depending on the nature of these

circumstances, it may be necessary for us to modify our opinion or add emphasis-of-

matter or other-matter paragraphs to our auditor’s report.

The purpose of our report[s] on internal control and compliance with laws, regulations,

contracts, and grant agreements [and financial management systems’ substantial

compliance with FFMIA requirements, if applicable] solely will be to describe the

scope of our testing of internal control and compliance with selected provisions of

applicable laws, regulations, contracts, and grant agreements [and FFMIA

requirements, if applicable], and the results of that testing, and not to provide an

Note to auditor: 20X2 denotes the current year, and 20X1 denotes the prior year, under audit.

A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over financial reporting

that is less severe than a material weakness, yet important enough to merit attention by those charged with

governance. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial

reporting, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements

will not be prevented, or detected and corrected, on a timely basis. A deficiency in internal control exists when the

design or operation of a control does not allow management or employees, in the normal course of performing their

assigned functions, to prevent, or detect and correct, misstatements on a timely basis.

Planning Phase

215 A – Sample Audit Engagement Letter

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215 A-11

opinion on the effectiveness of internal control over financial reporting or compliance

with applicable laws, regulations, contracts, and grant agreements [or on financial

management systems’ substantial compliance with FFMIA requirements, if

applicable]. Accordingly, our report[s] on internal control and compliance with laws,

regulations, contracts, and grant agreements [and financial management systems’

substantial compliance with FFMIA requirements, if applicable] will not be suitable

for any other purpose.

[Modify the previous paragraph, as shown, if the auditor is engaged to provide an

opinion on compliance with applicable laws, regulations, contracts, and grant

agreements, or on the entity’s financial management systems’ substantial

compliance with FFMIA.]

Management’s Responsibilities

Our audit will be conducted on the basis that [entity’s] management acknowledges and

understands that it has responsibility for the following:

1. The preparation and fair presentation of [entity’s] financial statements, including

related notes, in accordance with U.S. generally accepted accounting principles.

2. Designing, implementing, and maintaining effective internal control over financial

reporting relevant to the preparation and fair presentation of financial statements that

are free from material misstatement, whether due to fraud or error.

3. Complying with laws, regulations, contracts, and grant agreements applicable to

[entity].

4. Preparing, measuring, and presenting the required supplementary information (RSI)

in accordance with prescribed guidelines established in U.S. generally accepted

accounting principles.

5. Preparing and presenting other information included in [entity’s] [insert name of

annual report, e.g., agency financial report], and ensuring the consistency of that

information with the audited financial statements and the RSI.

6. Designing, implementing, and maintaining effective internal controls to prevent and

detect fraud. This includes providing management’s written representation that it has

disclosed to the auditor the results of its assessment of the risk that the financial

statements may be materially misstated as a result of fraud.

7. Maintaining adequate accounting records, selecting and applying appropriate

accounting policies, and safeguarding U.S. government assets related to [entity’s]

operations.

8. [For entities that conform to FASB standards (see FAM 550.28 and .29)]

Evaluating whether there are conditions or events, considered in the aggregate, that

raise substantial doubt about [entity’s] ability to continue as a going concern for a

reasonable period of time.

9. Ensuring that [entity’s] financial management systems comply substantially with

FFMIA requirements [if applicable].

In addition, [entity]’s management acknowledges and understands that it has the

responsibility to provide us with

Planning Phase

215 A – Sample Audit Engagement Letter

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215 A-12

1. access to all information, such as records, documentation, and other matters, of

which management is aware that is relevant to the (1) preparation and fair

presentation of the financial statements, including related notes; (2) measurement,

preparation, and presentation of the RSI; and (3) preparation and presentation of

other information;

2. additional information that we may request from management for the purpose of the

audit, including but not limited to

a. minutes of meetings, or summaries of actions of recent meetings for which

minutes have not been prepared, of the [Board of Directors or other similar

bodies of those charged with governance] and

b. any communications from the Office of Management and Budget (OMB) or the

Department of the Treasury’s Bureau of the Fiscal Service concerning

noncompliance with, or deficiencies in, financial reporting practices;

3. unrestricted access to and full cooperation of personnel within [entity] from whom

we determine it necessary to obtain audit evidence; and

4. any reports obtained from [entity]’s service organizations.

[Entity] management agrees to communicate to us the following:

1. the discovery of any material misstatement that would affect the fair presentation of

its fiscal year [20X2] or prior fiscal year’s financial statements;

2. any deficiencies in the design or operation of internal control over financial reporting

as of [September 30, 20X2], including separately identifying any deficiencies

management believes to be significant deficiencies or material weaknesses;

3. a description of fraud or suspected fraud that affects [entity] and involves (1)

management; (2) employees who have significant roles in internal control over

financial reporting, or (3) others when the fraud could have a material effect on the

financial statements;

4. any instances of noncompliance or suspected noncompliance with laws, regulations,

contracts, and grant agreements applicable to [entity] whose effects should be

considered when preparing the financial statements;

5. any violations, or potential violations, of the Antideficiency Act for the years ended

[September 30, 20X2, and 20X1] and through the date of the management

representation letter. Potential violations are limited to those that, if true, could have

a material effect on the financial statements;

6. any known actual or possible litigation, claims, and assessments, including those

related to treaties and other international agreements, whose effects should be

considered when preparing the financial statements;

7. the identities of [entity’s] disclosure entities, related parties, and public-private

partnerships, and all the relationships and transactions related to them;

8. any events or transactions subsequent to the date of the financial statements, and

for which U.S. generally accepted accounting principles require adjustment or

disclosure;

Note to auditor: Procedures related to disclosure entities and public-private partnerships do not apply to entities

issuing financial statements in accordance with FASB accounting standards.

Planning Phase

215 A – Sample Audit Engagement Letter

Updated May 2023 GAO/CIGIE Financial Audit Manual Page 215 A-13

9. whether, subsequent to [September 30, 20X2], there were any changes in internal

control over financial reporting or other conditions that might significantly affect

internal control over financial reporting, including any corrective actions taken with

regard to material weaknesses or significant deficiencies; and

10. any planned inclusion of our auditor’s reports and the audited financial statements in

documents prepared by [entity] and to provide a copy of any such documents prior

to issuance.

As part of our audit process, we will request from [entity] management written

confirmation concerning representations made to us in connection with the audit of the

financial statements, including internal control over financial reporting; compliance with

applicable laws, regulations, contracts, and grant agreements; and other related matters.

[Optional – The auditor may choose to make management aware of other specific

required written management representations. Factors to consider include initial

audits, changes in senior management, or changes in required representations.]

Definition and Limitations of Internal Control over Financial Reporting