External Review of Quality Control Systems

The Office of Inspector General (OIG) - Assistant Inspector General for Audit directs, conducts, supervises and coordinates audits. In carrying out these responsibilities, the Inspector General Act of 1978 as amended requires that OIG comply with standards established by the Comptroller General of the United States.

Requirement

Government Auditing Standards (GAS), commonly known as "The Yellow Book," require that an audit organization must have an effective quality control system that provides assurance of the quality of its products and that the audit work complies with the standards. Specifically, GAS states:

"Each audit organization performing audits and/or attestation engagements in accordance with GAS must:

• Establish a system of quality control that is designed to provide the audit organization with reasonable assurance that the organization and its personnel comply with professional standards and applicable legal and regulatory requirements, and
• Have an external peer review at least once every 3 years." (paragraph 3.50)

Quality Control System

The GAS also describes the characteristics of a quality control system:

"An audit organization's system of quality control encompasses the audit organization's leadership, emphasis on performing high quality work, and the organization's policies and procedures designed to provide reasonable assurance of complying with professional standards and applicable legal and regulatory requirements. The nature, extent, and formality of an audit organization's quality control system will vary based on the audit organization's circumstances, such as the audit organization's size, number of offices and geographic dispersion, the knowledge and experience of its personnel, the nature and complexity of its audit work, and cost benefit considerations." (paragraph 3.51)

"... The audit organization should document compliance with its quality control policies and procedures and maintain such documentation for a period of time sufficient to enable those performing monitoring procedures and peer reviews to evaluate the extent of the audit organization's compliance with its quality control policies and procedures..." (paragraph 3.52)

An audit organization should include policies and procedures in its system of quality control that collectively address:

• Leadership responsibilities for quality ...
• Independence, legal, and ethical requirements ...
• Initiation, acceptance, and continuance of audit and attestation engagements ...
• Human resources with the capabilities and competence to perform its audits ...
• Audit and attestation engagement performance, documentation, and reporting ...
• Monitoring of quality ...(paragraph 3.53)

Lastly, the audit organization should analyze and summarize the results of its monitoring procedures at least annually. The analysis should include identification of any systemic issues needing improvement, along with recommendations for corrective action. (paragraph 3.54)

External Quality Control Reviews

The GAS requires that the audit organization have an external review of its quality control system:

"Audit organizations performing audits and attestation engagements in accordance with GAS must have an external peer review performed by reviewers independent of the audit organization being reviewed at least once every 3 years." (paragraph 3.55)

The objectives of the peer review are to determine whether the organization's system of quality control was suitably designed and whether the organization is complying with its quality control system in order to provide the organization with reasonable assurance of conforming with applicable professional standards. (paragraph 3.56)